CRISC Practice Test 37 — 15 Questions

Question 1

An organization is implementing a new data loss prevention (DLP) solution. The risk manager is identifying potential risks related to the DLP solution itself. Which of the following is a risk that should be considered?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DLP solution may generate a high volume of false positives, causing alert fatigue and missed real incidents.. A DLP solution may generate false positives, leading to alert fatigue and missed detections. Option B is a benefit, not a risk. Option C is a control. Option D is a desired outcome.

Answer

The DLP solution will reduce the risk of data exfiltration.

Answer

The DLP solution will block all unauthorized data transfers.

Answer

The DLP solution will automatically encrypt sensitive data in transit.

Question 2

A company uses a third-party SaaS application for payroll processing. What is the most important activity to identify IT risks associated with this service?

Accepted Answer

Conducting a vendor risk assessment. A vendor risk assessment is the most important activity because it systematically evaluates the third-party SaaS provider's security controls, compliance posture, and operational resilience before and during service use. For a payroll SaaS, this includes reviewing data protection measures for sensitive employee PII, understanding the provider's SOC 2 Type II report, and assessing their incident response capabilities. Without this assessment, the organization cannot identify inherent risks like unauthorized data access, service downtime, or regulatory non-compliance specific to the third-party environment.

Answer

Performing penetration testing on the SaaS application

Answer

Reviewing the service-level agreement (SLA)

Answer

Implementing multi-factor authentication (MFA)

Question 3

A financial institution is evaluating the risk of a new mobile payment application. The risk team calculates the Annual Loss Expectancy (ALE) as $500,000 based on a single loss expectancy (SLE) of $100,000 and an annual rate of occurrence (ARO) of 5. After implementing a new encryption control at a cost of $150,000 per year, the ALE is reduced to $200,000. What is the residual risk in terms of ALE after one year of control operation?

Accepted Answer

$200,000. The residual risk is the remaining Annual Loss Expectancy (ALE) after controls are applied. Since the ALE after implementing the encryption control is explicitly stated as $200,000, that is the residual risk after one year of control operation. The control cost of $150,000 is a separate cost-of-control figure and does not reduce the ALE further; it is used for cost-benefit analysis, not for calculating residual risk.

Answer

$500,000

Answer

$350,000

Answer

$300,000

Question 4

After a risk assessment, the risk owner states that the residual risk for a specific asset is within the organization's risk tolerance. Which of the following BEST describes the action that should be taken?

Accepted Answer

Formally accept the risk and document the decision. When the risk owner confirms that residual risk is within the organization's risk tolerance, the appropriate action is to formally accept the risk and document the decision. This is a standard risk treatment option (risk acceptance) under the ISACA Risk IT Framework, where no further controls are needed because the residual risk level is already acceptable. Documenting the acceptance ensures auditability and accountability for the decision.

Answer

Transfer the risk to a third party

Answer

Implement additional controls to reduce risk further

Answer

Reassess the risk using a quantitative method

Question 5

A security control failed to prevent unauthorized access to a sensitive database. The risk owner has been notified. What should the risk practitioner do NEXT?

Accepted Answer

Recalculate the residual risk level and update the risk register. After a control failure, the risk practitioner must first reassess the residual risk level, which reflects the remaining risk after considering the failed control's ineffectiveness. Updating the risk register with the new residual risk ensures that the organization has an accurate, current view of its risk posture, which is a fundamental requirement of the risk monitoring and reporting process. This step aligns with the CRISC framework's emphasis on continuous risk assessment and documentation before any remediation or escalation actions.

Answer

Escalate the issue to the board of directors

Answer

Apply a patch to the database system immediately

Answer

Perform a root cause analysis on the control failure

Question 6

Which of the following is the PRIMARY purpose of a risk register in the risk identification phase?

Accepted Answer

Document identified risks and their characteristics. The primary purpose of a risk register during the risk identification phase is to systematically document each identified risk along with its key characteristics, such as the risk description, cause, impact, and potential triggers. This foundational record ensures that all risks are captured before any subsequent analysis or response planning occurs, aligning with the CRISC domain of IT Risk Identification.

Answer

Assign risk owners

Answer

Calculate risk scores

Answer

Track remediation progress

Question 7

Refer to the exhibit. What is the MOST immediate risk identification action?

Accepted Answer

Check if the patch has been deployed. The exhibit (not shown) likely presents a vulnerability scan result or a security advisory. The most immediate risk identification action is to verify whether the identified vulnerability has already been mitigated by deploying the vendor-supplied patch. This confirms the current exposure status before any further risk assessment or documentation steps are taken.

Answer

Document the vulnerability in the risk register

Answer

Update asset inventory

Answer

Validate the vulnerability manually

Question 8

During a cloud migration project, the IT risk manager is identifying risks associated with data residency. Which of the following is the MOST effective method to identify applicable regulatory requirements?

Accepted Answer

Implementing a data classification policy that maps to regulatory frameworks. Implementing a data classification policy that maps to regulatory frameworks is the most effective method because it systematically identifies which data types are subject to specific regulations (e.g., GDPR, HIPAA, LGPD) based on content and jurisdiction. This proactive approach ensures that all applicable legal and contractual requirements are considered before engaging with cloud providers, rather than relying on post-hoc interviews or scans.

Answer

Interviewing cloud service providers about compliance

Answer

Conducting a vulnerability scan of the cloud environment

Answer

Reviewing past audit findings

Question 9

A small manufacturing company is conducting its first IT risk assessment. The company has a flat network with no segmentation, and all employees have administrative access to their workstations. The risk practitioner identifies that a malware infection on one workstation could easily spread to the entire network. The company has a limited budget for IT security improvements. Which of the following risk treatment options is MOST cost-effective and practical?

Accepted Answer

Deploy endpoint protection software on all workstations and restrict administrative rights for users.. The most cost-effective and practical because deploying endpoint protection software provides immediate defense against known malware, while restricting administrative rights prevents users from installing unauthorized software or making system changes that could introduce malware. This combination directly addresses the root cause of the risk—unrestricted user privileges and lack of basic malware defenses—without requiring expensive network redesign or ongoing insurance premiums.

Answer

Accept the risk because the company's data is not highly sensitive.

Answer

Implement network segmentation and a next-generation firewall.

Answer

Purchase cyber insurance to cover potential losses.

Question 10

A company is evaluating its control monitoring program. Which TWO of the following are key elements of an effective control monitoring framework? (Choose two.)

Accepted Answer

Periodic review of KRI thresholds.. Periodic review of KRI thresholds is a key element because KRIs must remain aligned with the evolving risk landscape; thresholds that are not reviewed can become obsolete, leading to false positives or missed risk indicators. Clearly defined roles and responsibilities ensure accountability for control execution, monitoring, and escalation, which is foundational to any effective control monitoring framework.

Answer

Integration with performance management.

Answer

Use of statistical sampling for all tests.

Answer

Automated alerts for all control failures.

Question 11

A company is conducting an IT risk assessment for the first time. Which of the following should be the FIRST step?

Accepted Answer

Establish the risk assessment context. Before any risk assessment activities can begin, the organization must establish the context—defining the scope, risk appetite, criteria for risk evaluation, and the business objectives the assessment supports. Without this foundational step, subsequent identification of assets, threat analysis, or control implementation would lack alignment with business goals and could produce irrelevant or misleading results. This aligns with the ISACA Risk IT framework and the CRISC domain of IT Risk Assessment.

Answer

Identify all IT assets

Answer

Analyze the likelihood and impact of threats

Answer

Implement mitigating controls

Question 12

Which TWO of the following are primary sources of risk identification for IT projects?

Accepted Answer

Project documentation (e.g., scope, schedule, budget). Project documentation such as scope, schedule, and budget is a primary source of risk identification because it defines the project's boundaries, constraints, and deliverables. Analyzing these documents helps identify risks related to scope creep, unrealistic timelines, or insufficient funding that could impact IT project success.

Answer

Social media monitoring

Answer

Vendor marketing materials

Answer

Industry benchmark reports

Question 13

A company uses a risk control self-assessment (RCSA) process that is conducted annually. During a quarterly review, management discovers that several high-risk controls are no longer effective due to changes in the business environment. Which of the following is the BEST way to enhance the monitoring of these controls?

Accepted Answer

Deploy automated control monitoring tools for continuous assessment.. Automated control monitoring tools provide continuous, real-time assessment of control effectiveness, which is essential when high-risk controls are failing due to dynamic business changes. Unlike periodic manual reviews, automation reduces latency in detecting control degradation and enables immediate remediation, aligning with the CRISC principle of proactive risk monitoring.

Answer

Increase the frequency of the RCSA to quarterly.

Answer

Assign a risk owner to perform manual checks monthly.

Answer

Implement compensating controls to reduce the risk.

Question 14

A company implements a new automated control to monitor user access rights. The control sends a daily report of any users with excessive privileges. What is the PRIMARY benefit of this control?

Accepted Answer

Enables timely remediation of access violations. The primary benefit of an automated control that sends a daily report of users with excessive privileges is that it enables timely remediation of access violations. By providing a regular, scheduled summary of privilege anomalies, the control allows the IT security team to investigate and revoke unauthorized access within a defined timeframe (e.g., 24 hours), reducing the window of exposure. This aligns with the principle of continuous monitoring and rapid response, which is critical for minimizing risk from privilege creep or misconfigured roles.

Answer

Reduces the number of user access reviews

Answer

Eliminates the need for manual checks

Answer

Provides real-time alerts for critical changes

Question 15

A company is implementing a new access control system. According to the project plan, user training will be delivered after the system goes live. What change management issue does this present?

Accepted Answer

Training after go-live may lead to user errors and security incidents. Training should ideally be delivered before go-live to ensure users can operate the system securely. Delaying training increases the risk of errors and security incidents.

Answer

Training after go-live ensures the system is fully operational

Answer

Training after go-live is more effective because users have context

Answer

Training after go-live reduces the project budget