CRISC Practice Test 45 — 15 Questions

Question 1

An organization is categorizing IT risks. Which of the following risk categories would include the risk of regulatory fines due to non-compliance with data protection laws?

Accepted Answer

Compliance risk. Compliance risks involve violations of laws, regulations, or contractual obligations. Regulatory fines for data protection non-compliance fall under the compliance category.

Answer

Operational risk

Answer

Financial risk

Answer

Strategic risk

Question 2

A healthcare organization is subject to strict regulatory requirements regarding patient data privacy. The organization has a control that requires all access to patient records to be logged and reviewed weekly by the compliance team. The review is currently performed manually by sampling 10% of the logs. The compliance team reports that the review takes 20 hours per week and they are often unable to complete it on time. As a result, some suspicious access patterns are detected weeks after they occur. The risk manager needs to propose an improvement to the monitoring process. The organization's risk appetite for undetected unauthorized access is very low. Which of the following is the MOST effective recommendation?

Accepted Answer

Deploy user behavior analytics (UBA) tools for automated anomaly detection.. The most effective recommendation because deploying user behavior analytics (UBA) tools automates the detection of anomalous access patterns, enabling real-time or near-real-time monitoring. This reduces manual effort, improves detection speed, and aligns with the organization's low risk appetite for undetected unauthorized access. Option A is wrong because reducing review frequency to bi-weekly would further delay detection, increasing risk. Option B is wrong because hiring additional staff only addresses the workload issue temporarily and does not improve detection timeliness or scalability. Option D is wrong because increasing the sample size to 50% would increase manual effort and still result in delayed detection due to the manual review bottleneck.

Answer

Reduce the review frequency to bi-weekly to free up time.

Answer

Hire additional staff to perform the manual reviews.

Answer

Increase the sample size to 50% of logs for better coverage.

Question 3

A small online retailer with 15 employees sells handmade crafts through its e-commerce website. The company processes payments via a third-party gateway. The owner manually reviews transaction logs once a week for fraud indicators, but recently discovered three chargebacks due to unauthorized transactions. The retailer has limited IT budget and no dedicated security staff. The owner wants to improve detection of fraudulent transactions without significant investment. The current manual process takes about two hours per week and often results in delayed detection. The payment gateway offers basic fraud detection features such as IP geolocation and velocity checks, but these are not enabled. What is the most practical first step?

Accepted Answer

Enable the built-in fraud detection features offered by the payment gateway.. Enabling the built-in fraud detection features offered by the payment gateway is the most practical first step because it is low-cost, quick to implement, and leverages existing capabilities without additional expense. Option B (hiring a part-time analyst) would increase costs and may not be sustainable for a small retailer. Option C (purchasing a third-party system) requires significant investment and implementation time. Option D (accepting the risk) is not acceptable given the recent chargebacks.

Answer

Hire a part-time fraud analyst to review logs daily.

Answer

Purchase an automated fraud detection system from a third-party vendor.

Answer

Accept the current risk and set aside a reserve fund for chargebacks.

Question 4

Based on the exhibit, which of the following risks is MOST indicated by the policy configuration?

Accepted Answer

Exposure of web server to untrusted networks without encryption. The policy configuration shows a rule allowing inbound HTTP/HTTPS traffic from the internet to a web server without any associated encryption requirement (e.g., no TLS enforcement or VPN). This directly exposes the web server to untrusted networks, making it vulnerable to man-in-the-middle attacks and data interception, which is the most significant risk indicated.

Answer

Data exfiltration via MySQL from the internet

Answer

Unauthorized SSH access to the internal network

Answer

Policy misconfiguration causing low hits on rule 3

Question 5

An organization is conducting a risk assessment of its remote access infrastructure. Which THREE of the following are typical components of a risk assessment report? (Select THREE.)

Accepted Answer

Risk register with identified risks and ratings. A risk register is a core component of a risk assessment report because it formally documents each identified risk, its likelihood, impact, and risk rating (e.g., using a 5x5 matrix). This provides a structured, auditable record that supports decision-making and compliance with frameworks like ISO 31000 or NIST SP 800-30.

Answer

Detailed network architecture diagrams

Answer

Logs of all remote access sessions

Question 6

An organization is planning to implement a new security control. The project manager must ensure changes to existing systems are properly managed. Which process is most critical to include in the implementation plan?

Accepted Answer

Change management. Change management ensures that changes to systems are controlled, tested, and approved to prevent unintended disruptions or security gaps. It is essential during control implementation.

Answer

User training

Answer

Vulnerability scanning

Answer

Access review

Question 7

In third-party risk management, which of the following is MOST indicative of a vendor's control effectiveness for a critical vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the most indicative of a vendor's control effectiveness because it provides an independent auditor's opinion on the design and operating effectiveness of controls over a specified period (typically 6–12 months). For a critical vendor, this third-party attestation offers objective evidence that security and privacy controls are actually working, not just promised.

Answer

Contractual security requirements

Answer

Vendor's self-assessment questionnaire

Answer

Vendor's marketing materials

Question 8

Which THREE of the following are effective techniques for identifying IT risks?

Accepted Answer

Brainstorming. Brainstorming is a structured group technique that leverages the collective expertise of stakeholders to identify a wide range of IT risks, including emerging threats and vulnerabilities that may not be captured by automated tools. It is effective because it encourages creative thinking and surfaces risks related to business processes, third-party dependencies, and human factors that are often missed by purely technical assessments.

Answer

Root cause analysis

Answer

Cost-benefit analysis

Question 9

The exhibit shows a warning from a control monitoring system. Based on the log, which of the following is the MOST likely control deficiency?

Accepted Answer

There is no approver assigned for transactions exceeding the limit. The log indicates that a transaction exceeding the 50,000 USD threshold was initiated by user JSmith but no approval was recorded. The control deficiency is the absence of an assigned approver for transactions that exceed the limit, which directly violates the segregation of duties principle. Without a designated approver, the control fails to prevent or detect unauthorized high-value transactions, making this the most likely root cause.

Answer

The threshold of 50000 USD is set too high

Answer

The monitoring system is generating false positives

Answer

The user JSmith should not have authority to initiate such transactions

Question 10

An organization is implementing a data classification scheme. Which of the following classification categories would be MOST effective for identifying risks related to intellectual property theft?

Accepted Answer

Confidential. Confidential data is the classification category specifically designed to protect sensitive information that, if disclosed, could cause significant harm to the organization, including intellectual property theft. In a data classification scheme, 'Confidential' typically applies to trade secrets, source code, and proprietary designs, making it the most effective category for identifying and mitigating risks related to IP theft.

Answer

Restricted

Answer

Internal

Answer

Public

Question 11

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

Accepted Answer

Transfer the risk through cyber insurance. The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

Answer

Avoid the risk by discontinuing the process

Answer

Accept the risk with formal sign-off

Answer

Mitigate the risk by implementing controls

Question 12

A risk assessment team is calculating the Annual Loss Expectancy (ALE) for a critical server. The Single Loss Expectancy (SLE) is $50,000 and the Annual Rate of Occurrence (ARO) is estimated to be 2. The team is considering implementing a new backup solution costing $40,000 per year. Which TWO of the following statements are true regarding the cost-benefit analysis? (Select TWO.)

Accepted Answer

The backup is cost-effective if the ALE reduction exceeds the annual cost.. A cost-benefit analysis for a risk mitigation measure like a backup solution requires that the reduction in ALE (the benefit) exceed the annual cost of the control. Here, the current ALE is $100,000 (SLE $50,000 × ARO 2). If the backup reduces the ALE by more than $40,000 per year, it is cost-effective. Option E is correct because the current ALE without backup is indeed $50,000 × 2 = $100,000.

Answer

The net benefit of the backup is $60,000 per year.

Answer

The ALE after implementing the backup is $100,000 minus the backup cost.

Answer

The payback period for the backup is one year.

Question 13

A financial services company uses a legacy mainframe system for core banking transactions. The risk assessment identifies that the system does not support modern encryption standards, and data is transmitted in clear text over internal networks. The IT department has proposed implementing network segmentation and encryption at the application layer using a middleware solution. However, the cost is high and the project would take 18 months. Meanwhile, the company is planning to migrate to a new core system in two years. The risk appetite for data confidentiality is low. As the risk practitioner, what is the MOST appropriate risk response?

Accepted Answer

Implement compensating controls such as strict network access controls and monitoring.. The correct response is to implement compensating controls such as strict network access controls and monitoring. Given the low risk appetite for data confidentiality, the 18-month delay for the middleware solution is unacceptable, and the two-year migration timeline leaves a significant exposure window. Compensating controls like VLAN segmentation, ACLs, and continuous traffic monitoring can reduce the likelihood of exploitation of the clear-text transmission without requiring changes to the legacy mainframe itself.

Answer

Transfer the risk by purchasing cyber insurance covering data breach incidents.

Answer

Accept the risk because the system will be replaced in two years.

Answer

Avoid the risk by accelerating the migration to the new system within 18 months.

Question 14

Which TWO of the following are primary factors that determine how often a risk assessment should be performed?

Accepted Answer

Rate of change in the IT environment. The rate of change in the IT environment directly impacts the risk landscape; frequent changes (e.g., new applications, infrastructure updates, cloud migrations) introduce new vulnerabilities and alter existing threat vectors, requiring more frequent assessments to ensure controls remain effective. Inherent risk level of critical assets determines priority—higher inherent risk (e.g., systems processing PII or financial transactions) demands more frequent assessments because the potential impact of exploitation is greater, aligning with the ISACA risk assessment scheduling principle.

Answer

Available risk assessment budget

Answer

Number of IT employees

Answer

Number of past security incidents

Question 15

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

Accepted Answer

Acceptance. Acceptance is the most appropriate response because the vulnerability exists in a legacy application that supports a non-critical business process and is used by a small number of users. The cost and operational impact of patching or replacing the application outweigh the risk, making it acceptable to operate with the known vulnerability under formal risk acceptance.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation