CRISC Practice Test 39 — 15 Questions

Question 1

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Communicate the risk exposure to senior management. The risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 2

You are a risk analyst for a financial institution that uses a legacy mainframe system for core banking transactions. The mainframe is critical for daily operations, but it is no longer supported by the vendor. The system has known vulnerabilities that cannot be patched due to compatibility issues. The institution has a risk appetite that is very low for any disruption to core banking services. Recently, there was a minor outage caused by a hardware failure, which was resolved quickly, but it highlighted the system's fragility. The IT director proposes to migrate to a modern system, but the migration will take 2 years and cost $5 million. The board is concerned about the cost and timeline. You need to recommend an immediate risk treatment to reduce the likelihood of a major outage while the migration is underway. Which of the following is the BEST course of action?

Accepted Answer

Implement redundant hardware for critical components and conduct regular failover testing.. Implementing redundant hardware for critical components and conducting regular failover testing directly reduces the likelihood of a major outage by addressing the single point of failure exposed by the recent hardware failure. This is an immediate risk treatment that does not depend on the 2-year migration timeline, and it aligns with the institution's very low risk appetite for core banking disruption.

Answer

Accept the risk because the migration plan is in place.

Answer

Negotiate with the vendor for extended support.

Answer

Purchase business interruption insurance to cover potential losses.

Question 3

A company is integrating its IT risk management program with the enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It provides a holistic view of risk across the organization.. Integration ensures that IT risks are considered in the context of overall organizational objectives and that risk responses are aligned across the enterprise.

Answer

It allows IT to operate independently from business units.

Answer

It eliminates the requirement for a separate IT risk register.

Answer

It reduces the need for IT-specific risk assessments.

Question 4

During a vendor risk assessment, a third-party vendor is classified as "critical" because it has access to sensitive customer data. According to the organization's risk appetite, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor with access to sensitive customer data because it provides an independent, audited assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. This aligns with the organization's risk appetite by ensuring that the vendor has demonstrated effective controls in place to protect sensitive data, rather than relying on a point-in-time test or self-reported information.

Answer

General liability insurance certificate

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 5

An organization is implementing a quantitative risk assessment for its customer database. Which TWO elements are essential for calculating the annualized loss expectancy (ALE)?

Accepted Answer

Annualized rate of occurrence (ARO). The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). SLE itself is derived from the asset value (AV) multiplied by the exposure factor (EF), making AV the second essential element. Without both ARO and AV, you cannot compute the expected monetary loss over a one-year period for the customer database.

Answer

Control effectiveness rating

Answer

Inherent risk score

Answer

Risk appetite threshold

Question 6

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?

Accepted Answer

Expansion of the attack surface from IT to OT environments. Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.

Answer

Increased complexity in managing network bandwidth

Answer

Potential for increased data redundancy

Answer

Higher licensing costs for security software

Question 7

A company is identifying risks associated with a new cloud-based CRM. Which of the following is the MOST effective method for identifying potential threats?

Accepted Answer

Threat modeling workshops with stakeholders. Threat modeling workshops with stakeholders are the most effective method because they leverage diverse expertise to systematically identify threats specific to the cloud-based CRM architecture, including misconfigurations in IAM roles, API vulnerabilities, and data residency issues. This collaborative approach aligns with the CRISC focus on proactive risk identification by considering business context, technical constraints, and regulatory requirements early in the lifecycle.

Answer

Reviewing industry standards only

Answer

Conducting penetration testing alone

Answer

Analyzing historical security incidents from similar organizations

Question 8

Which threat actor is most likely motivated by political ideology and may target government systems?

Accepted Answer

Hacktivist. Hacktivists are threat actors whose primary motivation is political ideology, social activism, or protest. They often target government systems to disrupt operations, deface websites, or leak sensitive information in order to advance their political agenda, making option C correct.

Answer

Organized crime

Answer

Nation-state APT

Answer

Script kiddie

Question 9

An organization recently experienced a data breach due to a misconfigured cloud storage bucket. As part of the IT risk assessment, which control should be prioritized to prevent recurrence?

Accepted Answer

Deploy automated cloud configuration scanning and remediation tools.. Automated cloud configuration scanning and remediation tools directly address the root cause of a misconfigured cloud storage bucket by continuously monitoring cloud infrastructure against security baselines (e.g., CIS benchmarks) and automatically correcting deviations. This prevents recurrence by catching misconfigurations in real time, rather than relying on manual approval processes or periodic testing that may miss transient changes.

Answer

Require management approval for all cloud storage changes.

Answer

Implement mandatory annual security awareness training for all employees.

Answer

Increase the frequency of third-party penetration testing.

Question 10

Based on the exhibit, what is the MOST significant risk exposure?

Accepted Answer

Public access to the public-bucket with no restrictions. Public access to the public-bucket with no restrictions means that anyone on the internet can read, write, or delete objects in that bucket. This is the most significant risk exposure because it directly exposes data to unauthorized users without any authentication or authorization controls, violating the principle of least privilege and potentially leading to data breaches or data loss.

Answer

The policy does not include deny statements, so all access is allowed

Answer

The AdminRole can access both buckets

Answer

The anonymous access to the confidential-bucket

Question 11

A financial institution is considering adopting a new AI/ML model for credit scoring. The model uses customer demographic data and transaction history. Which of the following risks is MOST likely to cause regulatory penalties if not addressed?

Accepted Answer

Model bias leading to unfair lending practices. Regulators require explainability for credit decisions to ensure fairness and compliance with regulations like ECOA and GDPR. Model bias can lead to discriminatory outcomes, resulting in significant penalties.

Answer

Data privacy of training data

Answer

Model drift due to changing economic conditions

Answer

Adversarial attacks on the model

Question 12

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$140,000. The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

Answer

$100,000

Answer

$70,000

Answer

$1,400,000

Question 13

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness. Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 14

During a quarterly control effectiveness test, internal audit finds that a detective control missed 15% of security incidents. The control owner claims this is within the acceptable error rate of 20%. However, the risk practitioner notes that the missed incidents were high-severity. What should the risk practitioner do?

Accepted Answer

Escalate the findings to senior management with a recommendation to enhance the control. The risk practitioner should escalate the findings to senior management with a recommendation to enhance the control because the detective control's failure to detect 15% of incidents, while within the 20% acceptable error rate, specifically missed high-severity incidents. High-severity incidents pose a disproportionate risk to the organization, and a control that fails to detect them is not effective in mitigating critical risks, regardless of meeting a generic threshold. Escalation ensures that management is aware of the residual risk and can authorize appropriate enhancements, such as tuning the control's detection logic or implementing additional monitoring for high-severity events.

Answer

Accept the control as effective since it is within the threshold

Answer

Implement a compensating control to cover high-severity incidents

Answer

Recommend revising the KCI threshold to include severity weighting

Question 15

Based on the firewall log exhibit, which of the following conclusions is MOST appropriate for risk identification?

Accepted Answer

There is evidence of a potential reverse shell or malware beaconing from host 10.0.1.15. The firewall log shows an outbound connection from internal host 10.0.1.15 to external server 203.0.113.50 on a high ephemeral port (e.g., 4444), which is commonly associated with reverse shell payloads or malware command-and-control (C2) beaconing. This pattern indicates that the internal host may have been compromised and is establishing an outbound channel to an external attacker, bypassing typical inbound firewall rules. Such behavior is a critical risk indicator for IT risk identification, as it suggests active malicious activity within the network.

Answer

External server 198.51.100.20 is attempting to exploit host 10.0.1.10

Answer

Host 10.0.1.15 is successfully communicating with external server 203.0.113.50

Answer

The firewall is functioning correctly with no security incidents