CRISC Practice Test 46 — 15 Questions

Question 1

An organization is implementing a new access control system. Which of the following is the MOST important consideration during the implementation phase?

Accepted Answer

Change management. During the implementation phase of a new access control system, change management is the most critical consideration because it ensures that all changes to the authentication and authorization infrastructure are controlled, tested, and approved before deployment. Without a formal change management process, misconfigurations in protocols like LDAP, RADIUS, or SAML can lead to security gaps or service outages, making it the foundational control for a successful rollout.

Answer

Control ownership assignment

Answer

User training

Answer

Documentation update

Question 2

A bank is considering adopting artificial intelligence for credit scoring. The risk manager identifies that the AI model might produce biased outcomes against certain demographic groups. Which AI/ML risk is most directly associated with this concern?

Accepted Answer

Model bias. Model bias occurs when an AI/ML model produces systematically unfair outcomes against certain demographic groups, often because training data reflects historical discrimination or underrepresentation. In credit scoring, if the model learns from historical lending data that excluded or disadvantaged certain groups, it will replicate and even amplify that bias. This is the risk most directly associated with biased outcomes.

Answer

Adversarial attacks

Answer

Explainability requirements

Answer

Data privacy in AI training

Question 3

During a vulnerability assessment, a risk practitioner identifies that a web application is vulnerable to SQL injection, which is listed in the OWASP Top 10. Which type of vulnerability identification technique MOST likely discovered this issue?

Accepted Answer

DAST (Dynamic Application Security Testing). DAST (Dynamic Application Security Testing) is correct because it tests a running application from the outside by simulating attacks, such as injecting malicious SQL payloads into input fields, which directly reveals SQL injection vulnerabilities. SQL injection is a runtime flaw that manifests when untrusted input is improperly handled by the application and database, so it is most reliably discovered through dynamic testing. SAST, by contrast, analyzes source code statically and may miss or misidentify injection flaws due to complex data flows. Thus, DAST is the technique that most likely discovered this issue during a vulnerability assessment.

Answer

SAST (Static Application Security Testing)

Answer

CIS Benchmarks comparison

Answer

DISA STIG scanning

Question 4

A company is evaluating control types for a new system. The security team proposes implementing an intrusion detection system (IDS) and a backup restoration process. Which TWO control types do these represent, respectively?

Accepted Answer

Detective. An IDS is a detective control (D) because it monitors network or host activity and generates alerts on suspicious or malicious events, but it does not block them, so it identifies rather than prevents incidents. A backup restoration process is a corrective control (E) because it restores systems and data to a known-good state after an incident, directly remediating the impact. Deterrent (A) controls discourage attackers (e.g., warning banners, guards) and do not detect or recover, so they do not fit. Preventive (B) controls such as firewalls, IPS, or access controls stop events before they occur, which an IDS does not do. Compensating (C) controls are alternative measures used when a primary control cannot be implemented, which is not the case for either IDS or backup restoration here.

Answer

Deterrent

Answer

Preventive

Answer

Compensating

Question 5

A company faces a risk of data loss due to untrained staff. They implement mandatory training and quarterly phishing simulations. This is:

Accepted Answer

Risk Mitigation. Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Answer

Risk Avoidance

Answer

Risk Acceptance

Answer

Risk Transfer

Question 6

A company's risk management team is evaluating the effectiveness of its control monitoring program. They find that many controls are tested at the same time each year, leading to a resource bottleneck. Which of the following approaches would BEST address this issue?

Accepted Answer

Stagger testing cycles across the year. Staggering testing cycles across the year distributes the workload evenly, preventing the resource bottleneck caused by testing all controls simultaneously. This approach optimizes resource utilization without increasing headcount or reducing coverage, directly addressing the root cause of the scheduling conflict.

Answer

Increase the testing team size

Answer

Implement continuous monitoring automation

Answer

Reduce the number of controls tested

Question 7

A risk practitioner is calculating the residual risk for a critical asset. Which THREE factors should be considered?

Accepted Answer

Control design adequacy. Residual risk is the risk remaining after controls are applied. To calculate it, you must know the inherent risk level (the risk before controls) and then assess how effectively controls reduce that risk. Control design adequacy and operating effectiveness determine how much the inherent risk is mitigated, directly impacting the residual risk calculation.

Answer

Cost of controls

Answer

Risk appetite

Question 8

A risk assessment team is calculating the Annual Loss Expectancy (ALE) for a critical server. The Single Loss Expectancy (SLE) is $50,000 and the Annual Rate of Occurrence (ARO) is estimated to be 2. The team is considering implementing a new backup solution costing $40,000 per year. Which TWO of the following statements are true regarding the cost-benefit analysis? (Select TWO.)

Accepted Answer

The backup is cost-effective if the ALE reduction exceeds the annual cost.. Option E is correct because ALE is calculated as SLE × ARO, so $50,000 × 2 = $100,000, which is the current annualized loss exposure before any control is applied. Option B is correct because a safeguard is justified when its annual cost is less than the ALE reduction it produces; the backup costs $40,000 per year, so it is cost-effective only if it lowers the ALE by more than that amount. Option A is not correct because the net benefit cannot be stated as $60,000 without knowing the reduced ALE after the backup; $100,000 minus $40,000 is not the net benefit. Option C is not correct because the post-control ALE is the residual SLE × ARO after mitigation, not the original ALE minus the backup cost. Option D is not correct because no payback period can be determined from the given data; it would require the actual loss reduction and possibly the initial versus recurring cost structure.

Answer

The net benefit of the backup is $60,000 per year.

Answer

The ALE after implementing the backup is $100,000 minus the backup cost.

Answer

The payback period for the backup is one year.

Question 9

An organization is designing a risk indicator monitoring program for its key financial risks. Which of the following is the BEST example of a key risk indicator (KRI) for credit risk?

Accepted Answer

Percentage of loans that are in default or non-performing.. A key risk indicator (KRI) for credit risk must directly measure the likelihood or impact of a borrower failing to meet their obligations. The percentage of loans that are in default or non-performing is a direct, quantitative measure of credit risk exposure, as it reflects the actual realization of credit losses. This aligns with the CRISC focus on monitoring risk levels to trigger timely responses.

Answer

Number of employees who completed cybersecurity training.

Answer

Percentage of network uptime over the past month.

Answer

Employee turnover rate in the finance department.

Question 10

A financial institution is considering adopting a new AI/ML model for credit scoring. The model uses customer demographic data and transaction history. Which of the following risks is MOST likely to cause regulatory penalties if not addressed?

Accepted Answer

Model bias leading to unfair lending practices. Model bias leading to unfair lending practices is the most likely risk to cause regulatory penalties because credit scoring is heavily regulated under fair lending laws such as the Equal Credit Opportunity Act (ECOA) and Fair Housing Act. If an AI/ML model uses demographic data and produces disparate impact on protected classes, regulators can impose fines, sanctions, and enforcement actions. Unlike data privacy or model drift, bias directly violates anti-discrimination statutes, making it a legal compliance issue with immediate regulatory consequences.

Answer

Data privacy of training data

Answer

Model drift due to changing economic conditions

Answer

Adversarial attacks on the model

Question 11

A risk manager is using a 5x5 heat map to assess IT risks. Which of the following best describes the primary limitation of this qualitative risk analysis approach?

Accepted Answer

It is subjective and not comparable across organizations.. A 5x5 heat map is a qualitative technique: likelihood and impact are assigned ordinal ratings (e.g., 1–5) based on expert judgment rather than measured data. Because the scales are defined locally and the ratings are subjective, results are not directly comparable across organizations or even across business units with different risk appetites. This subjectivity is the primary limitation.

Answer

It requires extensive historical data to be accurate.

Answer

It is time-consuming and complex to implement.

Answer

It provides objective, financially meaningful results.

Question 12

Which of the following best describes the primary limitation of qualitative risk analysis?

Accepted Answer

It is subjective and not comparable across organizations. Qualitative risk analysis relies on expert judgment, ordinal scales (e.g., high/medium/low), and subjective ratings rather than numerical data. Its primary limitation is that these ratings are subjective and organization-specific, making them difficult to compare across different organizations or even across teams using different scales. This lack of standardization and comparability is the core weakness.

Answer

It requires extensive historical data

Answer

It cannot produce financial loss estimates

Answer

It is time-consuming and complex

Question 13

Which of the following is a detective control for an information system?

Accepted Answer

Intrusion detection system. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for malicious actions or policy violations and generates alerts when such events occur. Unlike preventive controls, an IDS does not block or stop the attack; it detects and reports it after the fact, enabling incident response.

Answer

Data backup

Answer

Encryption

Answer

Firewall

Question 14

A company's IT risk team is conducting a risk identification exercise for a new blockchain-based supply chain solution. Which THREE risks are MOST specific to this technology?

Accepted Answer

51% attack on the underlying consensus mechanism.. Option A is correct because a 51% attack is a blockchain-specific risk in which an entity controlling a majority of consensus power (hashrate in PoW or stake in PoS) can rewrite transaction history or double-spend, directly threatening the integrity of the distributed ledger. Option D is correct because smart contracts execute automatically on-chain, so coding flaws such as reentrancy, integer overflow, or access-control bugs can cause irreversible unintended transactions and fund loss unique to programmable blockchain logic. Option E is correct because blockchain relies on asymmetric cryptography, and loss or compromise of private keys means irreversible loss of asset control, forged signatures, or unauthorized transactions, a risk intrinsic to decentralized key ownership. Option B is not specific to blockchain, since incompatibility with legacy database systems is a generic integration challenge faced by many new enterprise platforms. Option C is not the best fit because high electricity consumption applies mainly to proof-of-work mining and is an environmental/cost concern rather than a core risk unique to all blockchain supply chain solutions, especially permissioned or proof-of-stake networks.

Answer

Incompatibility with legacy database systems.

Answer

High electricity consumption of mining nodes.

Question 15

Which TWO are primary objectives of IT risk identification?

Accepted Answer

Identify threats and vulnerabilities. Risk identification is the process of discovering and documenting the elements that could produce loss, so option C ("Identify threats and vulnerabilities") is correct because threats (e.g., malware, insider misuse, natural events) and vulnerabilities (e.g., unpatched software, weak access controls) are the fundamental inputs that define what risks exist. Option D ("Inventory assets") is also correct because you cannot identify risk without knowing what assets exist and their value; asset inventory (hardware, software, data, people, facilities) establishes the scope and context against which threats and vulnerabilities are assessed. By contrast, option A ("Assign risk owners") belongs to risk response/treatment, where accountability is delegated after risks are documented, not to the identification step itself. Option B ("Determine risk appetite") is a governance decision made by senior management to set acceptable risk thresholds, which frames but does not perform identification. Option E ("Implement controls") is part of risk mitigation/treatment, occurring after risks have been identified, analyzed, and evaluated.

Answer

Assign risk owners

Answer

Determine risk appetite

Answer

Implement controls