CRISC Practice Test 37 — 15 Questions

Question 1

A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?

Accepted Answer

Document the vulnerability and assess the associated risk in the risk register. The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

Answer

Apply a virtual patch via an intrusion prevention system

Answer

Isolate the application from the network

Answer

Notify the application owner and request an emergency patch

Question 2

A multinational corporation is conducting a risk assessment for its new online payment platform. The platform processes transactions in multiple currencies and stores sensitive customer financial data. The risk team has identified that the encryption algorithm used for data at rest is outdated and could be vulnerable to advanced attacks. The company's risk appetite is low for data breaches. The security team recommends upgrading the encryption to a modern standard, but the upgrade will require a 48-hour downtime impacting all global transactions. The business unit is concerned about revenue loss during the downtime. As the risk practitioner, what is the BEST course of action to balance security and business continuity?

Accepted Answer

Plan the upgrade during a low-traffic period and implement compensating controls such as additional monitoring during the downtime.. The best course of action because it balances the need to mitigate a high-risk encryption vulnerability with business continuity. By scheduling the upgrade during a low-traffic period and implementing compensating controls (e.g., enhanced monitoring and intrusion detection), the organization reduces the likelihood of exploitation during the 48-hour downtime while minimizing revenue loss. This aligns with the low risk appetite for data breaches and demonstrates a risk-based decision that treats the vulnerability without accepting unacceptable exposure.

Answer

Accept the risk and delay the upgrade until the next scheduled maintenance window in three months.

Answer

Outsource the payment processing to a third-party vendor that already uses modern encryption.

Answer

Implement the upgrade immediately to mitigate the vulnerability, accepting the revenue loss.

Question 3

A risk practitioner is using the TRIKE threat modeling methodology. Which TWO of the following are characteristics of TRIKE?

Accepted Answer

It is a requirements-based model. TRIKE is requirements-based and uses actor- and asset-centric views.

Answer

It is designed for analyzing denial-of-service threats

Answer

It is a visual, agile methodology for DevSecOps

Answer

It focuses on attack trees and threat libraries

Question 4

You are the IT risk manager at a multinational corporation that recently migrated its customer database to a cloud-based platform. The database contains personally identifiable information (PII) subject to GDPR. During a routine vulnerability scan, you discover that the database is accessible from the internet without encryption (port 1433 open). The cloud provider's shared responsibility model indicates that securing the database configuration is the customer's responsibility. You have identified the risk as high likelihood and high impact. The business owner argues that the database is only accessible to a limited IP range and that encryption would degrade performance. Which course of action should you recommend to treat the risk?

Accepted Answer

Close the port or implement a VPN, and enforce encryption. The risk is high likelihood and high impact, and the database is exposed to the internet without encryption, violating GDPR. The most effective risk treatment is to mitigate the risk by closing the port or using a VPN and enforcing encryption. This directly addresses the vulnerability and reduces both likelihood and impact. Other options do not adequately treat the risk.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk because the IP restriction reduces likelihood

Answer

Implement a web application firewall (WAF) to monitor traffic

Question 5

After implementing controls for a high-risk IT process, the residual risk is calculated as medium. The risk owner argues that the controls are not adequate because the inherent risk was critical. Which of the following should be the primary basis for determining control adequacy?

Accepted Answer

The reduction from inherent risk to residual risk based on control effectiveness. Control adequacy should be determined by the reduction from inherent risk to residual risk based on control effectiveness. The goal of controls is to mitigate risk to an acceptable level; if residual risk is medium and within the organization's risk appetite, the controls may be adequate regardless of the inherent risk being critical. The risk owner's argument that controls are inadequate solely because inherent risk was critical is flawed; what matters is the effectiveness of the controls in reducing risk.

Answer

The number of controls implemented

Answer

The cost of controls relative to the asset value

Answer

The industry standards for similar processes

Question 6

In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function in the NIST Cybersecurity Framework (CSF) covers the safeguards that limit or contain the impact of a cybersecurity event — access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is explicitly defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. Detect, Identify, and Recover address different phases of the risk lifecycle.

Answer

Detect

Answer

Recover

Answer

Identify

Question 7

During a risk assessment, a financial institution identifies that its online banking application uses an outdated encryption protocol. The likelihood of exploitation is high, and the impact is moderate. What should the risk owner do FIRST?

Accepted Answer

Validate the risk rating with additional data. The risk owner's first responsibility is to ensure the risk assessment is accurate before deciding on a response. Validating the risk rating with additional data (option B) confirms that the high likelihood and moderate impact are correctly assessed, which is a prerequisite for selecting an appropriate treatment. Jumping to implement controls, transfer, or accept the risk without validation could lead to misallocation of resources or inadequate mitigation.

Answer

Implement a compensating control to mitigate the risk

Answer

Transfer the risk via cyber insurance

Answer

Accept the risk as low priority

Question 8

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Accepted Answer

Helps align cybersecurity activities with business objectives. Option B is correct because the NIST Cybersecurity Framework (CSF) is designed to be integrated with enterprise risk management so that cybersecurity investments and activities are prioritized according to business objectives, mission needs, and organizational risk tolerances, rather than treated as a purely technical concern. Option D is correct because the CSF Core's Functions, Categories, and Subcategories (Identify, Protect, Detect, Respond, Recover, and Govern in CSF 2.0) establish a standardized taxonomy that gives technical and business stakeholders a common language for describing, discussing, and communicating cybersecurity risk. Option A is incorrect because no framework can guarantee prevention of all cyber attacks; the CSF is risk-based and assumes some incidents will occur, emphasizing detection, response, and recovery. Option C is incorrect because the CSF is outcome-based and voluntary, not a prescriptive checklist of mandatory controls for every organization. Option E is incorrect because the CSF complements, rather than replaces, an organization's risk appetite statement, which is a governance input used to guide risk-based decisions.

Answer

Ensures all cyber attacks are prevented

Answer

Provides a prescriptive set of controls for all organizations

Answer

Replaces the need for a separate risk appetite statement

Question 9

A company uses a DevOps approach with a continuous integration/continuous deployment (CI/CD) pipeline. Which risk identification technique is best suited for detecting code vulnerabilities early in the development lifecycle?

Accepted Answer

Automated security scanning integrated into the pipeline. Automated security scanning integrated into the CI/CD pipeline is best suited for detecting code vulnerabilities early because it runs continuously on every code commit, providing immediate feedback to developers. This aligns with the DevOps principle of shifting security left, catching issues like SQL injection or insecure dependencies before they reach production. Unlike periodic tests, this technique ensures vulnerabilities are identified at the moment of introduction, minimizing remediation cost and risk.

Answer

Quarterly penetration testing

Answer

Threat modeling of system architecture

Answer

Manual code review

Question 10

During a third-party risk management review, the organization is tiering its vendors based on risk. Which TWO of the following criteria are most relevant for determining vendor risk tier?

Accepted Answer

Criticality of service provided. The criticality of the service provided (A) directly determines the potential business impact if the vendor fails, making it a primary factor in risk tiering. Similarly, the level of data access (C) dictates the confidentiality and privacy risks, as vendors handling sensitive or regulated data (e.g., PII, PHI) pose higher inherent risk. Both criteria align with the ISACA risk management framework, which prioritizes impact and data sensitivity over financial or operational metrics.

Answer

Number of vendor employees

Answer

Annual contract value

Answer

Vendor geographic location

Question 11

Which TWO risk identification techniques are most appropriate for identifying emerging risks from new technologies?

Accepted Answer

Scenario analysis. Scenario analysis (A) is correct because it lets risk teams model plausible future states and 'what-if' situations around new technologies that have little or no historical data, exposing emerging risks such as novel attack paths or unintended AI behavior. Threat intelligence feeds (E) are correct because they continuously deliver current indicators, vulnerability disclosures, and adversary TTPs (e.g., CVEs, IOCs, MITRE ATT&CK techniques) about newly exploited technologies, which is exactly how emerging risks surface before they appear in your own incident history. Historical incident review (B) is not appropriate here because it only reflects risks already experienced, so it cannot reveal risks from technologies with no prior incidents. The Delphi technique (C) and peer benchmarking (D) can inform risk assessment through expert consensus or comparison with other organizations, but they are slower, opinion- or peer-dependent, and not specifically designed to detect fast-moving emerging technology risks.

Answer

Historical incident review

Answer

Delphi technique

Answer

Peer benchmarking

Question 12

A company has implemented a new cloud-based customer relationship management (CRM) system. The IT risk manager is tasked with identifying risks related to this system. Which of the following is the MOST important risk identification technique to use initially?

Accepted Answer

Facilitating a risk workshop with IT, business, and security stakeholders. A facilitated risk workshop brings together IT, business, and security stakeholders to collectively identify risks across the full scope of the new CRM system, including business process, data, compliance, and technical dimensions. This cross-functional collaboration is the most effective initial technique because it surfaces risks that no single group would see alone, aligning with CRISC's emphasis on enterprise-wide risk identification. It also establishes shared ownership and a common risk language early in the system lifecycle.

Answer

Conducting a series of interviews with key users of the CRM

Answer

Performing a penetration test on the CRM environment

Answer

Automated vulnerability scanning of the CRM system

Question 13

In a qualitative risk assessment, which TWO elements are typically used to determine the risk rating?

Accepted Answer

Likelihood. In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Answer

Risk appetite

Answer

Cost of mitigation

Answer

Control effectiveness

Question 14

An organization is evaluating risk treatment options for a critical vulnerability. Which TWO options would be considered risk mitigation?

Accepted Answer

Deploy an intrusion prevention system. Deploying an intrusion prevention system (IPS) is a risk mitigation measure because it actively monitors and blocks malicious traffic targeting the vulnerability, reducing the likelihood of exploitation. Implementing a security patch directly removes the vulnerability, thereby reducing both the likelihood and impact of a potential attack. Both actions modify the risk by applying technical controls to lower the residual risk level.

Answer

Purchase cyber insurance

Answer

Accept the risk with formal sign-off

Answer

Discontinue the vulnerable service

Question 15

During risk identification, a risk manager is reviewing threat intelligence sources. Which THREE of the following are considered legitimate sources of threat intelligence? (Choose three.)

Accepted Answer

Government advisories such as CISA Known Exploited Vulnerabilities (KEV) catalog. OSINT (open-source intelligence), ISACs (sector-specific sharing), and government advisories (e.g., CISA KEV) are established threat intelligence sources. Social media rumor and vendor sales pitches are not reliable.

Answer

Unverified social media rumors

Answer

Vendor sales presentations