CRISC Practice Test 38 — 15 Questions

Question 1

Based on the exhibit, which risk is MOST likely to be identified during a risk assessment?

Accepted Answer

Lateral movement risk from DMZ to internal network. The exhibit shows a DMZ architecture where the internal network is separated from the DMZ by a firewall. A risk assessment would identify the potential for an attacker who compromises a DMZ host (e.g., a web server) to pivot through the firewall to the internal network, especially if firewall rules are overly permissive or if the DMZ host has a trust relationship with internal systems. This lateral movement risk is a classic and high-priority finding in such segmented environments.

Answer

Weak passwords on user workstations

Answer

Unauthorized physical access to the data center

Answer

Incomplete audit logs on firewalls

Question 2

An access control policy includes a default deny rule (DenyAll) and an explicit allow rule. During a monitoring review, the risk practitioner notices that the DenyAll rule is never evaluated because the explicit allow matches first. What is the MOST likely monitoring gap?

Accepted Answer

No automated test validates that the DenyAll policy is effective. The default deny rule is overridden by the explicit allow rule, making the deny ineffective. Without an automated test to validate that the deny rule is actually enforced, the monitoring gap is that the control is assumed to work but is not verified. This is a classic control monitoring failure where the existence of a policy is confused with its effectiveness.

Answer

No KRI is defined for unauthorized access attempts

Answer

Server-side encryption is not enabled

Answer

User access reviews are not performed quarterly

Question 3

Which TWO of the following are examples of risk avoidance? (Select TWO.)

Accepted Answer

Deciding not to enter a new market. Risk avoidance involves taking action to eliminate the risk entirely by not engaging in the activity that introduces it. Option C, 'Deciding not to enter a new market,' avoids all associated market, regulatory, and competitive risks by simply not pursuing that business opportunity. Option E, 'Discontinuing a risky product line,' removes the risk by ceasing the activity that generates it, such as halting production of a product with known safety or compliance issues.

Answer

Accepting the risk

Answer

Installing a firewall

Answer

Purchasing insurance

Question 4

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Accepted Answer

Expanded attack surface due to numerous connected devices. Option A is correct because deploying many IoT sensors multiplies entry points (each device's network services, management interfaces, and APIs), greatly expanding the attack surface an adversary can probe or exploit. Option C is correct because IoT devices without a secure firmware update mechanism cannot receive patches for newly disclosed CVEs, leaving them permanently vulnerable to exploitation. Option E is correct because legacy components often run outdated firmware or unsupported OS/protocol stacks with publicly known vulnerabilities that attackers can leverage. Option B is not a direct security risk but a business/procurement concern, and Option D concerns legal/regulatory data residency rather than a technical security vulnerability.

Answer

Vendor lock-in due to proprietary protocols

Answer

Data sovereignty issues for sensor data

Question 5

A risk practitioner is performing an external threat environment analysis for a retail chain that accepts card payments. The practitioner wants to identify which external factors should be treated as inputs to the likelihood of payment card data compromise. Which TWO of the following are the MOST appropriate inputs? (Choose two.)

Accepted Answer

The prevalence and activity level of organized criminal groups that monetize stolen card data.. External threat inputs describe conditions outside the organization's control that shape how likely an attack is. Organized criminal activity that monetizes card data, and published reports of skimming and shimming techniques used against comparable retailers, both reflect adversary capability and intent in the card payment ecosystem. Terminal counts, cashier turnover, and audit completion are internal attributes better suited to vulnerability, impact, or assurance analysis.

Answer

The percentage of the chain's stores that have completed a recent internal audit.

Answer

The turnover rate among store cashiers and the adequacy of their security awareness training.

Answer

The number of point-of-sale terminals the chain operates across all stores.

Question 6

The exhibit shows a control monitoring configuration in JSON format. Which of the following is the MOST critical gap in this monitoring setup?

Accepted Answer

There is no action defined for when the threshold is first breached. The JSON configuration defines a threshold but lacks any corresponding action (e.g., alert, ticket, or automated response) to be triggered when the threshold is first breached. Without an action, the monitoring setup cannot notify or initiate a response, rendering the threshold definition useless for risk mitigation. This is the most critical gap as it directly undermines the control's ability to detect and react to risk events in a timely manner.

Answer

The control was last tested over a month ago

Answer

The data source 'transaction_log' is not specific enough

Answer

The monitoring frequency is set to daily, which may miss real-time breaches

Question 7

A quantitative risk analysis for a data breach yields an Annualized Loss Expectancy (ALE) of $500,000. The Single Loss Expectancy (SLE) is $100,000. What is the Annualized Rate of Occurrence (ARO)?

Accepted Answer

5. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). Given ALE = $500,000 and SLE = $100,000, the ARO is $500,000 / $100,000 = 5. This means the data breach is expected to occur 5 times per year.

Answer

50

Answer

0.2

Answer

500,000

Question 8

An organization is planning to adopt post-quantum cryptography. Which TWO considerations are MOST important for migration planning?

Accepted Answer

Assess the cryptographic agility of current systems. Option B is correct because cryptographic agility—the ability of systems to swap algorithms, keys, and protocols without major redesign—is essential for migrating to post-quantum cryptography (PQC), since standards such as ML-KEM (FIPS 203) and ML-DSA (FIPS 204) will continue to evolve and hybrid deployments (e.g., X25519+ML-KEM) must be supported during transition. Option C is correct because systems protecting data with long confidentiality lifetimes (classified, health, financial records) are exposed to 'harvest now, decrypt later' attacks, so migration priority must be driven by how long the data must remain secret versus when a cryptographically relevant quantum computer (CRQC) is expected. Option A is not a migration-planning consideration because the cost of quantum computers is irrelevant to an organization's own cryptographic inventory and transition roadmap. Option D is unnecessary because adopting PQC requires cryptographic and IT expertise, not training staff in quantum physics. Option E is premature because standardized PQC algorithms run on existing classical hardware via software/firmware updates, so buying 'quantum-resistant hardware' immediately is neither required nor a sound first step.

Answer

Evaluate the cost of quantum computers

Answer

Train employees on quantum physics

Answer

Purchase quantum-resistant hardware immediately

Question 9

An organization is evaluating whether to accept a risk. Which TWO conditions must be met for risk acceptance to be appropriate?

Accepted Answer

The risk owner formally documents and accepts the risk. Risk acceptance is only appropriate when the risk owner formally documents and accepts the risk (B), because accountability for the residual risk must be explicitly acknowledged by the party who owns it, ensuring the decision is authorized and auditable. It is also required that the risk falls within the organization's risk appetite (E), since accepting a risk that exceeds the defined tolerance would violate the risk management framework and require treatment instead. Options A, C, and D do not justify acceptance: transferring risk to an insurer (A) is risk transference, not acceptance; a high but unavoidable risk (C) still needs to be within appetite and formally accepted, and 'unavoidable' alone is not a valid criterion; and having a cost-effective control available (D) argues for risk mitigation rather than acceptance.

Answer

The risk can be transferred to an insurer

Answer

The risk is high but unavoidable

Answer

A cost-effective control is available

Question 10

A risk practitioner is using a 5×5 heat map with likelihood and impact ratings. Which of the following is a key advantage of this qualitative risk analysis approach?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using a 5×5 heat map is designed to be quick to perform and easy to communicate visually to non-technical stakeholders. The color-coded matrix (e.g., red for high risk, green for low risk) allows immediate understanding of risk priorities without requiring complex calculations, making it ideal for initial risk assessments and board-level reporting.

Answer

It provides objective, financially meaningful results.

Answer

It eliminates the need for expert judgment in risk assessment.

Answer

It allows direct comparison of risk levels across different organizations.

Question 11

A risk practitioner is conducting a threat modeling exercise for a new cloud-based application using the STRIDE methodology. Which of the following is the PRIMARY benefit of using STRIDE over a simple checklist?

Accepted Answer

It identifies threats by category, reducing the chance of missing key threat types. The STRIDE methodology categorizes threats into six specific types (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). This structured approach ensures that the threat modeling exercise systematically covers each category, reducing the likelihood of overlooking entire classes of threats that a simple checklist might miss. For a cloud-based application, this is critical because threats like elevation of privilege or information disclosure can manifest in unique ways across shared infrastructure, and STRIDE forces the practitioner to consider each category explicitly.

Answer

It requires less expertise to perform

Answer

It automatically quantifies risk levels

Answer

It ensures consistent application of controls

Question 12

Which TWO of the following are appropriate criteria for selecting key risk indicators (KRIs)?

Accepted Answer

Indicators that are quantifiable and reliable. Key risk indicators (KRIs) must be quantifiable and reliable to provide objective, measurable data that can be consistently tracked over time. Quantifiable indicators allow for trend analysis and threshold setting, while reliability ensures the data source is accurate and repeatable, which is essential for effective risk monitoring in IT environments such as network security or system availability.

Answer

Indicators that only cover financial risks

Answer

Indicators that measure historical losses

Answer

Indicators that are easy to collect regardless of relevance

Question 13

During a control monitoring review, the auditor finds that a control designed to detect unauthorized access has not triggered any alerts in six months. What should the risk practitioner do first?

Accepted Answer

Test the control to ensure it is functioning correctly.. The absence of alerts does not automatically confirm that the control is working; it could indicate that the control has failed silently or that the detection logic is misconfigured. The risk practitioner must first test the control (e.g., by simulating an unauthorized access attempt) to verify that it can actually detect and alert on violations. Only after confirming correct functionality can the lack of alerts be interpreted as evidence of effectiveness.

Answer

Document the lack of alerts as evidence of effectiveness.

Answer

Redesign the control with different parameters.

Answer

Increase the frequency of monitoring.

Question 14

During a risk assessment, the risk practitioner develops a scenario involving a disgruntled employee exfiltrating sensitive customer data through a USB drive. The organization has a strict policy against removable media but lacks technical controls to prevent USB usage. Which element of the risk scenario is the vulnerability?

Accepted Answer

Lack of technical controls to prevent USB usage. In a risk scenario, the vulnerability is the weakness or gap that can be exploited by a threat. Here, the absence of technical controls to prevent USB usage is the weakness, even though a policy exists. The policy alone does not enforce compliance, so the lack of technical enforcement is the vulnerability.

Answer

Data exfiltration

Answer

Disgruntled employee

Answer

Sensitive customer data

Question 15

A company is considering using a qualitative risk assessment approach to evaluate IT risks. Which TWO of the following are advantages of qualitative risk analysis over quantitative risk analysis?

Accepted Answer

Quick to perform. Option C is correct because qualitative risk analysis relies on relative scales such as High/Medium/Low or ordinal rankings rather than collecting precise monetary values and statistical data, so assessments can be completed quickly with far less data gathering and calculation effort. Option D is correct because qualitative outputs expressed in simple descriptive terms (for example, a risk matrix rating of High) are readily understood by non-technical stakeholders, executives, and business owners who may lack a financial or statistical background. By contrast, option A is wrong because qualitative ratings are subjective and scale-dependent, so results are not easily comparable across different organizations that use different criteria or rating scales. Option B is wrong because financially meaningful results, such as annualized loss expectancy (ALE) derived from single loss expectancy (SLE) and annualized rate of occurrence (ARO), are a hallmark of quantitative analysis, not qualitative. Option E is wrong because qualitative analysis is inherently subjective and depends on expert judgment, making it less objective and repeatable than quantitative methods.

Answer

Easily comparable across organizations

Answer

Provides financially meaningful results

Answer

Objective and repeatable