CRISC Practice Test 43 — 15 Questions

Question 1

An organization uses a risk register that includes inherent risk, control effectiveness, and residual risk. During a quarterly review, the risk owner updates control effectiveness from 'partially effective' to 'effective'. What effect does this have on the residual risk rating?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Residual risk decreases. When control effectiveness is updated from 'partially effective' to 'effective', the control is now better at mitigating the inherent risk. Since residual risk is calculated as inherent risk minus the risk reduction provided by controls, improving control effectiveness directly lowers the residual risk rating. The risk register reflects this by showing a decreased residual risk value, assuming inherent risk remains unchanged.

Answer

Inherent risk changes

Answer

Residual risk increases

Answer

Residual risk remains unchanged

Question 2

A financial services firm is assessing vulnerabilities in its web application. The team wants to identify application-level vulnerabilities that could be exploited. Which TWO vulnerability identification techniques should be prioritized for this purpose?

Accepted Answer

SAST (Static Application Security Testing). SAST (Static Application Security Testing) analyzes source code for vulnerabilities, and DAST (Dynamic Application Security Testing) tests running applications. IAST combines both but is less common. CVE database and CIS Benchmarks are asset- and configuration-focused, not application-specific.

Answer

IAST (Interactive Application Security Testing)

Answer

CVE database review

Answer

CIS Benchmarks comparison

Question 3

A risk assessment that assigns monetary values to assets and calculates expected loss is called:

Accepted Answer

Quantitative. A quantitative risk assessment assigns specific monetary values to assets and calculates expected loss using formulas such as Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF), and Annualized Loss Expectancy (ALE) = SLE × Annualized Rate of Occurrence (ARO). This approach provides objective, numeric risk metrics that support cost-benefit analysis for risk mitigation decisions.

Answer

Qualitative

Answer

Semi-quantitative

Answer

Comprehensive

Question 4

During a risk assessment for a new financial application, the risk manager identifies that the application processes sensitive customer data and is accessible from the internet. Which of the following is the MOST appropriate risk scenario to document?

Accepted Answer

An attacker could exploit weak authentication mechanisms to gain unauthorized access and exfiltrate customer data, resulting in regulatory fines and reputational damage.. The most appropriate risk scenario because it follows the standard risk scenario structure: threat (attacker), vulnerability (weak authentication), impact (unauthorized access, data exfiltration, regulatory fines, reputational damage). It directly ties the technical weakness to a business consequence, which is essential for communicating risk to stakeholders. The scenario is specific to the application's internet-facing nature and sensitive data processing, making it actionable for risk treatment.

Answer

The application has several unpatched vulnerabilities that increase the likelihood of a security incident.

Answer

The application will implement multi-factor authentication to prevent unauthorized access.

Answer

The application must comply with PCI DSS requirements for data protection.

Question 5

A company's internal audit function reports that a detective control (manual review of transactions) is operating effectively based on a sample of 50 transactions showing no issues. However, the continuous monitoring system shows that 100 suspicious transactions were not reviewed during the same period. The control owner argues the control is effective. What is the BEST conclusion?

Accepted Answer

The control is ineffective because the audit sample size is too small to detect the actual failure rate.. The detective control (manual review) is ineffective because the audit sample of 50 transactions is statistically insufficient to detect a failure rate of 100 suspicious transactions out of the total population. The continuous monitoring system provides near-real-time visibility into all transactions, revealing a significant gap that the small sample missed. A control cannot be deemed effective when a larger, more comprehensive monitoring system shows a high volume of unaddressed suspicious activity.

Answer

The control is effective because the monitoring system is too sensitive.

Answer

The control is ineffective because the monitoring system is unreliable.

Answer

The control is effective because the sample showed no issues.

Question 6

A risk manager notices that a key risk indicator (KRI) for failed login attempts has exceeded the threshold for three consecutive weeks. Which of the following should be the FIRST action?

Accepted Answer

Investigate the root cause of the increase.. When a KRI exceeds its threshold for multiple consecutive periods, the first action is to investigate the root cause to determine whether the increase indicates a genuine security issue (e.g., brute-force attack, credential stuffing) or a false positive. Jumping to reporting or threshold adjustment without understanding the underlying cause could lead to misallocation of resources or missed detection of an actual threat. This aligns with the CRISC principle that risk indicators must be validated before escalation or remediation.

Answer

Adjust the threshold to reduce false positives.

Answer

Report the breach to the senior management immediately.

Answer

Ignore the trend as a statistical anomaly.

Question 7

An organization uses a third-party SaaS provider for payroll processing. Which of the following is the BEST technique to identify risks associated with this vendor?

Accepted Answer

Review the vendor's SOC 2 Type II report and conduct an on-site assessment. The SOC 2 Type II report provides an independent auditor's assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time, which is critical for identifying risks in a payroll SaaS processing sensitive employee data. An on-site assessment allows the organization to verify physical and logical controls, observe operations, and discuss specific risk scenarios directly with vendor personnel, offering a deeper risk identification than any single document or review.

Answer

Request a penetration test report from the vendor

Answer

Check online user reviews and ratings

Answer

Read the vendor's marketing materials and case studies

Question 8

Refer to the exhibit. What is the most likely risk indicated by this error log?

Accepted Answer

SQL injection. The error log shows a SQL query with a single quote (') in the input, which is a classic indicator of a SQL injection attempt. The query 'SELECT * FROM users WHERE username = 'admin' OR '1'='1'' is attempting to manipulate the SQL statement to bypass authentication or extract data. This directly corresponds to SQL injection (option B), as the attacker is injecting malicious SQL code through user input.

Answer

Buffer overflow

Answer

Denial of service

Answer

Cross-site scripting

Question 9

During a risk assessment, the risk practitioner discovers that a critical database does not have an active failover solution. The database is used by multiple business applications. Which of the following factors should be given the HIGHEST weight when determining the inherent risk level?

Accepted Answer

The criticality of the database to business operations. The inherent risk level is determined by the potential impact and likelihood of a threat exploiting a vulnerability, without considering controls. The criticality of the database to business operations directly drives the impact severity—if the database fails, multiple business applications could be disrupted, leading to significant operational and financial damage. This makes option A the highest-weighted factor because it defines the worst-case consequence, which is the foundation of inherent risk.

Answer

The number of existing compensating controls

Answer

The frequency of vulnerability scans

Answer

The cost to restore the database from backup

Question 10

A company recently experienced a data breach due to an unpatched vulnerability in a public-facing web application. During the post-incident review, the IT risk manager notes that the vulnerability was identified by the vulnerability scanner six months ago but was not remediated because the patch required a critical database server restart. Which of the following is the BEST risk treatment decision to prevent a recurrence?

Accepted Answer

Implement a compensating control such as a web application firewall.. Implementing a web application firewall (WAF) as a compensating control provides virtual patching, blocking exploitation attempts at the application layer (e.g., SQL injection, path traversal) without requiring a database server restart. This directly addresses the root cause—the unpatched vulnerability—while avoiding the operational disruption that prevented the patch from being applied. A WAF can inspect HTTP/HTTPS traffic and filter malicious payloads based on signatures or behavioral rules, effectively reducing risk to an acceptable level until the next maintenance window.

Answer

Ignore the vulnerability until the next maintenance window.

Answer

Escalate the risk to senior management for acceptance.

Answer

Accept the risk based on the low likelihood of exploitation.

Question 11

A risk practitioner is using the ISACA risk scenario template to document a scenario. The template includes elements such as threat actor, threat type, event, asset/resource, timing, detection, and response. Which element describes the likelihood that the threat event will occur within a specific timeframe?

Accepted Answer

Timing. The 'timing' element in the ISACA scenario template captures when the event might occur and the likelihood within that timeframe, which is a key factor in determining risk probability.

Answer

Threat type

Answer

Response

Answer

Detection

Question 12

A multinational corporation has adopted a risk mitigation strategy for its key suppliers by requiring them to maintain ISO 27001 certification. During an audit, the risk manager discovers that one critical supplier lost its certification six months ago but did not report it, as contractually required. The supplier still has adequate security controls in place, and the relationship is strategically important. The CEO wants to avoid contract termination. What is the MOST appropriate risk response?

Accepted Answer

Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.. It directly addresses the contractual breach with a corrective action plan and progress reviews, allowing the supplier to regain certification while maintaining the strategic relationship. Option B is incorrect because transferring risk to the supplier's cyber liability insurance does not restore the required certification or address the root cause of the breach. Option C is incorrect because accepting the risk disregards the contractual requirement for certification, even if controls are currently adequate. Option D is incorrect because immediate termination may be too disruptive given the strategic importance of the supplier and the existence of a feasible remediation path.

Answer

Transfer the risk to the supplier's cyber liability insurance policy.

Answer

Accept the risk because the supplier still has effective controls, and update the risk register.

Answer

Terminate the contract immediately and find an alternative supplier.

Question 13

A quantitative risk analysis for a data breach yields an Annualized Loss Expectancy (ALE) of $500,000. The Single Loss Expectancy (SLE) is $100,000. What is the Annualized Rate of Occurrence (ARO)?

Accepted Answer

5. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). Given ALE = $500,000 and SLE = $100,000, the ARO is $500,000 / $100,000 = 5. This means the data breach is expected to occur 5 times per year.

Answer

50

Answer

0.2

Answer

500,000

Question 14

Refer to the exhibit. During a risk identification review, the risk manager sees this IDS alert. What risk does this alert MOST directly indicate?

Accepted Answer

An internal SQL server is exposed to the internet and may be probed for vulnerabilities.. The IDS alert indicates an inbound connection attempt to TCP port 1433 (Microsoft SQL Server) from an external IP address. This directly suggests that an internal SQL server is exposed to the internet, which is a security misconfiguration that allows external entities to probe for vulnerabilities, such as weak credentials or unpatched flaws. While data exfiltration or malware could be subsequent outcomes, the alert itself most immediately signals the exposure and probing risk.

Answer

Sensitive data is being exfiltrated from the SQL server.

Answer

A malware infection is spreading across the network.

Answer

The organization is under a distributed denial-of-service (DDoS) attack.

Question 15

During a quarterly control effectiveness test, internal audit discovers that a key automated control failed 15% of the time due to a software bug. The risk owner decides to accept the risk because the cost to fix the bug is high. What should the risk manager do next?

Accepted Answer

Document the risk acceptance and rationale in the risk register. The risk manager's primary responsibility is to formally document the risk acceptance decision, including the rationale provided by the risk owner, in the risk register. This ensures audit trail, transparency, and compliance with governance frameworks such as COBIT or ISO 31000. Since the risk owner has the authority to accept the risk, the risk manager must record it rather than challenge or escalate it without justification.

Answer

Implement a compensating control

Answer

Override the risk owner's decision

Answer

Report the issue to the board immediately