CRISC Practice Test 44 — 15 Questions

Question 1

During a risk assessment of a legacy system, the assessor finds that no control is currently in place. The inherent risk level is 'critical'. The residual risk will be:

Accepted Answer

Critical. Residual risk is the level of risk remaining after controls are applied. Since the scenario explicitly states that no control is currently in place, the residual risk remains identical to the inherent risk level, which is 'critical'. Therefore, the residual risk is also critical.

Answer

Medium

Answer

High

Answer

Low

Question 2

A multinational financial services company has implemented a continuous monitoring program for its trading systems. The program uses automated scripts to check system configurations against a baseline every hour. Recently, the company experienced a significant security incident where a malicious actor exploited a misconfigured firewall rule to exfiltrate sensitive customer data. Post-incident analysis revealed that the misconfiguration had been present for 72 hours before detection. The monitoring scripts did not detect the change because the baseline had been updated two weeks prior to include the misconfiguration as part of a planned change that was later reversed without updating the baseline. The company's change management process requires that all configuration changes be approved and documented, but the reversal of the change was not documented. The incident response team was only alerted when a customer reported suspicious activity. The risk practitioner is tasked with recommending improvements to prevent recurrence. Which of the following is the BEST course of action?

Accepted Answer

Implement a change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates.. The root cause is that the baseline was updated to include the misconfiguration, and the subsequent reversal was not documented or reflected in the baseline. A change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates, directly addresses this by ensuring that only approved changes are in the baseline and any unapproved deviation (including reversals) triggers an alert. This prevents the monitoring system from accepting unauthorized changes as normal.

Answer

Enhance incident response procedures to include notification of customers within 24 hours.

Answer

Increase the frequency of monitoring scripts to every 30 minutes.

Answer

Require manual review of all configuration changes by a second analyst.

Question 3

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Accepted Answer

Controls are effective in reducing the risk level. A reduction from 25 to 9 indicates controls are effective in reducing risk. High inherent risk does not automatically mean high residual risk; controls can reduce it significantly.

Answer

Additional controls are unnecessary

Answer

Controls are not effective because residual risk remains

Answer

The inherent risk was overestimated

Question 4

A control owner reports that a control is operating effectively, but the internal audit found a deficiency. What should the risk manager do?

Accepted Answer

Re-test the control independently.. When a control owner asserts effectiveness but internal audit identifies a deficiency, the risk manager must independently re-test the control to resolve the conflict. This ensures objective evidence is gathered, eliminating bias from the control owner's self-assessment. Re-testing validates whether the control is truly operating as designed or if the audit finding is accurate.

Answer

Update the control description.

Answer

Remove the control from monitoring.

Answer

Accept audit's finding.

Question 5

For a risk with very low likelihood and low impact, what is the typical risk response?

Accepted Answer

Accept. When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 6

After a security incident, an organization discovers that a critical database was accessed by an unauthorized user due to weak authentication controls. As part of the IT risk assessment process, which step should have identified this vulnerability?

Accepted Answer

Risk identification. Risk identification is the step in the IT risk assessment process where potential vulnerabilities, such as weak authentication controls, are systematically discovered and documented. In this scenario, the weak authentication that allowed unauthorized database access should have been identified during risk identification, which involves cataloging assets, threats, and existing controls. This step precedes any treatment, monitoring, or evaluation activities.

Answer

Risk treatment

Answer

Risk monitoring

Answer

Risk evaluation

Question 7

When assessing IT risks, which of the following is the PRIMARY purpose of developing risk scenarios?

Accepted Answer

To identify specific threats and vulnerabilities that could impact objectives. The primary purpose of developing risk scenarios in IT risk assessment is to identify specific threats and vulnerabilities that could impact business objectives. Risk scenarios provide a structured narrative that links threat sources, vulnerabilities, and potential impacts, enabling a focused analysis of how adverse events might occur. This is foundational for prioritizing risks and determining appropriate controls, rather than for calculating exact losses, compliance, or continuity planning.

Answer

To calculate the exact financial loss

Answer

To satisfy regulatory compliance

Answer

To create a business continuity plan

Question 8

A company's risk management policy requires a risk register to be maintained. Which of the following is the primary purpose of a risk register?

Accepted Answer

To document and track identified risks, assessments, and risk responses. The primary purpose of a risk register is to serve as a central repository for documenting and tracking all identified risks, their assessments (including likelihood and impact), and the corresponding risk response strategies. This ensures that risk management activities are transparent, auditable, and actionable throughout the risk lifecycle, aligning with the ISACA CRISC framework.

Answer

To assign financial values to all risks

Answer

To record audit findings

Answer

To provide a list of all IT assets

Question 9

When assessing cloud computing risk, which of the following is a key concern related to data sovereignty?

Accepted Answer

Data may be stored in jurisdictions with different privacy laws. Data sovereignty refers to legal requirements that data be stored and processed within certain geographic boundaries. Cloud providers may store data in multiple jurisdictions, leading to compliance risks if data crosses borders without authorization.

Answer

Shared responsibility model misunderstandings

Answer

Multi-tenancy isolation gaps

Answer

Vendor lock-in due to proprietary APIs

Question 10

An organization is migrating on-premises applications to a public cloud. Which THREE of the following should be considered as key risk identification activities?

Accepted Answer

Mapping network security group rules to existing firewall policies.. Mapping network security group (NSG) rules to existing firewall policies is a key risk identification activity because it ensures that security controls are correctly translated to the cloud environment. Misconfigured NSG rules can lead to unintended network exposure, such as open ports or overly permissive access, which directly increases the attack surface. This mapping identifies gaps between on-premises security postures and cloud-native security constructs, a critical step in risk identification during migration.

Answer

Performing a cost-benefit analysis of the migration.

Answer

Calculating the total cost of ownership.

Question 11

During a risk assessment of a web application, the risk owner identifies that the application uses outdated encryption algorithms. What is the most appropriate next step?

Accepted Answer

Document the finding in the risk register and assign a remediation timeline.. The risk owner has identified a specific vulnerability (outdated encryption algorithms) that must be formally recorded in the risk register. The next step is to document the finding and assign a remediation timeline, which aligns with the risk assessment process of treating identified risks. This ensures the issue is tracked, prioritized, and addressed within the organization's risk management framework, rather than being escalated, ignored, or patched without analysis.

Answer

Escalate the issue to senior management for approval to accept the risk.

Answer

Accept the risk without action because encryption is not critical.

Answer

Immediately patch the application to use modern encryption without further analysis.

Question 12

A risk practitioner is updating the risk register and needs to categorize risks. Which TWO of the following are standard risk categories used in IT risk management?

Accepted Answer

Strategic. Strategic and operational are standard risk categories. Financial and reputational are also common, but the question asks for the two that are standard in IT risk management frameworks. Both strategic and operational are universally recognized.

Answer

Budgetary

Answer

Technical

Answer

Environmental

Question 13

A manufacturing company uses Internet of Things (IoT) sensors to monitor equipment temperature and vibration on the production floor. The sensor data is automatically sent to a central system, but there is a manual log maintained by operators that records their visual inspections. Recently, there have been instances where the sensor data indicated abnormal readings, but the operator logs showed normal conditions, leading to delayed maintenance actions and two equipment breakdowns. The risk manager investigates and finds that operators sometimes forget to update logs or misinterpret sensor alerts. The company wants to improve the reliability of the monitoring process. What should be the primary action?

Accepted Answer

Implement automated reconciliation between sensor data and operator logs, flagging discrepancies in real time.. Automated reconciliation between sensor data and operator logs would highlight discrepancies immediately, allowing quick investigation. Reducing reliance on IoT sensors (A) would eliminate the benefits of automated alerts and is a step backward. Replacing all sensors (B) is costly and does not address the human error in log keeping. Training operators (C) may help but alone it does not guarantee consistent compliance and still leaves room for human error.

Answer

Reduce reliance on IoT sensors and increase manual inspections.

Answer

Replace all IoT sensors with newer models that have better accuracy.

Answer

Provide additional training to operators on how to accurately fill in logs and respond to sensor alerts.

Question 14

A risk practitioner is updating the risk register after a third-party security incident. Which of the following is the MOST important information to include in the risk register entry for this third-party risk?

Accepted Answer

A description of the risk event, its impact, and the response taken. The risk register should include a description of the risk event, its impact, and the response. While other details are relevant, the core of the entry is the event and its consequences.

Answer

The remediation plan and the risk owner's signature

Answer

The date of the incident and the amount of data compromised

Answer

The name and contact details of the third party

Question 15

A board member asks for a summary of the top five risks. The risk practitioner has 10 risks with current residual risk levels. Which approach BEST supports board-level reporting?

Accepted Answer

Present the top five by residual risk level, including a trend indicator. Board-level reporting requires concise, actionable insights. Presenting the top five risks by residual risk level, with a trend indicator (e.g., increasing, stable, decreasing), allows the board to quickly understand the most critical exposures and whether risk posture is improving or deteriorating. This aligns with the CRISC focus on risk communication that supports strategic decision-making, not operational detail.

Answer

Only highlight risks that have increased since last quarter

Answer

List risks alphabetically with current control status

Answer

Provide a detailed risk register with all 10 risks and full risk analysis