CRISC Practice Test 39 — 15 Questions

Question 1

During an IT risk assessment, the risk team identifies a high inherent risk for a legacy application. The team is evaluating control options. Which THREE are considered preventive controls?

Accepted Answer

Encryption of data at rest. Preventive controls aim to stop risk events. Access controls, encryption, and change management are preventive. Logs are detective, backup restoration is corrective.

Answer

Log monitoring

Answer

Backup restoration procedures

Question 2

In the context of ERM integration, IT risk is typically considered a subset of which broader risk category?

Accepted Answer

Operational risk. In Enterprise Risk Management (ERM) integration, IT risk is typically categorized as a subset of operational risk because it directly impacts the availability, integrity, and confidentiality of information systems and data, which are core operational assets. Operational risk encompasses failures in internal processes, people, and systems, and IT risk—such as system outages, data breaches, or software defects—falls squarely within this domain. This alignment is reinforced by frameworks like COSO and ISO 31000, which treat technology-related failures as operational risk events.

Answer

Strategic risk

Answer

Financial risk

Answer

Compliance risk

Question 3

A vendor risk manager is tiering vendors based on the criticality of services and data access. A vendor that processes sensitive customer data for a core business application should be classified as which tier?

Accepted Answer

Critical. A vendor processing sensitive customer data for a core business application poses the highest potential impact on confidentiality, integrity, and availability. This aligns with the definition of a Critical tier, where failure or breach would cause severe business disruption, regulatory penalties, and reputational damage. The classification is driven by the combination of sensitive data access and the application's essential role in business operations.

Answer

Low

Answer

Medium

Answer

High

Question 4

A financial institution is evaluating the risk of a new mobile payment application. The risk team calculates the Annual Loss Expectancy (ALE) as $500,000 based on a single loss expectancy (SLE) of $100,000 and an annual rate of occurrence (ARO) of 5. After implementing a new encryption control at a cost of $150,000 per year, the ALE is reduced to $200,000. What is the residual risk in terms of ALE after one year of control operation?

Accepted Answer

$200,000. The residual risk is the remaining Annual Loss Expectancy (ALE) after controls are applied. Since the ALE after implementing the encryption control is explicitly stated as $200,000, that is the residual risk after one year of control operation. The control cost of $150,000 is a separate cost-of-control figure and does not reduce the ALE further; it is used for cost-benefit analysis, not for calculating residual risk.

Answer

$500,000

Answer

$350,000

Answer

$300,000

Question 5

A risk practitioner is creating a risk scenario for a ransomware attack. Which of the following is the BEST sequence to describe the scenario using the ISACA risk scenarios template?

Accepted Answer

Threat actor, threat type, event, asset/resource, timing, detection, response. The correct option is C, which orders the scenario as threat actor, threat type, event, asset/resource, timing, detection, and response. This matches the ISACA risk scenario template logic: it starts with who initiates the attack (threat actor), then the nature of the threat (threat type, e.g., ransomware/malware), then the event (the ransomware incident), then the affected asset/resource, followed by timing and the detection and response elements. Options A, B, and D misplace key components such as putting asset/resource or event before the threat actor or threat type, which breaks the causal sequence used in the ISACA template. Therefore, only C provides the BEST sequence for describing a ransomware risk scenario.

Answer

Asset/resource, event, threat actor, timing, detection, response, threat type

Answer

Threat type, event, asset/resource, threat actor, timing, detection, response

Answer

Event, threat actor, asset/resource, timing, detection, response, threat type

Question 6

After a risk assessment, the risk owner states that the residual risk for a specific asset is within the organization's risk tolerance. Which of the following BEST describes the action that should be taken?

Accepted Answer

Formally accept the risk and document the decision. When the risk owner confirms that residual risk is within the organization's risk tolerance, the appropriate action is to formally accept the risk and document the decision. This is a standard risk treatment option (risk acceptance) under the ISACA Risk IT Framework, where no further controls are needed because the residual risk level is already acceptable. Documenting the acceptance ensures auditability and accountability for the decision.

Answer

Transfer the risk to a third party

Answer

Implement additional controls to reduce risk further

Answer

Reassess the risk using a quantitative method

Question 7

A risk manager is designing a monitoring and reporting framework. Which THREE of the following are essential components of an effective risk and control monitoring program?

Accepted Answer

Control self-assessments (CSAs). Control self-assessments (CSAs) are essential because they empower process owners to evaluate the design and operating effectiveness of internal controls, providing firsthand evidence for the monitoring program. This bottom-up approach complements top-down testing by identifying control gaps and remediation needs directly from those who execute the controls, which is critical for a comprehensive risk and control monitoring framework.

Answer

Key performance indicators (KPIs)

Answer

Risk response plans

Question 8

Which of the following is the PRIMARY benefit of using a risk register for monitoring?

Accepted Answer

Centralized repository of all risks.. A risk register serves as the centralized repository where all identified risks, their attributes (likelihood, impact, owner, response), and status are documented and tracked over time. This single source of truth is the PRIMARY benefit for monitoring because it enables consistent tracking, reporting, and escalation of risk status across the enterprise. Real-time alerting and automation are features of GRC tooling layered on top, not the register's core value.

Answer

Provides real-time alerts.

Answer

Eliminates the need for KRIs.

Answer

Automates control testing.

Question 9

Which TWO of the following are key elements that should be included in an IT risk assessment report?

Accepted Answer

A list of identified risks and their ratings. Option A is correct because a risk assessment report must document the identified risks along with their assigned ratings (e.g., likelihood and impact scores, or qualitative labels such as high/medium/low), which form the core output of the assessment and enable prioritization. Option B is correct because the report should include recommendations for risk treatment — such as mitigation, transfer, acceptance, or avoidance — so that decision-makers can act on the findings; this is a standard component of risk assessment reporting per frameworks like ISO/IEC 27005 and NIST SP 800-30. Option C is not a key element, since vendor contracts are supporting evidence that may be referenced but are not part of the risk assessment report itself. Option D is not required, as network topology diagrams are technical artifacts that may inform the assessment but do not constitute a core reporting element. Option E is not relevant, because detailed IT financial budgets fall under financial or budgetary reporting, not IT risk assessment.

Answer

Copies of vendor contracts

Answer

Network topology diagrams

Answer

Detailed financial budgets of the IT department

Question 10

Which of the following is the primary purpose of a risk heat map in a risk report?

Accepted Answer

To prioritize risks based on likelihood and impact. A risk heat map visually plots risks on a grid based on their likelihood (probability) and impact (consequence), enabling stakeholders to quickly identify which risks require immediate attention. This prioritization is the primary purpose because it directly supports risk response decisions by highlighting high-priority risks that exceed the organization's risk appetite.

Answer

To track compliance with regulations

Answer

To detail remediation plans

Answer

To show control performance over time

Question 11

Which THREE of the following are common challenges in risk reporting?

Accepted Answer

Timeliness of information.. Timeliness of information is a common challenge in risk reporting because risk data must be current to support effective decision-making. If reports are delayed, the organization may act on outdated risk profiles, leading to inappropriate responses. Real-time or near-real-time reporting is often required, but data aggregation and processing latency can introduce delays.

Answer

Over-reliance on automated tools.

Answer

Lack of board support.

Question 12

A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?

Accepted Answer

Risk mitigation. Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 13

A mid-sized retail company operates 50 stores across three regions. Each store uses a point-of-sale (POS) system that transmits credit card transactions to a centralized payment processor. The company recently deployed a new SaaS-based inventory management application that connects to the POS system via API. The IT department has no formal process for tracking third-party connections. The risk manager suspects that unknown or unauthorized connections may exist. During a risk identification review, the risk manager discovers that the POS vendor's API documentation was shared with the inventory SaaS provider without a non-disclosure agreement (NDA). Additionally, the API keys for the POS system are stored in plain text configuration files on the inventory SaaS application server. The company's security policy requires encryption of all sensitive data in transit and at rest. Which of the following should the risk manager prioritize as the HIGHEST risk scenario to document in the risk register?

Accepted Answer

Exposure of POS system API keys stored in plain text on the inventory SaaS server. The plain-text storage of API keys on the inventory SaaS server represents an active, exploitable vulnerability that directly violates the company's encryption-at-rest policy. Unlike the other options, this is a confirmed technical control failure that could allow an attacker to impersonate the POS system, intercept or manipulate credit card transactions, and compromise the entire payment processing pipeline. The risk is immediate and high-impact because the keys are already exposed, not merely a procedural gap or missing legal agreement.

Answer

The POS system may not be PCI DSS compliant due to API sharing without NDA

Answer

No formal process for tracking third-party connections

Answer

The lack of an NDA with the inventory SaaS provider

Question 14

During a cost-benefit analysis for a new control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce risk by 80% and will cost $150,000 annually to operate. What is the net benefit of implementing the control?

Accepted Answer

$250,000. ALE reduction is 80% of $500,000 = $400,000. Net benefit = ALE reduction - annual control cost = $400,000 - $150,000 = $250,000.

Answer

$400,000

Answer

$100,000

Answer

$350,000

Question 15

A risk practitioner is assessing the effectiveness of the control environment supporting an online trading platform. Management asserts that controls are mature, but the practitioner must determine which activities constitute control monitoring rather than one-time assurance. Which TWO of the following activities are examples of ongoing control monitoring? (Choose two.)

Accepted Answer

Reviewing a monthly dashboard of failed login attempts and account lockouts against defined thresholds.. Ongoing monitoring relies on recurring observation with defined thresholds, ownership, and escalation. Reviewing authentication dashboards against thresholds and tracking remediation of open findings both provide continuous visibility into whether controls operate as intended and allow timely intervention. Periodic penetration tests, annual self-assessments, and register documentation are point-in-time or record-keeping activities that do not deliver the continuous feedback loop monitoring requires.

Answer

Documenting the control environment in the risk register during the annual risk assessment cycle.

Answer

Performing a control self-assessment workshop with process owners at the start of the fiscal year.

Answer

Commissioning an external penetration test of the trading platform once every two years.