CRISC Practice Test 42 — 15 Questions

Question 1

A bank's risk committee reviews a monthly risk report that includes KRIs. One KRI shows that the number of failed transactions due to system errors is trending upward. The control owner states that the trend is within the risk appetite. However, the report also shows that the number of customer complaints is stable. What should the risk manager do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Investigate the root cause of the increasing failed transactions.. The upward trend in failed transactions due to system errors, even if within risk appetite, indicates a potential control degradation or emerging risk that requires root cause analysis. The risk manager must first investigate the underlying cause (e.g., software bugs, database contention, or network latency) to determine if the trend signals a systemic issue that could breach risk appetite thresholds or impact customer experience, despite stable complaints. This aligns with the CRISC principle of proactive risk monitoring, where unexplained KRI deviations trigger investigation before escalation or acceptance.

Answer

Escalate to the board of directors.

Answer

Accept the control owner's assessment and continue monitoring.

Answer

Recommend increasing the monitoring frequency.

Question 2

You are the IT risk manager for a financial institution. During a routine vulnerability scan, you discover that a critical web application has a high-severity vulnerability that could allow remote code execution. The development team states that a patch is not yet available from the vendor, and the application is business-critical with no acceptable downtime. The risk owner wants to accept the risk. However, the organization's risk appetite is very low for security vulnerabilities. You have been asked to recommend a course of action. Which of the following should you recommend?

Accepted Answer

Implement a web application firewall (WAF) with virtual patching to reduce exploitability.. Implementing a web application firewall (WAF) with virtual patching provides an immediate, compensating control that reduces the exploitability of the vulnerability without requiring application downtime. This aligns with the organization's low risk appetite by actively mitigating the risk while waiting for an official vendor patch, rather than passively accepting it.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Decommission the application immediately.

Answer

Accept the risk as the team will monitor for patches.

Question 3

You are the IT risk manager for a mid-sized e-commerce company. The company processes credit card payments and stores customer data. Recently, the company experienced a security incident where an attacker exploited a SQL injection vulnerability in the web application, exfiltrating a database of customer records. The vulnerability was introduced three months ago during a feature upgrade. The development team claims they followed secure coding guidelines, but the vulnerability was missed due to insufficient testing. The company's risk appetite is moderate, and they have a risk management policy that requires risks to be treated within 30 days of identification. The CISO wants to know the most effective way to reduce the likelihood of similar incidents. You have assessed that the current risk score for web application vulnerabilities is 16 (High). The company has a bug bounty program, but it has not been effective. Which of the following courses of action would BEST address the root cause and reduce the risk?

Accepted Answer

Implement a secure software development lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing.. The root cause of the incident is a failure in the development process: secure coding guidelines were followed but insufficient testing allowed a SQL injection vulnerability to be introduced. Implementing a Secure Software Development Lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing directly addresses this root cause by embedding security controls into every phase of development, preventing vulnerabilities from being introduced in the first place. This is the most effective way to reduce the likelihood of similar incidents, as it proactively fixes the process rather than relying on reactive measures.

Answer

Increase the frequency of vulnerability scanning and patch management.

Answer

Deploy a web application firewall (WAF) to block SQL injection attempts.

Answer

Increase the reward amounts in the bug bounty program to attract more researchers.

Question 4

A large e-commerce company uses several key risk indicators (KRIs) to monitor credit card fraud. The risk committee noticed that one KRI has been trending above the threshold for three consecutive months, yet no risk response was initiated. Which of the following is the MOST likely root cause?

Accepted Answer

The risk response workflow was not triggered automatically. The most likely root cause is that the risk response workflow was not triggered automatically. In a mature risk monitoring environment, KRIs should be linked to automated workflows that initiate a response when thresholds are breached. Since the KRI has been above threshold for three consecutive months without any action, it indicates a failure in the automated triggering mechanism, not in the KRI's accuracy or the threshold's leniency.

Answer

The KRI was not validated for accuracy

Answer

The KRI threshold was set too lenient

Answer

The monitoring tool failed to capture data

Question 5

An organization deployed a new intrusion detection system (IDS) that generates many alerts. The security team is overwhelmed and has started ignoring some alerts. What is the BEST way to address this issue?

Accepted Answer

Tune the IDS to reduce false positive alerts.. Tuning the IDS to reduce false positive alerts directly addresses the root cause of alert fatigue: excessive noise from misconfigured or overly sensitive detection rules. By adjusting thresholds, signatures, and exclusion lists, the security team can focus on genuine threats without being overwhelmed, which is a core risk monitoring and reporting practice.

Answer

Implement a SIEM to filter and prioritize alerts.

Answer

Deactivate the IDS until it can be properly configured.

Answer

Hire additional security analysts to handle the alert volume.

Question 6

What is the primary purpose of a control self-assessment (CSA)?

Accepted Answer

To involve process owners in evaluating control effectiveness.. The primary purpose of a control self-assessment (CSA) is to involve process owners in evaluating the effectiveness of controls within their own areas of responsibility. This approach leverages the deep operational knowledge of those who design and execute processes daily, enabling them to identify control gaps and improvement opportunities that external auditors might miss. By fostering ownership and accountability, CSA enhances the control environment without replacing independent assurance functions.

Answer

To replace external audits.

Answer

To automate monitoring.

Answer

To generate compliance reports.

Question 7

A retail company uses a manual control to verify that all credit card transactions are processed by authorized payment terminals. The control requires a store manager to compare a daily transaction log against a list of approved terminal IDs. The company processes an average of 10,000 transactions per day across 200 stores. During a recent internal audit, it was found that 15% of stores had not completed the reconciliation for the past month. The audit also revealed that several unauthorized terminals had been used to process transactions, resulting in a data breach of customer payment information. The company's risk appetite for payment card data security is very low. The current monitoring approach includes a quarterly review of control performance by the internal audit team. The risk manager needs to recommend improvements to the monitoring of this control. Which of the following is the BEST recommendation?

Accepted Answer

Automate the reconciliation by integrating the transaction log with the approved terminal list.. Automating the reconciliation process ensures it is performed consistently and promptly, eliminating the manual gaps. Option A is wrong because increasing audit frequency does not prevent the control from being skipped. Option B is wrong because disciplinary actions may motivate compliance but do not address the process inefficiency. Option D is wrong because additional training may help but does not guarantee consistent performance.

Answer

Increase internal audit reviews of the control to monthly.

Answer

Implement disciplinary actions for store managers who skip reconciliations.

Answer

Provide refresher training to all store managers on the procedure.

Question 8

Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?

Accepted Answer

SSH protocol version 1.0 on 192.168.1.10. SSH protocol version 1.0 is critically vulnerable to multiple security flaws, including session key recovery and man-in-the-middle attacks, due to weak integrity checks and lack of strong cryptographic algorithms. Unlike the other options, which represent misconfigurations or outdated software that can be mitigated with patches or configuration changes, SSHv1.0 is a deprecated protocol with known, easily exploitable vulnerabilities that directly compromise confidentiality and integrity of administrative access. This makes it the most critical risk to address first, as it exposes the core management interface of the asset.

Answer

RDP with weak encryption on 192.168.1.20

Answer

SMB signing not required on 192.168.1.20

Answer

Apache HTTP Server 2.2.3 on 192.168.1.10

Question 9

Which TWO of the following are examples of continuous monitoring techniques?

Accepted Answer

Automated SIEM rules for intrusion detection.. Automated SIEM rules for intrusion detection (B) are a continuous monitoring technique because they operate in real-time, analyzing logs and events as they occur to detect and alert on security incidents without manual intervention. This aligns with the CRISC principle of ongoing, automated oversight rather than periodic or ad-hoc reviews.

Answer

Ad-hoc access reviews requested by management.

Answer

Annual risk assessment.

Answer

Quarterly control testing by internal audit.

Question 10

A healthcare organization is migrating its electronic health records (EHR) system to a cloud provider. The risk assessment shows that the cloud provider has strong security certifications (e.g., SOC 2 Type II, ISO 27001). However, the organization's legal team is concerned about data sovereignty laws that require patient data to remain within the country. The cloud provider's data centers are located in three regions: one in-country, and two outside. The project manager proposes using only the in-country data center. The IT director warns that this will increase latency and reduce redundancy. The risk manager must propose a response. Which is the BEST option?

Accepted Answer

Configure the EHR system to store primary data in the in-country data center, and use the other two centers for disaster recovery with data residency controls ensuring data does not leave the country unless encrypted and with legal approval.. It balances compliance with data sovereignty laws (using the in-country data center for primary storage) and maintains redundancy for disaster recovery with data residency controls. Option A is wrong because simply accepting the legal risk based on certifications is not sufficient; data sovereignty laws are regulatory requirements that must be adhered to, and the certifications do not override those laws. Option B is wrong because automatic failover to data centers outside the country would violate data sovereignty laws by allowing patient data to leave the country without proper controls. Option D is wrong because using only one data center increases availability risk and does not address the legal concerns properly; it avoids the legal risk but introduces high operational risk.

Answer

Accept the legal risk because the cloud provider's certifications are sufficient, and document the decision.

Answer

Use all three data centers with automatic failover, and rely on the cloud provider's contractual guarantees of data residency.

Answer

Use only the in-country data center and accept the increased availability risk.

Question 11

A financial services firm is migrating critical applications to a public cloud. The architecture review board (ARB) is evaluating the solution architecture. Which THREE risks should the ARB prioritize for review?

Accepted Answer

Vendor lock-in due to proprietary services. Data sovereignty (regulatory), shared responsibility model (security gaps), and vendor lock-in (strategic) are key cloud risks that the ARB should assess before implementation.

Answer

Energy consumption of cloud data centers

Answer

Network bandwidth limitations

Question 12

A risk manager is evaluating the potential impact of quantum computing on the organization's encryption infrastructure. The organization uses RSA-2048 for key exchanges and digital signatures. According to current quantum computing projections, what is the MOST urgent risk management action to take?

Accepted Answer

Begin a cryptographic inventory and develop a migration plan to post-quantum cryptography. Quantum computers capable of breaking RSA-2048 are not imminent but expected within 10-20 years. The most urgent action is to start planning for post-quantum cryptography migration, as it requires long lead times for assessment and implementation.

Answer

Immediately replace all RSA-2048 keys with symmetric encryption

Answer

Purchase cyber insurance to cover potential losses from quantum attacks

Answer

Increase the RSA key length to 4096 bits

Question 13

A risk practitioner is designing a quarterly IT risk report for the CISO. Which of the following elements is MOST critical for tactical decision-making?

Accepted Answer

Control performance metrics. Control performance metrics (D) are most critical for tactical decision-making because they provide quantifiable, real-time data on how well existing security controls are operating. Tactical decisions require immediate, actionable insights—such as whether a firewall rule is blocking 95% of malicious traffic or if a patch management process is meeting its 30-day SLA—rather than high-level summaries or future projections. Without control metrics, the CISO cannot assess the effectiveness of current defenses or prioritize remediation efforts.

Answer

Top risks and status

Answer

Risk heat map

Answer

Upcoming risk events

Question 14

Which of the following is the BEST example of promoting a risk-aware culture within an organization?

Accepted Answer

Encouraging incident reporting without blame. A blame-free incident reporting culture is the foundation of a risk-aware environment. When employees feel safe to report errors or near-misses without fear of punishment, the organization can collect accurate data on control weaknesses and emerging threats, enabling proactive risk response. This aligns with the COBIT 5 principle of fostering a culture of openness and learning, which is essential for effective risk management.

Answer

Implementing strict penalties for security violations

Answer

Assigning risk ownership to IT only

Answer

Conducting annual security training

Question 15

An organization is using the FAIR framework to perform a quantitative risk analysis for a data breach scenario. Which TWO of the following are components of the Annualized Loss Expectancy (ALE) calculation in FAIR?

Accepted Answer

Loss Event Frequency (LEF). In the FAIR framework, Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) × Loss Magnitude (LM). LEF represents the probable number of times a loss event will occur per year, and LM represents the probable magnitude of a single loss event. This differs from traditional quantitative risk analysis, which uses ARO and SLE. Therefore, the correct components from the FAIR perspective are LEF and LM.

Answer

Annualized Rate of Occurrence (ARO)

Answer

Single Loss Expectancy (SLE)

Answer

Exposure Factor (EF)