CRISC Practice Test 46 — 15 Questions

Question 1

A financial institution monitors the number of unauthorized access attempts to its core banking system. The risk owner recommends increasing the monitoring frequency from daily to hourly because a recent attack exploited a delayed detection. Which of the following is the PRIMARY benefit of this change?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Faster detection of anomalies. Increasing monitoring frequency from daily to hourly reduces the time between an unauthorized access attempt and its detection. This faster detection enables the security team to respond more quickly to anomalies, minimizing the potential impact of an attack that exploits delayed detection, such as a brute-force or credential-stuffing campaign.

Answer

Lower cost of monitoring

Answer

Increased system performance

Answer

Reduced false positive rate

Question 2

A risk assessment team is evaluating the effectiveness of existing controls for a critical application. Which of the following approaches best determines whether controls are operating as intended?

Accepted Answer

Conducting a walkthrough and testing the controls. Walkthroughs and testing provide direct, empirical evidence that controls are functioning as designed. For a critical application, this approach validates actual control execution (e.g., verifying that an automated access control list (ACL) on a database server actually blocks unauthorized queries), rather than relying on secondhand accounts or static documentation. Testing confirms operational effectiveness in real-time, which is essential for accurate risk assessment.

Answer

Interviewing the control owner

Answer

Reviewing control documentation

Answer

Analyzing historical audit findings

Question 3

A risk owner wants to implement continuous monitoring for a set of critical controls. Which of the following is the PRIMARY benefit of continuous monitoring over periodic testing?

Accepted Answer

Timely detection of control failures.. Continuous monitoring provides timely detection of control failures, which is its primary benefit over periodic testing. This enables faster response to issues, reducing the window of exposure. Option B (Elimination of manual testing) is incorrect because continuous monitoring may reduce but not eliminate manual testing. Option C (Compliance with regulatory requirements) is a benefit but not the primary one. Option D (Reduced cost) is not necessarily true; continuous monitoring can be more expensive to implement initially.

Answer

Elimination of manual testing.

Answer

Compliance with regulatory requirements.

Answer

Reduced cost of control testing.

Question 4

During a control monitoring review, a risk analyst discovers that the control owner has not been performing the required monthly reconciliations. What should the analyst do FIRST?

Accepted Answer

Contact the control owner to understand the reason for non-performance.. The first step in any control monitoring review is to investigate the root cause of a control failure before taking further action. Contacting the control owner allows the risk analyst to determine whether the non-performance was due to a process issue, resource constraint, or a deliberate decision, which informs the appropriate remediation. Jumping to escalation or documentation without understanding the context could lead to incorrect risk treatment or unnecessary disruption.

Answer

Escalate to the risk committee for immediate action.

Answer

Update the risk register to reflect control deficiency.

Answer

Recommend removal of the control as it is not being followed.

Question 5

A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:

Accepted Answer

Risk Mitigation. Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Acceptance

Question 6

What is the most significant risk identified by this configuration?

Accepted Answer

Unauthorized access to sensitive data from the internet. The configuration exposes the S3 bucket to the internet without proper access controls, such as a bucket policy that restricts access to specific IP addresses or requires authentication. This means anyone on the internet can read or write objects in the bucket, leading to unauthorized access to sensitive data. The most significant risk is the direct exposure of confidential information to untrusted external actors.

Answer

Denial of service attack on the S3 bucket

Answer

Loss of encryption keys

Answer

Data exfiltration by internal users

Question 7

A risk practitioner is designing a risk dashboard for the executive team. The organization has a high risk appetite for revenue-generating activities but a low risk appetite for regulatory compliance. Which combination of metrics should be prominently displayed?

Accepted Answer

Key risk indicators (KRIs) for revenue-related risks and regulatory compliance status.. The executive team needs visibility into metrics that directly align with the organization's stated risk appetite: high appetite for revenue-generating activities (monitored via KRIs for revenue-related risks) and low appetite for regulatory compliance (monitored via compliance status). This ensures the dashboard provides actionable, risk-informed insights rather than operational or administrative data.

Answer

Percentage of controls tested and employee training completion rates.

Answer

Vendor risk ratings and number of security incidents.

Answer

Number of open remediation items and budget variance for risk projects.

Question 8

A risk practitioner is connecting a risk scenario to business impact. The scenario involves a ransomware attack that encrypts critical financial systems, resulting in a two-week outage. Which of the following is the MOST appropriate business impact category?

Accepted Answer

Operational disruption. Operational disruption directly affects the organization's ability to conduct business operations, such as system outages. While financial loss may result, the primary impact is operational disruption.

Answer

Regulatory penalty

Answer

Reputational damage

Answer

Financial loss

Question 9

A retail company has a risk monitoring program that tracks key risk indicators (KRIs) for its e-commerce platform. One KRI measures the number of failed payment transactions as a percentage of total transactions. The threshold is set at 2%. Over the past quarter, the KRI has been fluctuating between 1.8% and 2.5%, breaching the threshold several times. Each time the KRI exceeded the threshold, the risk owner performed a manual investigation and found that the failures were due to transient network issues that resolved on their own. The risk owner has now requested that the threshold be raised to 3% to avoid unnecessary investigations. The risk practitioner is evaluating this request. What should the risk practitioner do?

Accepted Answer

Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change.. The recurring network issues causing threshold breaches indicate an underlying problem that needs to be addressed, not just a threshold adjustment. Raising the threshold without understanding the root cause could mask a significant risk to transaction integrity and revenue. A root cause analysis (RCA) would identify whether the transient network issues stem from infrastructure, configuration, or external dependencies, enabling a proper control response.

Answer

Approve the threshold increase since investigations have not found any significant issues.

Answer

Suggest implementing automated remediation for network issues instead of raising the threshold.

Answer

Reject the request and require investigation of every breach.

Question 10

An IT risk report to the board of directors should primarily focus on which of the following?

Accepted Answer

Strategic risks and risk trends affecting the organization. The board of directors requires a high-level view of IT risk that aligns with business strategy and enterprise risk management. Strategic risks and risk trends provide the necessary context for informed decision-making, focusing on the aggregate impact of risk on organizational objectives rather than operational minutiae.

Answer

Specific control test results for each system

Answer

Vendor risk assessment scores for all third parties

Answer

Detailed weekly operational incidents

Question 11

Which TWO of the following are best practices for risk reporting to senior management?

Accepted Answer

Provide actionable recommendations based on risk trends. Risk reporting to senior management should be actionable, focusing on trends and recommendations that enable informed decision-making. Senior leaders need concise, strategic insights rather than raw data, so providing recommendations based on risk trends aligns with the principle of risk-based decision support.

Answer

Avoid discussing risk appetite to prevent confusion

Answer

Present detailed technical analysis for every risk

Answer

Include all available risk data for transparency

Question 12

Which TWO of the following are essential components of an effective control monitoring program?

Accepted Answer

A defined baseline for normal system behavior.. A defined baseline for normal system behavior is essential because it provides the reference point against which monitoring tools can detect anomalies, deviations, or potential control failures. Without a baseline, it is impossible to distinguish routine activity from suspicious or unauthorized changes, rendering monitoring alerts meaningless. This baseline is typically established through statistical modeling, threshold tuning, or historical analysis of logs and metrics.

Answer

A comprehensive list of all controls in the organization.

Answer

A manual checklist for each control reviewed daily.

Answer

Real-time alerting for all control failures.

Question 13

A large financial institution has implemented a risk monitoring framework that includes KRIs for operational risk. Recently, a critical KRI related to trade settlement errors has been showing an upward trend, but it remains within the approved threshold. The risk manager is concerned because the trend indicates potential control degradation. The control owner argues that since the KRI is still within threshold, no action is needed. The risk manager wants to determine the best course of action to address the trend before it breaches the threshold. The organization's risk policy requires proactive monitoring. What should the risk manager do?

Accepted Answer

Conduct a detailed analysis to understand the root cause and consider adjusting the threshold or implementing control enhancements.. Proactive monitoring requires understanding the root cause of the trend before taking action. Option A is correct because it involves conducting a detailed analysis first, then considering threshold adjustments or control enhancements based on findings. This aligns with the organization's risk policy. Option B implements controls without understanding the cause, which may be premature. Option C reports to the audit committee without analysis, which is not the first step. Option D updates the threshold without addressing the underlying issue, masking the problem.

Answer

Implement additional controls immediately.

Answer

Report the trend to the audit committee.

Answer

Update the threshold to reflect the new normal.

Question 14

During a risk assessment, a risk manager is evaluating the effectiveness of a firewall rule set. The manager notes that the firewall logs show a high number of dropped packets from a specific IP range, but no policy changes have been made. The manager suspects the firewall rule set may be misconfigured. Which of the following should the manager do FIRST?

Accepted Answer

Review the change management records for the firewall.. The first step when a misconfiguration is suspected without any known policy changes is to verify the change management records. This ensures that any recent modifications to the firewall rule set are accounted for, ruling out unauthorized or undocumented changes before proceeding with more invasive actions like penetration testing or blocking IP ranges.

Answer

Conduct a penetration test on the firewall.

Answer

Immediately block the IP range.

Answer

Update the risk register with a new risk.

Question 15

An organization is adopting machine learning for credit scoring decisions. Which of the following risks is MOST critical from a regulatory compliance perspective?

Accepted Answer

Lack of model explainability for automated decisions. Regulatory frameworks like GDPR and the EU AI Act emphasize the right to explanation for automated decisions. Without model explainability, the organization cannot demonstrate compliance with transparency requirements, making it the most critical risk from a regulatory compliance perspective.

Answer

Model bias leading to unfair outcomes

Answer

Data privacy during model training

Answer

Adversarial attacks on the model