CRISC Practice Test 43 — 15 Questions

Question 1

An organization is implementing a continuous monitoring solution for its network. Which of the following is an example of continuous monitoring?

Accepted Answer

Daily automated vulnerability scanning. Continuous monitoring means ongoing, automated observation of controls and risk indicators at frequent intervals. Daily automated vulnerability scanning fits this definition because it runs repeatedly without manual intervention and provides near-real-time visibility into the control environment. The other options are periodic, point-in-time activities.

Answer

Monthly control testing by internal audit

Answer

Annual penetration testing

Answer

Quarterly access reviews

Question 2

Which of the following is an example of a corrective control?

Accepted Answer

Incident response plan. A corrective control is designed to remediate or restore after an incident has occurred, reducing the impact and returning the environment to normal operation. An incident response plan is the canonical example: it defines the procedures, roles, and steps to contain, eradicate, and recover from a security incident. It acts after the fact, which is the defining characteristic of a corrective control.

Answer

Access control list

Answer

Security awareness training

Answer

Log monitoring

Question 3

An organization has a risk culture where employees are hesitant to report security incidents due to fear of blame. Which of the following initiatives would MOST effectively promote a risk-aware culture?

Accepted Answer

Establish a confidential incident reporting system with a no-blame policy. Establishing a confidential incident reporting system with a no-blame policy directly addresses the root cause — fear of blame — by removing the deterrent to reporting. This creates psychological safety, which is a prerequisite for a healthy risk-aware culture where employees surface issues early.

Answer

Increase the frequency of security awareness training

Answer

Conduct more frequent audits to detect unreported incidents

Answer

Discipline employees who fail to report incidents

Question 4

During IT risk identification, which document serves as the central repository for all identified risks, their characteristics, and current status?

Accepted Answer

Risk register. The risk register is the central repository that documents all identified risks, including their characteristics (e.g., likelihood, impact, risk rating), risk owners, mitigation plans, and current status. It is a key tool in the risk identification and assessment process, as defined in CRISC and ISO 31000.

Answer

Threat model

Answer

Vulnerability database

Answer

Business impact analysis

Question 5

During a risk assessment, the risk practitioner is identifying threats to an application. Which threat modeling technique is specifically designed to analyze application threats using categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. It is specifically designed to analyze application threats using these categories, making it the correct answer.

Answer

VAST

Answer

TRIKE

Answer

PASTA

Question 6

You are the IT risk manager for a financial institution that processes high-value transactions. The organization uses a cloud-based core banking system and on-premises servers for backup. During a recent risk assessment, you identified that the cloud provider's service-level agreement (SLA) guarantees 99.9% uptime, but the organization's business impact analysis (BIA) indicates that every hour of downtime costs $500,000. The current recovery time objective (RTO) for the core banking system is 4 hours, but the actual recovery capability is 6 hours due to manual steps in failover. The risk owner has accepted this risk informally. You are asked to recommend a course of action to the risk committee. Which of the following is the most appropriate recommendation?

Accepted Answer

Document the risk gap (actual recovery of 6 hours vs. RTO of 4 hours) and present it to the risk committee for formal risk acceptance or remediation.. The organization has a critical risk gap: the actual recovery capability (6 hours) exceeds the stated RTO (4 hours), meaning the business would incur $1M in losses (2 hours × $500K) before recovery completes. The risk owner's informal acceptance is insufficient for a financial institution processing high-value transactions; formal documentation and risk committee approval are required for governance and regulatory compliance. Presenting the gap enables informed decision-making on whether to accept the risk formally or invest in remediation (e.g., automating failover to meet the 4-hour RTO).

Answer

Accept the risk because the cloud provider's SLA covers 99.9% uptime.

Answer

Continue with informal acceptance since the risk owner has already accepted it.

Answer

Reduce the RTO to 2 hours to align with industry best practices.

Question 7

A financial institution has a control that manually reviews all wire transfers over $10,000. During an audit, it was found that the review is completed within 24 hours for 95% of transactions, but the target is 99%. The process owner wants to improve the control's effectiveness. Which of the following would be the MOST effective remediation?

Accepted Answer

Automate the review process using an application control.. Automating the review process with an application control directly addresses the root cause of the missed target (human delay or error) by enforcing real-time or near-real-time validation of wire transfers over $10,000. This eliminates the dependency on manual throughput and ensures consistent, timely compliance with the 99% target, as the control can be configured to block or flag transactions until automated checks are completed within the required window.

Answer

Implement a second level of approval for all wire transfers.

Answer

Increase the number of staff performing the reviews.

Answer

Adjust the target to 95% to reflect current performance.

Question 8

A retail company is establishing an IT risk universe. Which of the following should be included as a primary category of IT risk?

Accepted Answer

Third-party risk. Third-party risk is a primary IT risk category because organizations increasingly depend on vendors, cloud providers, and service integrators whose failures, breaches, or non-compliance directly affect the organization's IT risk posture. It belongs in the IT risk universe alongside categories such as cybersecurity, availability, data integrity, and compliance risk. Market, inflation, and interest rate risks are financial/market risks, not IT risk categories.

Answer

Market risk

Answer

Inflation risk

Answer

Interest rate risk

Question 9

Based on the exhibit, what is the MOST likely risk scenario?

Accepted Answer

Brute force attack resulting in account compromise. The exhibit shows a high number of failed authentication attempts from a single IP address over a short time window, followed by a successful login. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations until one succeeds, leading to account compromise.

Answer

Phishing attack that captured user credentials

Answer

Insider threat from a legitimate user

Answer

Denial of service attack on the authentication server

Question 10

Which THREE of the following are indicators of potential IT risk in an organization? (Select exactly THREE.)

Accepted Answer

High employee turnover in IT. High employee turnover in IT is a risk indicator because it can lead to loss of institutional knowledge, inconsistent security practices, and increased likelihood of misconfigurations or unpatched systems. When experienced staff leave, remaining or new employees may lack the context to properly manage firewall rules, access controls, or incident response, creating vulnerabilities.

Answer

Strong password policy

Answer

Regular patching cycles

Question 11

An organization uses the CISA Known Exploited Vulnerabilities (KEV) catalog as a primary source for vulnerability identification. This catalog is BEST described as:

Accepted Answer

A list of known exploited vulnerabilities maintained by the US government. The CISA Known Exploited Vulnerabilities (KEV) catalog is a publicly maintained list published by the US Cybersecurity and Infrastructure Security Agency (CISA) that enumerates vulnerabilities confirmed to be actively exploited in the wild. It is not a scanning tool, commercial feed, or configuration benchmark — it is a curated reference list used to prioritize patching. Organizations use it to drive remediation deadlines, especially under Binding Operational Directive 22-01 for US federal agencies.

Answer

An application vulnerability scanning tool

Answer

A commercial threat intelligence feed

Answer

A configuration vulnerability assessment benchmark

Question 12

During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?

Accepted Answer

Implement a web application firewall (WAF) as a compensating control.. A web application firewall (WAF) is the appropriate compensating control because it can inspect and block SQL injection payloads at the HTTP/HTTPS layer without modifying the application code. This provides immediate risk reduction while the development team works on the permanent fix, aligning with the principle of defense-in-depth and the risk manager's responsibility to treat unacceptable risk during the remediation window.

Answer

Accept the risk due to the low likelihood of exploitation.

Answer

Document the risk and defer action to the next assessment.

Answer

Request an immediate emergency patch deployment.

Question 13

A risk manager is reviewing the risk register and notices that several risks have been identified as 'high' but no risk owner has been assigned. Which of the following is the MOST appropriate action to ensure proper risk identification going forward?

Accepted Answer

Update the risk identification policy to mandate that risk owners be identified during the initial risk identification phase.. The risk identification phase should include assigning risk owners to ensure accountability from the outset. Without a risk owner, identified risks cannot be properly managed, monitored, or escalated. Mandating owner assignment during initial identification embeds ownership into the process, preventing gaps in risk governance.

Answer

Provide training to risk owners on their responsibilities.

Answer

Assign risk owners after the risk assessment is completed.

Answer

Conduct an audit of the risk identification process.

Question 14

Which THREE of the following are key components of an effective risk reporting framework?

Accepted Answer

Consistent risk metrics across the organization.. Consistent risk metrics across the organization (Option B) are a key component of an effective risk reporting framework because they ensure that risk data is comparable and aggregated meaningfully across different business units and systems. Without standardized metrics, reports would be inconsistent, making it impossible to assess overall risk posture or identify trends reliably.

Answer

Automated collection of risk data from all sources.

Answer

Statistical models for predicting future risks.

Question 15

A risk analyst uses a 5x5 heat map to evaluate a set of IT risks. For a particular risk, the likelihood is rated as 4 (likely) and impact as 5 (very high). What is the resulting risk rating?

Accepted Answer

Critical. On a standard 5x5 risk heat map, the risk score is the product of likelihood and impact: 4 × 5 = 20. A score of 20 falls in the highest band of the matrix, which is typically labeled Critical (or Extreme). This reflects that a likely event with very high impact demands immediate executive attention and treatment.

Answer

Low

Answer

Medium

Answer

High