CRISC Practice Test 41 — 15 Questions

Question 1

An organization has implemented a new control that requires manual approval for all high-value transactions. The control owner is responsible for ensuring approvals are obtained. Which control ownership aspect is demonstrated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Control ownership. The scenario explicitly states that the control owner is responsible for ensuring approvals are obtained, which directly demonstrates the concept of control ownership. Control ownership refers to the assignment of accountability for the implementation, operation, and maintenance of a specific control, such as manual approval for high-value transactions. This is a core principle in risk response, where a named individual is accountable for the control's effectiveness, not just its implementation or cost.

Answer

Control implementation plan

Answer

Cost-benefit analysis

Answer

Resource requirements

Question 2

Which TWO of the following are examples of corrective controls?

Accepted Answer

Disaster recovery plan execution. Disaster recovery plan execution (B) is a corrective control because it is activated after a disruptive event to restore normal operations. It directly addresses the impact of an incident by executing predefined procedures to recover systems and data, thereby correcting the damage caused by the outage or disaster.

Answer

Encryption of data at rest

Answer

Intrusion detection system

Answer

Access control lists

Question 3

A risk assessment identifies a high likelihood of a data breach due to insecure APIs. The risk team proposes disabling the APIs until they are secured, implementing a WAF, and purchasing breach insurance. Which THREE risk response options are being considered?

Accepted Answer

Transfer. (Transfer) is correct because purchasing breach insurance transfers the financial risk of a data breach to an insurance provider. Option C (Avoid) is correct because disabling the APIs until they are secured eliminates the risk entirely by removing the vulnerable component. Option D (Mitigate) is correct because implementing a Web Application Firewall (WAF) reduces the likelihood or impact of an API-based attack without removing the API.

Answer

Remediate

Answer

Accept

Question 4

An IAM policy grants an external auditor user permission to read objects from a sensitive data bucket, with no location restrictions. What risk does this indicate?

Accepted Answer

External auditor can access sensitive data from any location. The IAM policy's second statement allows the external-auditor user to perform GetObject on the corporate-data bucket without any IP address condition. This means the auditor can access sensitive data from any location, posing a risk of unauthorized access outside the internal network. Option B is incorrect because there is no unrestricted public access; the policy specifically allows only the external-auditor user. Option C is incorrect because listing operations (ListBucket) are not allowed; only GetObject is permitted. Option D is incorrect because the policy does not address encryption; the risk is about location-based access.

Answer

Unrestricted public access to the S3 bucket

Answer

Bucket is configured to allow list operations

Answer

Data in transit is unencrypted

Question 5

Refer to the exhibit. Based on the risk register, which risk response is applied to the risk with the highest inherent risk?

Accepted Answer

Transfer. The risk with the highest inherent risk (Risk A, with a score of 25) involves a critical database server lacking encryption at rest. The risk response chosen is 'Transfer,' which is implemented by purchasing a cyber insurance policy that specifically covers data breach costs and regulatory fines. This shifts the financial impact of the risk to the insurer without altering the technical vulnerability or likelihood of the event.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 6

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Accepted Answer

Risk transfer. Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Answer

Risk reduction

Answer

Risk acceptance

Answer

Risk avoidance

Question 7

An organization uses a risk and control monitoring system that generates weekly reports. The reports show a key control as 'effective' for the past three months. However, during a recent audit, a significant control failure was discovered. Which TWO of the following are MOST likely root causes for this discrepancy? (Choose two.)

Accepted Answer

The control test sample was not representative.. Options D and E are correct. A non-representative test sample (D) would fail to detect failures in parts of the population not sampled, leading to a false 'effective' rating. KRI thresholds set too high (E) would prevent alerts even when control failures occur, masking the true status. Option A (data integrity issue) is possible but less likely given the system generated consistent reports. Option B (inaccurate reporting by control owner) is plausible but assumes deliberate misrepresentation, which is not indicated as a root cause. Option C (low monitoring frequency) would affect detection, but three months of effective reports suggests frequency alone is not the primary issue.

Answer

The reporting system had a data integrity issue.

Answer

The control owner was not reporting accurately.

Answer

The monitoring frequency was too low.

Question 8

An organization recently experienced a significant security incident that was not detected by existing monitoring controls. The risk team is reviewing the effectiveness of the control monitoring framework. Which THREE of the following are key factors that should be evaluated to improve detection capabilities?

Accepted Answer

The correlation rules between different monitoring tools. Correlation rules between different monitoring tools (Option A) are critical because they define how alerts from disparate sources (e.g., SIEM, IDS/IPS, endpoint detection) are combined to identify complex attack patterns. Without well-tuned correlation rules, the organization may miss multi-stage attacks that span multiple systems, as no single tool alone provides the full picture. Evaluating and refining these rules directly improves the detection of incidents that existing controls failed to catch.

Answer

The existence of an incident response plan

Answer

The level of automation in incident response

Question 9

Which TWO of the following are examples of risk mitigation controls?

Accepted Answer

Implementing a firewall. Implementing a firewall is a risk mitigation control because it reduces the likelihood and impact of unauthorized network access by enforcing access control policies based on source/destination IP addresses, ports, and protocols. Firewalls operate at Layers 3 and 4 (and sometimes Layer 7) of the OSI model to filter traffic, thereby directly reducing the attack surface and preventing exploitation of vulnerabilities.

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Answer

Discontinuing a high-risk service

Question 10

An organization is designing a risk and control monitoring program for a new cloud-based application. Which of the following is the MOST important factor to consider when selecting Key Risk Indicators (KRIs)?

Accepted Answer

Alignment with strategic objectives.. Alignment with strategic objectives is the most important factor because KRIs must directly measure risks that could impede the organization's business goals and strategic initiatives. For a new cloud-based application, KRIs tied to strategic objectives ensure monitoring focuses on risks that matter most to the business, such as data breaches affecting customer trust or service downtime impacting revenue, rather than irrelevant metrics.

Answer

Historical loss data availability.

Answer

Ease of automated data collection.

Answer

Industry best practices.

Question 11

Which of the following is an example of a leading indicator?

Accepted Answer

Percentage of employees trained.. A leading indicator is a proactive metric that predicts future risk events or control effectiveness. The percentage of employees trained is a leading indicator because it measures a preventive control (security awareness) that reduces the likelihood of future incidents, such as phishing or data breaches. In contrast, lagging indicators like incident counts or loss amounts reflect past events.

Answer

Number of security incidents.

Answer

Audit findings count.

Answer

Loss amount from fraud.

Question 12

A medium-sized e-commerce company has a risk monitoring program that tracks key risk indicators (KRIs) monthly. One KRI is the percentage of orders with failed payment transactions. The threshold is 2%, but for the past three months, the KRI has been 2.5%, 3.1%, and 2.8%. The risk owner says this is due to a seasonal increase in fraudulent transactions and expects it to return to normal next month. The company has a compensating control that manually reviews flagged transactions. The internal audit team recently tested the compensating control and found it to be 100% effective. The risk committee wants to know if the KRI breach requires action. What should the risk practitioner recommend?

Accepted Answer

Acknowledge the breach but note that the compensating control is effective, so no immediate action is required; continue to monitor.. The compensating control (manual review of flagged transactions) has been tested as 100% effective, meaning the residual risk is within acceptable tolerance despite the KRI breach. The risk owner attributes the breach to a seasonal spike, and the risk monitoring program should continue to track the KRI monthly to confirm a return to normal. Immediate action is not warranted when the compensating control fully mitigates the risk, and the risk committee should be informed that the control is effective.

Answer

Immediately implement additional automated controls to reduce the KRI.

Answer

Escalate the issue to the board and recommend a risk acceptance.

Answer

Lower the KRI threshold to 3% to accommodate seasonal variations.

Question 13

Which TWO of the following are examples of key risk indicators (KRIs) in an IT environment? (Choose two.)

Accepted Answer

Number of critical security vulnerabilities unresolved for more than 30 days.. Unresolved critical security vulnerabilities for more than 30 days directly indicate a high-risk condition that could lead to exploitation, data breaches, or compliance violations. This KRI provides a measurable threshold (30 days) that triggers risk response actions, such as patching or compensating controls, making it a leading indicator of potential security incidents.

Answer

Number of IT projects in progress.

Answer

Number of employees in the IT department.

Answer

Annual IT budget variance.

Question 14

Which of the following is the PRIMARY purpose of integrating IT risk reporting into the enterprise risk management (ERM) program?

Accepted Answer

To provide a holistic view of risk across the organization. Integrating IT risk reporting into the ERM program provides a holistic view of risk across the organization by aligning IT-specific risks with strategic, operational, and compliance risks. This integration ensures that decision-makers can prioritize and respond to risks based on their aggregate impact, rather than treating IT risks in isolation. The primary purpose is to enable a unified risk posture that supports enterprise-wide governance and resource allocation.

Answer

To reduce the frequency of IT risk reporting

Answer

To eliminate the need for IT risk assessments

Answer

To replace IT risk management with ERM

Question 15

A company has implemented an automated control monitoring system that generates alerts when transactions exceed predefined thresholds. The system has been in production for six months. The risk team notices that the number of alerts has been decreasing, while actual control failures have remained constant. Which of the following is the MOST likely cause?

Accepted Answer

The data feed from transaction systems has degraded, causing missing data. A degraded data feed can cause the monitoring system to miss transaction records, resulting in fewer alerts while actual control failures remain constant. Option A is incorrect: if employees bypass the system, actual failures would likely change, not remain constant. Option B is incorrect: improved control effectiveness would reduce actual failures, which contradicts the given condition. Option D is incorrect: adjusting thresholds to be more restrictive (e.g., higher limits) would reduce alerts but should also reduce actual failures, not keep them constant.

Answer

Employees have learned to bypass the monitoring system

Answer

The control effectiveness has improved significantly

Answer

The thresholds were automatically adjusted to be more restrictive