CRISC Practice Test 44 — 15 Questions

Question 1

A risk owner decides to accept a risk because the cost of mitigation exceeds the potential loss, and the risk level is within the organization's risk appetite. What should the risk owner do next?

Accepted Answer

Document the risk and obtain formal sign-off. When a risk owner decides to accept a risk because mitigation costs exceed potential loss and the risk is within appetite, the next step is to document the risk and obtain formal sign-off. This ensures accountability, creates an audit trail, and aligns with governance requirements. Acceptance must be an informed, documented decision.

Answer

Implement detective controls to monitor the risk

Answer

Reassess the risk using quantitative analysis

Answer

Transfer the risk to a third party via insurance

Question 2

A risk practitioner is prioritizing IT risks for treatment. Which factor should be the PRIMARY basis for prioritization?

Accepted Answer

Risk level (inherent or residual). Risk prioritization must be driven by the level of risk itself — whether inherent or residual — because that reflects the likelihood and impact the organization actually faces. CRISC frames risk treatment as a response to evaluated risk, so the magnitude of risk determines what gets addressed first. Ease, cost, and personal preference are inputs to the treatment decision, not the primary basis for ranking risks.

Answer

Ease of implementing controls

Answer

Cost of controls

Answer

Business unit manager's preference

Question 3

Which of the following best describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. An IT risk universe is the comprehensive inventory of all potential IT risks that could affect the organization — it is the master list from which specific risk assessments and scenarios are drawn. It provides the scope for risk management activities and ensures no material risk category is overlooked. It is not limited to assets, incidents, or scenarios.

Answer

A catalog of all IT assets and their vulnerabilities

Answer

A list of all past security incidents

Answer

A set of risk scenarios used for quantitative analysis

Question 4

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

Accepted Answer

ALE = $100,000; expected annual loss. ALE (Annualized Loss Expectancy) is calculated as ARO × SLE. With an ARO of 0.5 (the event is expected to occur once every two years) and an SLE of $200,000, the ALE is 0.5 × $200,000 = $100,000. This figure represents the expected average annual financial loss from this risk, which is the value used to justify the cost of controls.

Answer

ALE = $400,000; maximum possible loss

Answer

ALE = $100,000; single loss expectancy

Answer

ALE = $200,000; annual cost of controls

Question 5

An organization is conducting a vulnerability assessment of its IT assets. Which of the following sources is MOST authoritative for identifying known software vulnerabilities?

Accepted Answer

NVD (National Vulnerability Database). The National Vulnerability Database (NVD), maintained by NIST, is the U.S. government repository that enriches and standardizes CVE data with CVSS scores, CWE classifications, and CPE applicability statements. It is the most authoritative public source for identifying known software vulnerabilities because it aggregates and normalizes vulnerability data from vendors and researchers worldwide. Vulnerability scanners and risk tools routinely sync with NVD feeds to identify known CVEs.

Answer

DISA STIGs

Answer

OWASP Top 10

Answer

CIS Benchmarks

Question 6

A risk assessment team is prioritizing risks for treatment using inherent risk ratings. Which TWO factors should be considered when deciding which risks to treat first?

Accepted Answer

Cost-benefit analysis of potential controls. Option B (Cost-benefit analysis of potential controls) is correct because risk treatment decisions must weigh the cost of implementing a control against the expected reduction in loss exposure; a control is only justified when its benefit (risk reduction) exceeds its cost, ensuring resources are allocated efficiently. Option C (Risk ranking by inherent risk score) is correct because inherent risk ratings—likelihood and impact assessed before controls—establish the priority order; risks with the highest inherent scores represent the greatest potential exposure and should generally be treated first. Option A is not a prioritization factor by itself, since replacement value is only one input into impact and does not account for likelihood or existing controls. Option D is incorrect because a department's budget is an organizational constraint, not a risk-based criterion for prioritization. Option E is incorrect because the number of controls already in place relates to residual risk and control effectiveness, not to ranking inherent risk for treatment priority.

Answer

The asset's replacement value

Answer

The risk owner's department budget

Answer

The number of controls already in place

Question 7

An organization is considering outsourcing its payroll processing to a third party. The risk assessment shows that the inherent risk of payroll errors is high, but the vendor contract includes liability clauses and the organization obtains cyber insurance. This risk treatment is best described as:

Accepted Answer

Risk transfer. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual liability clauses. Here, the vendor contract includes liability clauses and the organization obtains cyber insurance — both mechanisms shift financial consequences away from the organization. This is the defining characteristic of risk transfer, making it the correct answer.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 8

A company is implementing a new access control system. During the project, the IT team updates the system configuration without notifying the risk team. This leads to a temporary misconfiguration that exposes sensitive data. Which process should have been followed to prevent this issue?

Accepted Answer

Change management process. The change management process is the correct answer because it is the formal ITIL/COBIT-aligned control that ensures all configuration changes to production systems are requested, assessed for risk impact, approved by relevant stakeholders (including the risk team), tested, and documented before implementation. In this scenario, the IT team bypassed this process by updating the access control system configuration without notifying the risk team, which is precisely the failure mode change management is designed to prevent. A properly executed change management workflow would have triggered a risk assessment and impact analysis, flagging the sensitive data exposure before the misconfiguration reached production.

Answer

Control design approval

Answer

Continuous monitoring

Answer

Vendor risk assessment

Question 9

Which of the following is an example of a preventive control?

Accepted Answer

Encryption of sensitive data. Encryption of sensitive data is a preventive control because it stops unauthorized parties from reading the data in the first place, even if they gain access to the storage or transmission medium. It acts before an incident causes harm by rendering the data unintelligible without the correct key. This aligns with the CRISC definition of preventive controls, which are designed to deter or stop an event from occurring or reduce its impact before it happens.

Answer

Incident response plan

Answer

Intrusion detection system

Answer

Security logs

Question 10

Which of the following is a key element of promoting a risk-aware culture within an IT department?

Accepted Answer

Establishing an anonymous incident reporting system. An anonymous incident reporting system encourages employees to report risks, errors, and near-misses without fear of retaliation, which is fundamental to building a risk-aware culture where people feel safe to speak up. It directly promotes transparency and proactive risk identification, key elements of a risk-aware culture.

Answer

Outsourcing risk management to a third party

Answer

Conducting annual performance reviews

Answer

Requiring employees to sign non-disclosure agreements

Question 11

After implementing a set of controls, the risk owner calculates the residual risk. Which of the following is true about residual risk?

Accepted Answer

It is the risk that remains after controls are applied. Residual risk is by definition the risk that remains after controls have been applied and risk treatment has occurred. It represents the exposure the organization accepts or must further mitigate after existing safeguards are considered.

Answer

It is not considered in risk treatment decisions

Answer

It is always higher than inherent risk

Answer

It is the risk before any controls are implemented

Question 12

A risk practitioner is designing an IT risk management programme. Which of the following is the BEST sequence of components to establish?

Accepted Answer

Risk management policy, risk assessment methodology, risk register, risk treatment process, risk reporting. The best sequence starts with a risk management policy, which provides the mandate and framework. Then a risk assessment methodology defines how risks are identified and evaluated. Next, a risk register captures the risks. Then a risk treatment process defines how to respond. Finally, risk reporting communicates to stakeholders. This logical order ensures that each component builds on the previous one.

Answer

Risk register, risk assessment methodology, risk treatment process, risk reporting, risk management policy

Answer

Risk assessment methodology, risk register, risk treatment process, risk management policy, risk reporting

Answer

Risk reporting, risk management policy, risk assessment methodology, risk register, risk treatment process

Question 13

A company is implementing a risk identification process for third-party risks. Which THREE factors should be considered when identifying risks from a critical software vendor?

Accepted Answer

Vendor's compliance with relevant regulations. Option B is correct because a critical software vendor's compliance with relevant regulations (e.g., GDPR, HIPAA, PCI DSS, SOX) directly determines legal, contractual, and data-protection exposure, and non-compliance is itself an identifiable third-party risk. Option D is correct because a documented history of security incidents (breaches, ransomware, vulnerabilities, downtime) is a concrete indicator of the likelihood and impact of future third-party risk. Option E is correct because the vendor's financial stability affects continuity of service, ability to remediate vulnerabilities, and the risk of sudden insolvency or acquisition that could disrupt critical software support. Option A does not belong because headcount alone is not a meaningful risk indicator — a small vendor can be highly secure and a large one poorly controlled. Option C does not belong because SLAs are contractual performance terms used to manage or transfer risk after identification, not a factor for identifying the risk itself.

Answer

Number of employees at vendor

Answer

Service level agreements (SLAs)

Question 14

A power utility subject to NERC CIP standards is planning to deploy a new SCADA system. Which of the following requirements is MOST likely mandated by NERC CIP?

Accepted Answer

Establishment of an electronic security perimeter around critical cyber assets. NERC CIP standards require identification and protection of critical cyber assets, including clear boundaries (electronic security perimeters) to control access.

Answer

Adoption of a cloud-based backup solution

Answer

Use of quantum-resistant encryption for all communications

Answer

Implementation of IEC 62443 security levels

Question 15

The risk team is evaluating the cost-effectiveness of a proposed control that will reduce the annualized loss expectancy (ALE) for a cyber attack from $500,000 to $100,000. The annual cost of the control is $150,000. What is the net benefit of implementing this control?

Accepted Answer

$250,000. The net benefit of a control is calculated as the reduction in Annualized Loss Expectancy (ALE) minus the annual cost of the control. The ALE reduction is $500,000 - $100,000 = $400,000. Subtracting the $150,000 annual control cost gives a net benefit of $250,000.

Answer

$400,000

Answer

$150,000

Answer

$350,000