CRISC Practice Test 38 — 15 Questions

Question 1

An organization is implementing a third-party risk management program. Which TWO are essential components of the initial vendor risk assessment process?

Accepted Answer

Security questionnaires. Initial vendor assessments typically involve security questionnaires to gather information and review of SOC 2 reports to verify controls. These are foundational due diligence steps.

Answer

Contract compliance review

Answer

Quarterly vulnerability scans of vendor networks

Answer

Annual reassessment

Question 2

Which TWO of the following are key functions of an Architecture Review Board (ARB) in managing risk?

Accepted Answer

Reviewing solution architectures for security risks before implementation. A primary function of an Architecture Review Board (ARB) is to evaluate solution architectures for security risks prior to implementation. This proactive review ensures that security controls are embedded in the design phase, reducing the likelihood of vulnerabilities being introduced into production systems.

Answer

Managing user access controls

Answer

Performing daily vulnerability scans

Answer

Responding to security incidents

Question 3

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

Accepted Answer

Accept the risk with compensating controls such as network segmentation.. The system processes non-critical data and cannot be patched, making risk acceptance with compensating controls the most appropriate strategy. Network segmentation reduces the likelihood of exploitation by isolating the legacy system from critical assets, while the low likelihood and non-critical data make decommissioning or insurance less suitable. This aligns with CRISC best practices for legacy systems where patching is impossible and the risk is within the organization's risk appetite.

Answer

Mitigate the risk by applying vendor patches.

Answer

Avoid the risk by decommissioning the system immediately.

Answer

Transfer the risk by purchasing cyber insurance.

Question 4

An IT risk manager is preparing a report for the board of directors. Which of the following content elements is most important for strategic risk reporting?

Accepted Answer

IT risk integration with enterprise risk management. Strategic risk reporting to the board requires a high-level view that aligns IT risk with enterprise objectives. Option B is correct because it demonstrates how IT risk is integrated into the broader enterprise risk management (ERM) framework, enabling the board to understand the business impact of IT risks. This integration is essential for strategic decision-making, as it connects technical risk data to organizational goals and risk appetite.

Answer

Weekly vulnerability scan results

Answer

List of all vendor risk assessments

Answer

Detailed control performance metrics

Question 5

Match each risk analysis formula to its component.

Accepted Answer

SLE: Single Loss Expectancy (calculated as AV × EF). In quantitative risk analysis, ALE = SLE × ARO, SLE = AV × EF, AV is asset value, EF is percentage loss, and ARO is frequency per year. Common confusions involve swapping EF and ARO definitions.

Answer

EF: Exposure Factor (the expected frequency of occurrence per year)

Answer

ARO: Annualized Rate of Occurrence (the percentage of asset value lost from an incident)

Question 6

Match each risk management term to its definition.

Accepted Answer

Risk: The effect of uncertainty on objectives.. The correct matches are Risk with 'effect of uncertainty on objectives', Threat with 'circumstance/event that can adversely impact', and Vulnerability with 'weakness that can be exploited'. Common confusions include swapping definitions between these terms.

Answer

Risk: A weakness that could be exploited.

Answer

Threat: The effect of uncertainty on objectives.

Answer

Vulnerability: Any circumstance or event with potential to adversely impact.

Question 7

Based on the exhibit, what control monitoring deficiency is evident in the DLP policy?

Accepted Answer

The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).. The DLP policy shown in the exhibit only includes rules for monitoring and blocking credit card data exfiltration via webmail (Gmail, Yahoo Mail) and FTP. It completely omits any rule for cloud storage applications such as Dropbox or OneDrive, which are common vectors for data exfiltration. This is a control monitoring deficiency because the policy fails to cover a significant risk surface, leaving the organization blind to unauthorized transfers of sensitive data through these channels.

Answer

Alerts are not sent to the appropriate team.

Answer

Log retention is insufficient for forensic analysis.

Answer

The rules are too broadly defined and may cause false positives.

Question 8

An organization is updating its asset inventory to improve IT risk identification. Which of the following asset attributes is MOST critical for assessing cybersecurity risk?

Accepted Answer

Criticality rating based on business impact. For assessing cybersecurity risk, the most critical attribute is the criticality rating based on business impact because it directly quantifies the potential harm from a security incident. Without knowing which assets are most vital to business operations, risk prioritization becomes arbitrary, leading to misallocated security controls. This aligns with the CRISC focus on risk-based decision-making, where impact drives the urgency of mitigation.

Answer

IP address and location

Answer

Asset owner contact information

Answer

Software vendor name

Question 9

Which TWO of the following are examples of continuous monitoring activities? (Select TWO.)

Accepted Answer

Continuous vulnerability scanning. Automated SIEM monitoring and continuous vulnerability scanning are continuous activities, while annual penetration testing and quarterly access reviews are periodic.

Answer

Annual penetration testing

Answer

Quarterly user access reviews

Answer

Monthly review of audit logs

Question 10

A software development team is adopting Agile methodology and wants to integrate risk identification into their sprints. Which approach BEST aligns with Agile principles while ensuring effective risk identification?

Accepted Answer

Incorporate a risk identification task in each sprint backlog and review risks during sprint retrospectives. Agile emphasizes iterative, continuous improvement, and integrating risk identification into each sprint backlog ensures risks are identified and addressed as the project evolves. Reviewing risks during sprint retrospectives aligns with the Agile principle of inspecting and adapting, making risk management a recurring, team-driven activity rather than a one-time event. This approach is effective because it captures risks that emerge from changing requirements, technical debt, or integration issues during development.

Answer

Conduct a risk workshop at the start of the project only

Answer

Assign risk identification solely to the product owner

Answer

Perform an annual risk assessment

Question 11

Which of the following is the BEST indicator that a risk assessment should be performed outside the normal cycle?

Accepted Answer

A major IT infrastructure change. A major IT infrastructure change introduces new or altered assets, data flows, and threat surfaces that were not considered in the previous risk assessment cycle. This change can invalidate existing control assumptions and risk ratings, making an ad-hoc assessment necessary to identify and evaluate emerging risks before they materialize.

Answer

A new regulation is proposed

Answer

An employee leaves the company

Answer

The annual budget is approved

Question 12

A large enterprise uses a risk matrix with impact categories (very low, low, medium, high, very high) and likelihood (rare, unlikely, possible, likely, almost certain). A risk identified has a 'likely' likelihood and 'high' impact. According to the matrix, risks with this combination are classified as 'high' risk. The risk appetite statement requires that all high risks have a response plan within 30 days. However, the risk owner argues that due to effective compensating controls, the residual risk is only 'medium'. Which of the following is the BEST course of action?

Accepted Answer

Formalize the risk treatment plan and include the compensating controls in the risk register.. The best course of action is to formalize the risk treatment plan by documenting the compensating controls that reduce the residual risk to medium. This updates the risk register and provides a formal response plan within the required timeframe. Option B is unnecessary because additional controls are not needed if the residual risk is within the risk appetite. Option C is insufficient as acceptance without formal documentation does not meet the requirement for a response plan. Option D incorrectly suggests extending the deadline; the risk should be reclassified based on residual risk, but a formal plan is still needed.

Answer

Implement additional controls to ensure the residual risk becomes low.

Answer

Accept the risk as is, since controls reduce it to acceptable level.

Answer

Document the residual risk as medium and extend the response deadline beyond 30 days.

Question 13

A company uses a DevOps approach with a continuous integration/continuous deployment (CI/CD) pipeline. Which risk identification technique is best suited for detecting code vulnerabilities early in the development lifecycle?

Accepted Answer

Automated security scanning integrated into the pipeline. Automated security scanning integrated into the CI/CD pipeline is best suited for detecting code vulnerabilities early because it runs continuously on every code commit, providing immediate feedback to developers. This aligns with the DevOps principle of shifting security left, catching issues like SQL injection or insecure dependencies before they reach production. Unlike periodic tests, this technique ensures vulnerabilities are identified at the moment of introduction, minimizing remediation cost and risk.

Answer

Quarterly penetration testing

Answer

Threat modeling of system architecture

Answer

Manual code review

Question 14

A risk manager is designing a monitoring and reporting framework. Which THREE of the following are essential components of an effective risk and control monitoring program?

Accepted Answer

Control self-assessments (CSAs). Control self-assessments (CSAs) are essential because they empower process owners to evaluate the design and operating effectiveness of internal controls, providing firsthand evidence for the monitoring program. This bottom-up approach complements top-down testing by identifying control gaps and remediation needs directly from those who execute the controls, which is critical for a comprehensive risk and control monitoring framework.

Answer

Key performance indicators (KPIs)

Answer

Risk response plans

Question 15

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

Accepted Answer

Implement additional monitoring and restrictions. Implementing additional monitoring and restrictions (Option B) is the most appropriate risk response because it allows the organization to gather more evidence of the suspected insider threat while immediately reducing the attack surface. This aligns with the risk mitigation strategy, as it directly addresses the observed anomalous behavior—accessing systems outside normal hours—without prematurely escalating the situation. In a financial data environment, this could involve enabling enhanced audit logging, restricting access to specific IP ranges or times, and deploying user and entity behavior analytics (UEBA) to detect deviations from baseline activity.

Answer

Terminate the employee immediately

Answer

Accept the risk as the employee is trusted

Answer

Transfer via fidelity insurance