CRISC Practice Test 41 — 15 Questions

Question 1

Which THREE of the following are commonly used techniques for identifying IT risks in a large enterprise?

Accepted Answer

Brainstorming sessions. Brainstorming sessions (B) are a core risk-identification technique in which cross-functional stakeholders and subject-matter experts collectively surface potential threats, vulnerabilities, and failure scenarios across the enterprise. The Delphi technique (C) is also a recognized identification method: it gathers anonymous, iterative expert judgments through rounds of questionnaires and controlled feedback until consensus emerges, which suits large, distributed organizations and reduces bias. Risk questionnaires (D) are commonly used to systematically collect risk information from business units, process owners, and IT staff, often via surveys or checklists, ensuring broad coverage of assets and processes. Cost-benefit analysis (A) is a decision-support and risk-evaluation tool for comparing the costs of controls against expected benefits, not a technique for identifying risks. SWOT analysis (E) is a strategic-planning framework for assessing strengths, weaknesses, opportunities, and threats; while it can inform risk discussions, it is not one of the standard, commonly cited IT risk-identification techniques in frameworks such as ISO 31000 or ISACA's risk IT guidance.

Answer

Cost-benefit analysis

Answer

SWOT analysis

Question 2

A multinational corporation operates in 15 countries with decentralized control monitoring systems. Each regional office uses different tools and processes for monitoring operational risks. The corporate risk team has consolidated quarterly reports, but the board recently raised concerns about inconsistencies and late identification of emerging risks. A root cause analysis revealed that regional monitoring teams define key risk indicators (KRIs) differently and report on different timeframes. Additionally, there is no centralized platform to aggregate data. The risk manager must recommend a solution that balances local autonomy with global visibility. Which option is the most effective?

Accepted Answer

Implement a centralized risk and control monitoring platform that aggregates data and enforces common reporting standards.. A centralized risk and control monitoring platform that aggregates data while enforcing common reporting standards directly addresses the root causes: inconsistent KRI definitions, differing timeframes, and no aggregation mechanism. It preserves local autonomy in how regions execute monitoring while giving the corporate risk team and board consistent, timely global visibility. This is the only option that solves both the standardization and aggregation problems simultaneously.

Answer

Create a policy requiring regional risk teams to follow the same KRI definitions and reporting schedule.

Answer

Standardize monitoring tools across all regions globally.

Answer

Increase the frequency of board risk committee meetings to twice per month.

Question 3

An IT risk manager is reviewing the results of a recent risk assessment. The organization has a risk appetite that allows for low residual risk. One identified risk has an inherent risk score of 15 (on a scale of 1-25) and currently has no controls. Which of the following is the BEST recommendation for this risk?

Accepted Answer

Implement controls to reduce the residual risk to an acceptable level.. The inherent risk score of 15 (out of 25) is moderate, but the organization's risk appetite allows only low residual risk. Since there are currently no controls, the residual risk equals the inherent risk of 15, which exceeds the acceptable threshold. Therefore, implementing controls is the best recommendation to reduce the residual risk to a level that aligns with the risk appetite.

Answer

Accept the risk because the score is moderate.

Answer

Transfer the risk via cyber insurance.

Answer

Avoid the risk by discontinuing the business process.

Question 4

Which THREE of the following are components of Loss Magnitude in the FAIR framework?

Accepted Answer

Reputational damage. In the FAIR (Factor Analysis of Information Risk) framework, Loss Magnitude is the probable loss resulting from a risk event and is decomposed into primary and secondary loss forms, each with six loss categories: productivity, response, replacement, fines and judgments, competitive advantage, and reputation. Option A (Reputational damage) is correct because reputation loss is one of the six secondary loss categories that make up Loss Magnitude. Option C (Incident response costs) is correct because response costs — the expense of managing an incident (forensics, communications, management time) — are one of the six loss categories within Loss Magnitude. Option D (Recovery costs) is correct because replacement/recovery costs, the expense of restoring or replacing assets after an event, are likewise one of the six Loss Magnitude categories. Option B (Vulnerability severity) is not part of Loss Magnitude; vulnerability is a factor in the Frequency/Loss Event Probability side of the FAIR ontology (resistance strength against threat capability). Option E (Threat event frequency) is not part of Loss Magnitude either; it is a primary factor under Loss Event Frequency in FAIR.

Answer

Vulnerability severity

Answer

Threat event frequency

Question 5

An organization uses a SIEM to automatically test access control rules on a continuous basis. This is an example of which type of monitoring?

Accepted Answer

Continuous monitoring. A SIEM that automatically tests access control rules on a continuous basis performs ongoing validation of rule effectiveness and compliance. This is a classic example of continuous monitoring, where security controls are assessed in real-time or near-real-time without manual intervention, ensuring that access policies remain effective against evolving threats.

Answer

Key Risk Indicator monitoring

Answer

Vulnerability scanning

Answer

Periodic control testing

Question 6

In the context of IT risk reporting to the board, which THREE elements should be included to effectively communicate risk?

Accepted Answer

Top risks and status. Option B (Top risks and status) is correct because board-level reporting must prioritize the most significant risks and their current mitigation status, giving directors a concise view of what threatens organizational objectives and how management is responding. Option C (Risk heat map) is correct because a heat map visually plots risks by likelihood and impact, enabling the board to quickly grasp relative exposure and prioritize attention without wading through technical detail. Option E (Risk trend analysis) is correct because showing how risk levels change over time (e.g., increasing, stable, or decreasing) demonstrates whether risk management is effective and supports forward-looking governance decisions. Option A (Detailed technical logs) does not belong because raw logs are operational artifacts for IT staff, not strategic governance information, and would overwhelm the board with irrelevant granularity. Option D (Employee performance reviews) does not belong because individual HR performance data is unrelated to enterprise risk communication and would be inappropriate to present in a board risk report.

Answer

Detailed technical logs

Answer

Employee performance reviews

Question 7

Which TWO of the following are appropriate actions when a control deficiency is identified during monitoring? (Select exactly two.)

Accepted Answer

Document the deficiency and its impact. Documenting the deficiency and its impact is a fundamental step in the risk and control monitoring process. It ensures that the nature, severity, and potential consequences of the control failure are formally recorded, which is essential for risk assessment, reporting, and audit trails. Without this documentation, the organization cannot properly evaluate the risk exposure or justify remediation efforts.

Answer

Increase the risk appetite

Answer

Ignore if the deficiency is minor

Answer

Immediately terminate the control owner

Question 8

An organization is performing a quantitative risk analysis using the FAIR framework. Which THREE of the following are direct components of the FAIR model?

Accepted Answer

Loss Event Frequency. In the FAIR (Factor Analysis of Information Risk) ontology, Loss Event Frequency (B) is a core top-level factor representing how often loss events occur, and it is decomposed into Threat Event Frequency and Vulnerability. Threat Event Frequency (C) is a direct component of FAIR, describing the probable frequency with which threat agents act against an asset. Vulnerability (E) is also a direct FAIR component, defined as the probability that a threat event becomes a loss event, and it combines with Threat Event Frequency to derive Loss Event Frequency. By contrast, Single Loss Expectancy (A) and Annualized Loss Expectancy (D) are classic qualitative/quantitative risk formulas from traditional risk analysis (SLE = asset value × exposure factor; ALE = SLE × ARO), not native FAIR ontology components.

Answer

Single Loss Expectancy

Answer

Annualized Loss Expectancy

Question 9

A change to a critical application is being implemented without updating the associated security controls. This is most likely a failure in which process?

Accepted Answer

Change management. A change to a critical application that bypasses updating security controls is a direct failure of the change management process. Change management requires that all changes, including security controls, be reviewed, approved, and documented before implementation to maintain the risk posture. Without this process, the organization loses visibility and control over the security implications of the change, leading to potential vulnerabilities.

Answer

Control design

Answer

Project management

Answer

User training

Question 10

An organization has implemented a new firewall rule to block malicious IP addresses. This is an example of which type of control?

Accepted Answer

Preventive control. A firewall rule that blocks malicious IP addresses is a preventive control because it proactively stops unauthorized traffic before it can reach the internal network. By filtering packets based on source IP addresses, the firewall enforces access control policies at the network layer, preventing potential attacks from ever being initiated. This aligns with the CRISC definition of preventive controls, which are designed to avoid or deter undesirable events.

Answer

Directive control

Answer

Corrective control

Answer

Detective control

Question 11

Which TWO of the following are primary sources of IT risk identification? (Select exactly TWO.)

Accepted Answer

Incident reports. Incident reports are a primary source of IT risk identification because they provide direct evidence of past security events, such as malware infections, unauthorized access attempts, or system failures. By analyzing incident reports, risk practitioners can identify patterns, root causes, and control weaknesses that represent current or emerging risks. This historical data is essential for updating the risk register and prioritizing remediation efforts based on actual impact.

Answer

Asset inventory

Answer

Risk appetite

Answer

Policy documents

Question 12

An organization is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. Which of the following is the PRIMARY risk introduced by this IT/OT convergence?

Accepted Answer

Expansion of the attack surface to OT systems. Connecting ICS/OT systems to the corporate IT network exposes previously isolated OT devices to the corporate attack surface, allowing threats that compromise IT to pivot into OT. This expansion of the attack surface is the primary risk of IT/OT convergence because OT systems often lack security controls and cannot be easily patched. The other options are secondary or not risks at all.

Answer

Reduced availability of OT systems

Answer

Higher cost of network equipment

Answer

Increased complexity of data analytics

Question 13

A risk practitioner is connecting a risk scenario to business impact. The scenario involves a ransomware attack that encrypts critical financial systems, resulting in a two-week outage. Which of the following is the MOST appropriate business impact category?

Accepted Answer

Operational disruption. A two-week outage of critical financial systems directly halts business processes, which is the definition of operational disruption — the inability to execute normal business operations. While financial loss and reputational damage may follow, the primary and most direct business impact category for an outage that stops systems from functioning is operational disruption. CRISC expects the practitioner to map the scenario's immediate effect to the correct impact category.

Answer

Regulatory penalty

Answer

Reputational damage

Answer

Financial loss

Question 14

After a risk assessment, the risk owner determines that the residual risk is still above the risk appetite. Which of the following is the MOST appropriate next step?

Accepted Answer

Implement additional controls. When residual risk remains above the risk appetite after initial risk assessment, the most appropriate next step is to implement additional controls to further reduce the risk to an acceptable level. This aligns with the risk treatment process where controls are selected and applied to lower the likelihood or impact of the risk event. Simply transferring, ignoring, or accepting the risk without further action would not address the gap between residual risk and risk appetite.

Answer

Transfer the risk

Answer

Ignore the risk

Answer

Accept the risk

Question 15

A company is developing risk scenarios for business impact analysis. Which of the following scenario components directly links the risk event to potential financial loss?

Accepted Answer

Consequence. In risk scenario development, the consequence component describes the outcome or impact that results from a threat exploiting a vulnerability against an asset — and it is the consequence that is translated into financial loss estimates during business impact analysis. Without a defined consequence, there is no direct linkage from the risk event to monetary impact.

Answer

Vulnerability

Answer

Threat actor

Answer

Asset