CRISC Practice Test 45 — 15 Questions

Question 1

Which of the following is a limitation of quantitative risk analysis?

Accepted Answer

It is data-intensive and time-consuming.. Quantitative risk analysis assigns numeric, often monetary, values to risk using models such as ALE (SLE × ARO) or Monte Carlo simulation. Its principal drawback is that it requires substantial historical loss data, asset valuations, and modeling effort, making it resource-intensive and slow to perform compared with qualitative approaches like risk matrices. This data dependency and time cost is the recognized limitation tested here.

Answer

Results are not comparable across organizations.

Answer

It is subjective and difficult to communicate.

Answer

It does not provide financially meaningful values.

Question 2

During a control implementation project, the risk manager discovers that the resource requirements have increased significantly, making the original cost-benefit analysis invalid. What should the risk manager do first?

Accepted Answer

Perform a revised cost-benefit analysis. When resource requirements change enough to invalidate the original cost-benefit analysis, the risk manager's first step is to perform a revised cost-benefit analysis to reassess whether the control is still justified relative to the risk it mitigates. This provides the objective data needed before any decision to continue, escalate, or cancel. CRISC emphasizes that risk decisions must be based on current, accurate information rather than assumptions.

Answer

Continue the project and request additional budget later

Answer

Escalate to the board for approval of additional funds

Answer

Cancel the project immediately

Question 3

A manufacturing company is evaluating the risks of connecting its OT network to the IT network. Which THREE risks are MOST significant due to IT/OT convergence?

Accepted Answer

Expansion of attack paths from IT to OT systems. Option A is correct because IT/OT convergence creates bridges between previously isolated environments, allowing attackers who compromise IT systems (e.g., via phishing or unpatched enterprise apps) to pivot laterally into OT networks and reach industrial control systems. Option B is correct because many OT devices such as PLCs, RTUs, and HMIs run legacy operating systems and proprietary protocols (e.g., Modbus, DNP3) with no authentication, encryption, or patch support, making them inherently vulnerable once exposed to IT-side threats. Option D is correct because compromised OT systems can directly manipulate physical processes—causing equipment damage, production outages, or safety incidents that endanger personnel, which is a uniquely severe consequence not present in pure IT breaches. Option C is not a convergence-specific risk; GDPR governs personal data protection and is largely irrelevant to OT process control data. Option E is incorrect because data storage costs are a general IT operational concern, not a significant security or safety risk arising from IT/OT convergence.

Answer

Compliance with GDPR

Answer

Increased data storage costs

Question 4

A global manufacturing company is implementing a new ERP system across multiple regions. The project manager has identified a risk that data migration from legacy systems may cause data corruption, leading to production delays. The risk owner proposes conducting a full data reconciliation after migration. However, the IT director argues that this would be too time-consuming and suggests only sampling data for verification. The risk manager must decide on the risk response. The project timeline is tight, and the company has a low tolerance for data integrity issues. Which of the following is the BEST course of action?

Accepted Answer

Implement the full data reconciliation as proposed by the risk owner. Full data reconciliation is the correct risk response because the company has a low tolerance for data integrity issues and the risk of data corruption could cause production delays. While time-consuming, this approach directly mitigates the identified risk by ensuring all migrated data is verified, aligning with the risk appetite. Sampling would leave a margin of error unacceptable for a low-tolerance environment, and the other options either fail to address the risk or are impractical.

Answer

Accept the risk and proceed with data sampling to save time

Answer

Avoid the risk by postponing the ERP implementation

Answer

Transfer the risk by purchasing insurance for data corruption

Question 5

According to the NIST Cybersecurity Framework, which function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The NIST Cybersecurity Framework's Protect function (PR) covers the safeguards needed to ensure delivery of critical infrastructure services — including access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is the function that directly addresses preventive controls.

Answer

Identify

Answer

Respond

Answer

Detect

Question 6

A company is implementing COBIT 2019 and wants to ensure that risk management activities are aligned with business objectives. Which governance objective is primarily responsible for evaluating, directing, and monitoring risk management?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically responsible for ensuring that enterprise risk is identified, assessed, and managed within the risk appetite, and that risk management activities align with business objectives. It covers evaluating risk, directing risk treatment, and monitoring risk exposure. The other EDM objectives address governance framework, benefits, and resources, not risk optimization.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 7

An organization is implementing an AI/ML model for credit approval decisions subject to regulatory oversight. Which TWO of the following are the most significant risk considerations?

Accepted Answer

Model bias causing discriminatory outcomes. Option A (Model bias causing discriminatory outcomes) is correct because credit approval is a legally regulated decision domain where biased models can produce discriminatory lending practices, violating fair-lending laws such as the Equal Credit Opportunity Act (ECOA) and Fair Housing Act, exposing the organization to enforcement actions and reputational harm. Option B (Model explainability for regulatory compliance) is correct because regulators in credit decisions require the ability to understand and justify adverse action reasons, typically under regulations like the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA), making explainability essential for compliance and auditability. Options C, D, and E, while relevant to AI/ML generally, are not the most significant risk considerations in this specific regulated credit-approval scenario: data privacy (C) matters but is secondary to fairness and explainability in lending regulation, high computational cost (D) is an operational efficiency concern rather than a regulatory risk, and adversarial attacks on training data (E) are a security concern that is less directly tied to the regulatory oversight governing credit decisions.

Answer

Data privacy in AI training

Answer

High computational cost of model retraining

Answer

Adversarial attacks on the training data

Question 8

An organization is designing an IT risk management program. Which of the following should be the PRIMARY consideration when developing a risk register?

Accepted Answer

Capturing risk details, including impact, likelihood, and mitigation status. The primary purpose of a risk register is to serve as the central repository that documents identified risks along with their key attributes—impact, likelihood, mitigation status, ownership, and timelines. Without capturing these core details, the register cannot support risk prioritization, decision-making, or tracking of remediation efforts. Options A, B, and C describe supporting or enhancing elements, but they are secondary to the fundamental requirement of recording essential risk information. Therefore, D is the primary consideration.

Answer

Aligning risk categories with the COSO internal control framework

Answer

Ensuring that the register is integrated with the enterprise risk management system

Answer

Automating the risk register with real-time risk monitoring tools

Question 9

During the solution architecture review, the Architecture Review Board (ARB) identifies a security risk in a proposed cloud migration project. The solution relies on a single cloud region with no disaster recovery plan. Which of the following is the BEST recommendation to mitigate this risk?

Accepted Answer

Deploy the application across multiple cloud regions with automated failover. The identified risk is the lack of disaster recovery for a single-region cloud deployment. The best mitigation is to deploy across multiple cloud regions with automated failover, which directly addresses the availability and resilience gap by ensuring the application survives a regional outage. This is a preventive/architectural control that reduces both likelihood and impact of downtime.

Answer

Purchase cyber insurance to cover financial losses

Answer

Implement encryption at rest and in transit

Answer

Conduct a business impact analysis (BIA)

Question 10

An enterprise is migrating to a public cloud environment. Which THREE of the following are critical cloud-specific risk considerations?

Accepted Answer

Multi-tenancy isolation failures. Multi-tenancy isolation failures (A) are a cloud-specific risk because public cloud providers co-locate workloads from different customers on shared physical hosts, hypervisors, and storage, so a hypervisor escape or misconfigured tenant boundary can expose another tenant's data. Data sovereignty and legal jurisdiction (C) matter because cloud data may be replicated across regions and countries, subjecting it to differing privacy laws, subpoena powers, and residency requirements that the enterprise cannot control contractually alone. Shared responsibility model gaps (D) are critical because the provider secures the cloud (physical, hypervisor, managed services) while the customer secures what they put in it (IAM, encryption, patching of IaaS guests, misconfigured S3 buckets), and unclear ownership of a control creates exploitable blind spots. On-premises network latency (B) is not cloud-specific since it concerns the legacy data center rather than the public cloud migration itself, and legacy system compatibility (E) is a general migration/modernization concern that applies to any platform change, not a risk unique to public cloud.

Answer

On-premises network latency

Answer

Legacy system compatibility

Question 11

Which THREE of the following are typical exclusions in a cyber insurance policy?

Accepted Answer

Losses due to power outages without malicious intent. Option A (losses due to power outages without malicious intent) is a typical exclusion because cyber policies generally cover malicious cyber events, not non-malicious infrastructure or utility failures that cause business interruption. Option B (intentional acts by the insured) is excluded because insurance cannot cover deliberate wrongdoing or fraudulent conduct by the policyholder, as this would violate the principle of indemnity and public policy. Option D (acts of war or terrorism) is a standard exclusion found in most cyber policies, often tied to war exclusions that remove coverage for state-sponsored or warlike attacks. Option C (ransomware payments) is not a standard exclusion — many cyber policies explicitly cover ransomware, including reimbursement of ransom payments, subject to conditions. Option E (social engineering fraud) is also not a typical blanket exclusion; it is frequently offered as a covered extension or sub-limit, though it may require specific endorsement rather than being excluded outright.

Answer

Ransomware payments

Answer

Social engineering fraud

Question 12

A risk manager is integrating risk management with IT governance. Which of the following are key elements of an IT risk management programme design? (Choose TWO.)

Accepted Answer

Risk assessment methodology. Option A (Risk assessment methodology) is correct because an IT risk management programme must define a consistent, repeatable approach for identifying, analyzing, and evaluating risks — including likelihood, impact, and risk criteria — so that risks can be prioritized and treated consistently across the enterprise. Option E (Risk register) is correct because it is the core record that captures identified risks, their owners, ratings, treatment decisions, and status, enabling ongoing monitoring and reporting that links IT risk to governance objectives. The other options do not belong as key design elements of an IT risk management programme: an incident response plan (B) and a business continuity plan (C) are operational response and recovery capabilities that may be informed by risk assessments but are not themselves risk programme design components, and a vendor management policy (D) is a third-party governance control that addresses only one risk domain rather than the overall programme structure.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Vendor management policy

Question 13

An organization recently experienced a significant security incident that was not detected by existing monitoring controls. The risk team is reviewing the effectiveness of the control monitoring framework. Which THREE of the following are key factors that should be evaluated to improve detection capabilities?

Accepted Answer

The correlation rules between different monitoring tools. Correlation rules between different monitoring tools (Option A) are critical because they define how alerts from disparate sources (e.g., SIEM, IDS/IPS, endpoint detection) are combined to identify complex attack patterns. Without well-tuned correlation rules, the organization may miss multi-stage attacks that span multiple systems, as no single tool alone provides the full picture. Evaluating and refining these rules directly improves the detection of incidents that existing controls failed to catch.

Answer

The existence of an incident response plan

Answer

The level of automation in incident response

Question 14

An organization is deploying a large number of Internet of Things (IoT) sensors for environmental monitoring in a remote facility. The sensors have limited processing power and cannot be patched easily. Which risk should the risk manager prioritize?

Accepted Answer

Expanded attack surface with unpatched devices. IoT sensors with limited processing power that cannot be easily patched represent a classic expanded attack surface with unpatched devices. Each unpatched sensor is a potential entry point into the network, and the sheer number of devices multiplies the risk. Because patching is infeasible, compensating controls (network segmentation, monitoring, least privilege) become critical, making this the priority risk for the risk manager.

Answer

Vendor lock-in to proprietary protocols

Answer

Insufficient bandwidth for data transmission

Answer

Data integrity issues from sensor malfunction

Question 15

An organization is developing an IT risk universe. Which of the following is the PRIMARY purpose of creating a comprehensive IT risk universe?

Accepted Answer

To ensure all potential IT risks are considered and documented. The IT risk universe is a comprehensive inventory of all plausible IT-related risks an organization faces, organized by category (e.g., infrastructure, applications, data, third parties, people). Its primary purpose is to ensure completeness — that all potential IT risks are considered and documented — so that subsequent risk assessment, prioritization, and treatment are built on a complete foundation. Without completeness, later steps may overlook material risks.

Answer

To prioritize risks based on their financial impact

Answer

To assign risk owners to each identified risk

Answer

To calculate the aggregated risk exposure for the organization