CRISC Practice Test 40 — 15 Questions

Question 1

A company is migrating its customer database to a public cloud provider. During the planning phase, which of the following is the MOST effective approach to identify risks specific to this migration?

Accepted Answer

Conduct a threat modeling exercise focusing on the cloud architecture. Conducting a threat modeling exercise (D) is the most effective approach because it systematically identifies threats, vulnerabilities, and attack vectors specific to the cloud architecture, data flow, and trust boundaries of the migration. Unlike generic reviews, threat modeling (e.g., using STRIDE or PASTA) directly addresses the unique risks of moving a customer database to a public cloud, such as misconfigured access controls, insecure APIs, or data exposure during transit.

Answer

Review industry risk reports for similar migrations

Answer

Rely on the cloud provider's published risk documentation

Answer

Perform a compliance checklist review

Question 2

An organization is designing a vendor risk management program. Which TWO of the following are essential components of ongoing vendor monitoring? (Select TWO)

Accepted Answer

Continuous monitoring via shared threat intelligence platforms. Continuous monitoring via shared threat intelligence platforms (Option D) is essential because it provides real-time visibility into emerging threats and vulnerabilities that may affect the vendor's environment. This allows the organization to proactively adjust risk posture without waiting for periodic reviews, aligning with the CRISC principle of ongoing risk response.

Answer

Review of contract terms

Answer

Penetration testing by the vendor

Answer

Initial onboarding security questionnaire

Question 3

During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control will cost $100,000 annually and is expected to reduce the ALE by 80%. What is the net benefit of implementing this control?

Accepted Answer

$300,000. The current annual loss expectancy (ALE) is $500,000. An 80% reduction lowers the ALE by $400,000, resulting in a new ALE of $100,000. The annual control cost is $100,000, so the net benefit is the reduction in ALE ($400,000) minus the control cost ($100,000), which equals $300,000.

Answer

$100,000

Answer

$400,000

Answer

$500,000

Question 4

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

Accepted Answer

Avoid by keeping IT support in-house. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements, which represents a high-severity compliance risk that cannot be effectively mitigated through monitoring alone. Avoiding the risk by keeping IT support in-house eliminates the exposure entirely, making it the best response when the risk level exceeds the organization's risk appetite and cannot be reduced to an acceptable level through other strategies.

Answer

Mitigate by regularly monitoring the provider

Answer

Transfer the risk through the outsourcing contract

Answer

Accept the risk because the provider is cheaper

Question 5

After implementing a set of controls, the risk owner calculates the residual risk and finds it is still above the risk tolerance. However, the cost to further reduce the risk exceeds the potential loss. What is the MOST appropriate next step?

Accepted Answer

Formally accept the residual risk. When the residual risk remains above the risk tolerance but the cost of further mitigation exceeds the potential loss, the most appropriate step is to formally accept the residual risk. This decision is based on a cost-benefit analysis showing that additional controls are not economically justified. The risk owner documents the acceptance, acknowledging the remaining exposure within the organization's risk appetite framework.

Answer

Re-assess the inherent risk

Answer

Reduce current controls to lower costs

Answer

Implement additional controls despite the cost

Question 6

A retail company uses a legacy inventory system that is no longer supported by the vendor. The IT department is planning to migrate to a modern cloud-based system. During risk identification, which of the following should be considered a PRIMARY risk?

Accepted Answer

Loss of data integrity during the data migration process.. Loss of data integrity during migration is the primary risk because the legacy system is unsupported, meaning there are no vendor patches or tools to validate or repair data inconsistencies. Corrupted or incomplete data transferred to the cloud-based system can lead to inaccurate inventory records, financial losses, and operational disruptions that are difficult to reverse without vendor support.

Answer

Inadequate training of staff on the new system.

Answer

Potential cost overrun due to migration complexity.

Answer

Failure to decommission the legacy system after migration.

Question 7

A multinational corporation has recently experienced a significant increase in phishing attacks targeting its employees. The attacks have caused several data breaches, resulting in regulatory fines and reputational damage. The organization has implemented security awareness training for all employees, but the number of successful attacks remains high. Additionally, the organization's risk appetite for cybersecurity incidents is Low. The CRO has asked you to recommend a risk response. You have the following options:

A. Accept the risk because the training has reduced the likelihood, and further controls are too expensive.
B. Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).
C. Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.
D. Avoid the risk by discontinuing the use of email for business communications.

Which course of action is most appropriate given the organization's risk appetite and the current situation?

Accepted Answer

Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.. Implementing technical controls like advanced email filtering (e.g., SPF, DKIM, DMARC validation) and multi-factor authentication (MFA) directly reduces both the likelihood and impact of phishing attacks. Given the organization's low risk appetite for cybersecurity incidents, this risk mitigation approach aligns with the need to lower residual risk to an acceptable level, especially since training alone has proven insufficient.

Answer

Avoid the risk by discontinuing the use of email for business communications.

Answer

Accept the risk because the training has reduced the likelihood, and further controls are too expensive.

Answer

Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).

Question 8

Which THREE of the following are key components of an effective risk treatment plan?

Accepted Answer

Assigned responsibilities. Assigned responsibilities are a key component of an effective risk treatment plan because they ensure accountability for implementing specific risk mitigation actions. Without clear ownership, tasks may be delayed or overlooked, undermining the plan's execution. This aligns with the CRISC framework's emphasis on defining roles to operationalize risk response.

Answer

The risk owner's signature

Answer

A detailed budget

Question 9

A security awareness program is being designed to promote a risk-aware culture. Which TWO elements are most critical for the program's success?

Accepted Answer

Tone from the top. Tone from the top demonstrates management commitment, and communicating risk in business terms ensures that employees understand the relevance to their roles. These are key to fostering a risk-aware culture.

Answer

Establishing a risk committee

Answer

Mandatory annual testing with pass/fail

Answer

Detailed technical training for all staff

Question 10

A risk manager is evaluating the effectiveness of a control that requires dual authorization for high-value transactions. The Key Control Indicator (KCI) for this control is the rate of transactions processed without dual authorization (i.e., exception rate). If the acceptable exception rate is less than 1% and the observed rate is 2.5%, what is the most appropriate immediate action?

Accepted Answer

Investigate the root cause of the exceptions. The observed exception rate of 2.5% exceeds the acceptable threshold of 1%, indicating a control deficiency. The most appropriate immediate action is to investigate the root cause of the exceptions to determine whether the control is failing due to process gaps, user behavior, or system issues. Root cause analysis (RCA) is a foundational step before any remediation, as it prevents premature redesign or unjustified risk acceptance.

Answer

Redesign the control immediately

Answer

Accept the risk since the rate is still low

Answer

Increase the acceptable exception rate to 2.5%

Question 11

Which TWO of the following are key inputs to a risk assessment?

Accepted Answer

Asset inventory

Answer

Employee satisfaction survey

Answer

Business continuity plan

Answer

Risk appetite statement

Question 12

A SOC analyst observes repeated failed login attempts from an external IP address targeting a user account. What is the best next step in the IT risk identification process?

Accepted Answer

Investigate if the IP address is associated with known malicious activity. The first step in the IT risk identification process is to validate whether the observed event represents a genuine threat. Investigating the external IP address against threat intelligence feeds (e.g., VirusTotal, AlienVault OTX) confirms if it is associated with known malicious activity, such as a botnet or brute-force campaign, before taking any action. This aligns with the CRISC risk identification phase, where the goal is to characterize the risk event, not immediately respond or escalate.

Answer

Block the IP address immediately

Answer

Conduct a vulnerability scan of the target system

Answer

Escalate to the incident response team

Question 13

Which TWO of the following are examples of inherent risk?

Accepted Answer

Risk of unauthorized access due to weak password policy. Inherent risk is the risk that exists in the absence of any controls or mitigations. Option A describes the risk of unauthorized access due to a weak password policy, which is a vulnerability present before any compensating controls (like multifactor authentication) are applied. Option B describes the risk of a data breach due to unencrypted sensitive data, which is a direct exposure that exists before encryption controls are implemented. Both represent the raw, uncontrolled risk level.

Answer

Residual risk after implementing firewalls

Answer

Risk appetite defined by the board

Answer

Risk reduction achieved by multifactor authentication

Question 14

An IT risk manager is performing a risk assessment for a new cloud service. Which TWO of the following are key inputs to the risk identification process? (Select TWO.)

Accepted Answer

Threat intelligence feeds. Threat intelligence feeds (B) provide current information about emerging threats, attack vectors, and adversary tactics, which are essential for identifying relevant risks to the cloud service. An asset inventory (E) is a foundational input because it lists all assets (e.g., data, VMs, APIs) that could be affected, enabling the risk manager to map threats to specific resources. Both are direct inputs to the risk identification phase, as defined by the CRISC framework.

Answer

Risk appetite statement

Answer

Control testing results

Answer

Residual risk levels

Question 15

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. When the cost of the control ($500k) exceeds the annualized loss expectancy (ALE) of $300k and the risk is within the organization's risk appetite, it is more cost-effective to accept the risk rather than implement a costly control.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk