CRISC Practice Test 42 — 15 Questions

Question 1

An internal audit report identifies that the IT department did not patch a critical vulnerability in a database server for 90 days. The risk manager wants to identify the root cause risk. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a root cause analysis on the patching process. The risk manager needs to identify the root cause risk, which requires understanding why the patching process failed to apply a critical security update within the required timeframe. A root cause analysis (RCA) on the patching process systematically examines procedural breakdowns, such as missed scanning cycles, lack of change management approval, or insufficient prioritization of database-specific patches (e.g., Oracle Critical Patch Updates). This approach directly addresses the underlying process deficiency rather than merely documenting or re-verifying the vulnerability.

Answer

Interview the database system owner

Answer

Conduct a new vulnerability scan

Answer

Update the risk register with the finding

Question 2

A healthcare organization is subject to strict regulatory requirements regarding patient data privacy. The organization has a control that requires all access to patient records to be logged and reviewed weekly by the compliance team. The review is currently performed manually by sampling 10% of the logs. The compliance team reports that the review takes 20 hours per week and they are often unable to complete it on time. As a result, some suspicious access patterns are detected weeks after they occur. The risk manager needs to propose an improvement to the monitoring process. The organization's risk appetite for undetected unauthorized access is very low. Which of the following is the MOST effective recommendation?

Accepted Answer

Deploy user behavior analytics (UBA) tools for automated anomaly detection.. The most effective recommendation because deploying user behavior analytics (UBA) tools automates the detection of anomalous access patterns, enabling real-time or near-real-time monitoring. This reduces manual effort, improves detection speed, and aligns with the organization's low risk appetite for undetected unauthorized access. Option A is wrong because reducing review frequency to bi-weekly would further delay detection, increasing risk. Option B is wrong because hiring additional staff only addresses the workload issue temporarily and does not improve detection timeliness or scalability. Option D is wrong because increasing the sample size to 50% would increase manual effort and still result in delayed detection due to the manual review bottleneck.

Answer

Reduce the review frequency to bi-weekly to free up time.

Answer

Hire additional staff to perform the manual reviews.

Answer

Increase the sample size to 50% of logs for better coverage.

Question 3

A Key Control Indicator (KCI) for a critical firewall rule set shows an exception rate of 12% over the past month, exceeding the acceptable threshold of 5%. The control owner is responsible for remediation. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a root cause analysis of the exceptions. The first step in addressing an elevated KCI is to investigate the root cause of the exceptions to determine if they are due to rule misconfigurations, policy violations, or other issues before taking corrective action.

Answer

Temporarily disable the firewall rules causing exceptions

Answer

Implement an automated rule change management process

Answer

Update the KCI threshold to 12%

Question 4

Which TWO of the following are valid techniques for identifying risk in IT risk assessment?

Accepted Answer

SWOT analysis. SWOT analysis (A) is a valid risk-identification technique because it systematically examines Strengths, Weaknesses, Opportunities, and Threats, and the Weaknesses and Threats quadrants directly surface internal and external risks to IT assets and processes. Brainstorming sessions (B) are also a recognized identification technique, as they gather subject-matter experts and stakeholders to openly generate potential risk events, threats, and vulnerabilities before any analysis or prioritization occurs. By contrast, residual risk assessment (C) is not an identification method but an evaluation step performed after controls are applied to determine what risk remains. Risk aggregation (D) is an analysis/reporting activity that combines individual risks into a portfolio or enterprise view, not a way to discover new risks. Monte Carlo simulation (E) is a quantitative risk-analysis technique used to model probability distributions and outcomes, so it belongs to risk evaluation rather than identification.

Answer

Residual risk assessment

Answer

Risk aggregation

Answer

Monte Carlo simulation

Question 5

A large enterprise uses a risk matrix with impact categories (very low, low, medium, high, very high) and likelihood (rare, unlikely, possible, likely, almost certain). A risk identified has a 'likely' likelihood and 'high' impact. According to the matrix, risks with this combination are classified as 'high' risk. The risk appetite statement requires that all high risks have a response plan within 30 days. However, the risk owner argues that due to effective compensating controls, the residual risk is only 'medium'. Which of the following is the BEST course of action?

Accepted Answer

Formalize the risk treatment plan and include the compensating controls in the risk register.. The risk appetite statement mandates that all high risks have a response plan within 30 days. Even if the risk owner argues residual risk is medium due to compensating controls, the initial risk classification is high, so a formal risk treatment plan must be created and the compensating controls documented in the risk register. This ensures compliance with policy and provides a clear record.

Answer

Implement additional controls to ensure the residual risk becomes low.

Answer

Accept the risk as is, since controls reduce it to acceptable level.

Answer

Document the residual risk as medium and extend the response deadline beyond 30 days.

Question 6

A company decides to purchase cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment option?

Accepted Answer

Transfer. Purchasing cyber insurance shifts the financial consequences of a data breach to a third party (the insurer) in exchange for a premium. In risk treatment terminology, this is risk transfer (also called risk sharing). The organization still owns the risk of the breach occurring, but the financial impact is contractually transferred, making 'Transfer' the correct answer.

Answer

Mitigate

Answer

Accept

Answer

Avoid

Question 7

An organization uses a risk appetite statement that limits operational losses to $2 million per quarter. A new risk reporting dashboard shows that current operational losses are $1.8 million with two weeks remaining in the quarter. The head of risk management wants to ensure that losses remain within appetite. Which of the following control monitoring reports would be MOST useful for proactive decision-making?

Accepted Answer

A projected loss report based on current trends and remaining period. A projected loss report based on current trends and remaining period is most useful for proactive decision-making because it uses historical and current data to forecast whether losses will exceed the $2 million appetite by quarter-end. This allows the risk manager to take corrective actions now, rather than waiting for actual losses to materialize. The other options are either backward-looking or lack the predictive element needed for proactive control.

Answer

A report on current loss amounts per business unit

Answer

A summary of historical operational losses by month

Answer

A detailed KRI report showing loss frequency by category

Question 8

Which of the following is a key component of an IT risk management programme that documents identified risks, their likelihood, and impact?

Accepted Answer

Risk register. The risk register is the central repository within an IT risk management programme that formally documents identified risks, their assessed likelihood, and potential impact. It serves as the authoritative record for tracking risk ownership, mitigation status, and residual risk levels, enabling ongoing monitoring and reporting. Without a risk register, an organization cannot systematically manage or communicate its risk posture.

Answer

Risk management policy

Answer

Business continuity plan

Answer

Incident response plan

Question 9

In the FAIR framework, Loss Event Frequency (LEF) is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is the probable frequency of loss events in a given timeframe. It is derived by multiplying Threat Event Frequency (TEF) — how often a threat agent acts — by Vulnerability, which is the probability that a threat event becomes a loss event. This product yields LEF.

Answer

Threat Event Frequency + Vulnerability

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Answer

Loss Magnitude × Vulnerability

Question 10

An organization is implementing a new control to prevent unauthorized access to its critical database. Which type of control is most appropriate for this requirement?

Accepted Answer

Preventive control. A preventive control is the most appropriate because it directly stops unauthorized access before it can occur. For a critical database, this could involve implementing database-level access control lists (ACLs), network firewall rules restricting traffic to specific IP ranges, or mandatory multi-factor authentication (MFA) on the database service. These mechanisms enforce the security policy at the point of entry, blocking the threat actor before any interaction with the data.

Answer

Compensating control

Answer

Corrective control

Answer

Detective control

Question 11

Which of the following is the PRIMARY purpose of integrating IT risk reporting into the enterprise risk management (ERM) program?

Accepted Answer

To provide a holistic view of risk across the organization. Integrating IT risk reporting into the ERM program provides a holistic view of risk across the organization by aligning IT-specific risks with strategic, operational, and compliance risks. This integration ensures that decision-makers can prioritize and respond to risks based on their aggregate impact, rather than treating IT risks in isolation. The primary purpose is to enable a unified risk posture that supports enterprise-wide governance and resource allocation.

Answer

To reduce the frequency of IT risk reporting

Answer

To eliminate the need for IT risk assessments

Answer

To replace IT risk management with ERM

Question 12

A risk scenario is being developed for a phishing attack leading to credential theft. Using ISACA's risk scenario template, which component would describe the 'threat event'?

Accepted Answer

A user clicks a malicious link in a phishing email. In ISACA's risk scenario template, the 'threat event' component describes the specific action or occurrence that triggers risk — here, a user clicking a malicious link in a phishing email. This is the initiating event that, combined with the threat actor and vulnerable asset, produces the risk. The threat event is distinct from the threat actor (who), the vulnerability (what weakness), and the impact (what happens next).

Answer

The organization's email security filter fails to block the phishing email

Answer

The attacker is an organized crime group based overseas

Answer

The compromised credentials are used to access a financial system

Question 13

An IT risk report for the board of directors should primarily focus on:

Accepted Answer

Top risks, trends, and control performance metrics. A board-level IT risk report should communicate the most significant risks, emerging trends, and the effectiveness of controls in mitigating those risks. This enables directors to make informed strategic decisions and fulfill governance responsibilities. Operational details are typically reserved for management-level reporting.

Answer

Specific control failures with root cause analysis

Answer

Detailed technical vulnerability scan results

Answer

Operational incident counts

Question 14

Which THREE of the following are common business impact categories used in risk scenarios?

Accepted Answer

Reputational damage. Reputational damage (A) is a standard business impact category because risk scenarios assess how incidents such as data breaches or outages harm customer trust, brand image, and market standing. Financial loss (B) is universally used in risk scenarios to quantify direct and indirect monetary effects like lost revenue, remediation costs, and reduced shareholder value. Regulatory penalty (D) is also a common business impact category, covering fines, sanctions, and legal enforcement actions imposed by bodies such as GDPR or HIPAA regulators when compliance obligations are breached. Strategic misalignment (C) is not typically treated as a business impact category in risk scenarios; it is more of a governance or planning concern than a measurable consequence of a realized risk. Technical downtime (E) is an operational/technical effect or cause rather than a business impact category, since it is usually translated into business consequences such as financial loss or reputational damage.

Answer

Strategic misalignment

Answer

Technical downtime

Question 15

Which of the following is a primary goal of the 'Protect' function in the NIST Cybersecurity Framework?

Accepted Answer

Develop and implement appropriate safeguards to ensure delivery of critical services. The NIST Cybersecurity Framework's Protect function (PR) is defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. It covers areas like access control, awareness training, data security, and protective technology — all aimed at limiting or containing the impact of a potential cybersecurity event.

Answer

Develop and implement appropriate activities to identify the occurrence of a cybersecurity event

Answer

Develop and implement appropriate activities to take action regarding a detected cybersecurity event

Answer

Develop and implement appropriate activities to maintain plans for resilience