CRISC Practice Test 36 — 15 Questions

Question 1

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement compensating controls. When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 2

An organization uses the FAIR (Factor Analysis of Information Risk) model to quantify cyber risk. Which of the following is the correct definition of 'Loss Magnitude' in the FAIR model?

Accepted Answer

The probable financial impact of a cyber incident. In FAIR, Loss Magnitude represents the probable financial impact resulting from a loss event — it quantifies how much money an organization would lose if a threat event materializes into a loss. It is one of the two primary factors (alongside Loss Event Frequency) that combine to produce risk. It encompasses primary and secondary loss forms across productivity, response, replacement, fines, and reputation.

Answer

The cost of implementing security controls

Answer

The number of records compromised in a data breach

Answer

The probability that a threat event will occur

Question 3

Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system (IDS) alerts. An intrusion detection system (IDS) monitors network traffic for suspicious activity and generates alerts when it detects potential threats. This is a detective control because it identifies and reports security incidents after they occur, rather than preventing them. IDS alerts provide visibility into ongoing or past attacks, enabling incident response.

Answer

Backup restoration after data loss

Answer

Firewall rules blocking unauthorized traffic

Answer

Requiring two-factor authentication

Question 4

A company is assessing a new vendor that will have access to its customer database. The vendor's security questionnaire reveals they lack SOC 2 certification. According to risk tiering, the vendor is classified as critical. What should the company do?

Accepted Answer

Require the vendor to obtain SOC 2 Type II certification before contract signing.. A critical-tier vendor with access to sensitive customer data requires independent assurance of security controls. SOC 2 Type II certification provides a rigorous, audited assessment of controls over a period of time, which is essential for a high-risk vendor. Requiring this certification before contract signing ensures the vendor meets the necessary security baseline before any data is exposed.

Answer

Accept the vendor because the questionnaire indicates other strong controls.

Answer

Proceed with the contract but increase monitoring frequency.

Answer

Lower the vendor's tier to medium to avoid the requirement.

Question 5

A risk manager notices that a key risk indicator (KRI) for network downtime has been steadily increasing over the past three months. The current value is 15% above the risk tolerance threshold. Which of the following is the BEST immediate action?

Accepted Answer

Alert the risk owner and initiate a root cause analysis. The KRI has exceeded the risk tolerance threshold, indicating a potential control failure or emerging threat. The immediate action is to alert the risk owner, who has accountability for the risk, and initiate a root cause analysis to identify why network downtime is increasing. This aligns with the CRISC process of monitoring KRIs and escalating when thresholds are breached.

Answer

Lower the risk tolerance threshold to trigger more frequent alerts

Answer

Accept the increased risk without further analysis because the trend is gradual

Answer

Increase the risk tolerance threshold to match the current level

Question 6

During a threat modeling exercise using the STRIDE methodology, a security analyst identifies a threat where an attacker can modify data in transit between a web server and database. Which STRIDE category does this threat belong to?

Accepted Answer

Tampering. Tampering involves unauthorized modification of data, which is the 'T' in STRIDE.

Answer

Repudiation

Answer

Spoofing

Answer

Information Disclosure

Question 7

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. The [CORRECT] answer is A. NERC CIP standards (specifically CIP-005) mandate the establishment and protection of Electronic Security Perimeters (ESPs) around critical cyber assets. Connecting a remote substation's OT network to the corporate WAN inherently crosses an ESP boundary, requiring strict controls such as firewalls, access control lists, and monitored electronic access points. Failure to properly define and secure the ESP is a direct compliance violation and the most significant risk because it exposes critical infrastructure to cyber threats.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols

Question 8

Which type of control testing is typically performed on a continuous basis using automated tools?

Accepted Answer

Continuous monitoring. Continuous monitoring is the control testing approach performed on an ongoing, automated basis using tools such as SIEM, configuration compliance scanners, and automated control assessment platforms. It provides real-time or near-real-time assurance that controls remain effective, unlike periodic manual reviews. This matches the question's description of continuous, automated testing.

Answer

Annual penetration test

Answer

Manual control walkthrough

Answer

Quarterly internal audit review

Question 9

Which TWO of the following are types of insider threats?

Accepted Answer

Malicious. Insider threats can be malicious (intentional harm) or negligent (unintentional mistakes).

Answer

Nation-state

Answer

Hacktivist

Answer

Script kiddie

Question 10

An organization is evaluating threat intelligence feeds to improve IT risk identification. Which of the following criteria should be given the HIGHEST priority when selecting a feed?

Accepted Answer

Relevance to the organization's industry and technology stack. Relevance to the organization's industry and technology stack is the highest priority because threat intelligence that does not align with the specific attack surface, software versions, and threat actors targeting that industry will generate excessive false positives and irrelevant alerts. For example, a healthcare organization using Epic EHR would prioritize feeds covering healthcare-specific ransomware (e.g., Ryuk) and medical device vulnerabilities over generic indicators, ensuring risk identification is actionable and contextually accurate.

Answer

Ease of integration with existing security tools

Answer

The feed's update frequency

Answer

The number of indicators provided per day

Question 11

An organization’s continuous monitoring program includes automated vulnerability scanning and log review. Which of the following is a Key Risk Indicator (KRI) that would BEST signal an increasing risk of a successful network breach?

Accepted Answer

Spike in failed authentication attempts from external IPs. A Key Risk Indicator (KRI) is a forward-looking metric that signals changes in risk exposure. A spike in failed authentication attempts from external IPs is a leading indicator of attempted unauthorized access — such as brute-force or credential-stuffing attacks — and directly signals increasing likelihood of a successful network breach. It is actionable and tied to a specific threat vector.

Answer

Average time to patch critical vulnerabilities

Answer

Number of firewall rule changes per month

Answer

Percentage of systems with up-to-date antivirus signatures

Question 12

An organization wants to promote a risk-aware culture. Which of the following actions is MOST effective for encouraging employees to report incidents without fear?

Accepted Answer

Establish a non-punitive incident reporting policy. A non-punitive incident reporting policy directly removes the fear of retaliation or blame, which is the primary barrier to reporting. By guaranteeing that employees will not be punished for reporting incidents (including their own mistakes), the organization encourages transparency and timely disclosure. This aligns with CRISC principles of fostering a risk-aware culture where risk information flows freely. Other options do not address the fear factor; rewards for zero incidents can actually discourage reporting, automated tools don't change human behavior, and annual training is insufficient to build trust.

Answer

Reward employees for zero incidents

Answer

Implement automated monitoring tools

Answer

Conduct security awareness training annually

Question 13

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Accepted Answer

Accept the risk and continue monitoring. R-0042 is a low-likelihood, low-impact risk involving PII stored with AES-256 encryption and strict access controls. The residual risk is within the organization's risk appetite, making acceptance with continued monitoring the most appropriate response. Mitigation, transfer, or avoidance would introduce unnecessary cost or operational disruption for a risk already well-controlled.

Answer

Mitigate the risk by implementing additional encryption controls

Answer

Transfer the risk to a third-party insurer

Answer

Avoid the risk by discontinuing storage of PII

Question 14

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

Accepted Answer

Conduct a threat modeling workshop with the development team.. Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Answer

Perform a vulnerability scan on the CRM server.

Answer

Run a penetration test against the CRM application.

Answer

Review the business impact analysis for the CRM.

Question 15

In the context of threat modeling for a web application, which technique is specifically designed to be integrated into Agile and DevSecOps processes, emphasizing collaboration and visualization?

Accepted Answer

VAST. VAST (Visual, Agile, and Simple Threat modeling) is specifically designed for Agile and DevSecOps environments. It emphasizes collaboration and visualization, making it easy to integrate into continuous development processes. Unlike other methodologies, VAST focuses on creating threat models that are actionable and scalable across large organizations.

Answer

STRIDE

Answer

TRIKE

Answer

PASTA