CRISC Practice Test 47 — 15 Questions

Question 1

A risk practitioner notices that a key control is tested only once a year, but the associated risk has a high velocity of change. What is the BEST recommendation?

Accepted Answer

Increase testing frequency to quarterly or monthly. A high velocity of change means the risk profile can shift rapidly between annual tests, leaving the organization exposed for months. Increasing testing frequency to quarterly or monthly ensures that control effectiveness is validated in near real-time, aligning monitoring cadence with risk dynamics. This is a core principle of risk-based monitoring: the testing interval must match the speed at which the risk can materialize.

Answer

Remove the control if it cannot be tested more often

Answer

Wait for a control failure before increasing frequency

Answer

Continue annual testing because it meets regulatory requirements

Question 2

Refer to the exhibit. A SIEM correlation rule 'Brute_Force_SSH' has fired excessively due to traffic from internal monitoring servers. What is the BEST course of action?

Accepted Answer

Add an exception in the rule to exclude internal monitoring server IPs.. The excessive alerts are caused by legitimate traffic from internal monitoring servers, not by an actual brute-force attack. Adding an exception to exclude these known IP addresses in the SIEM correlation rule preserves the rule's detection capability for real threats while eliminating the false positives. This is a standard tuning practice for SIEM rules to maintain operational efficiency without disabling security controls.

Answer

Disable the correlation rule to stop false alerts.

Answer

Increase the threshold to reduce false positives.

Answer

Investigate the monitoring servers for compromise.

Question 3

Refer to the exhibit. The control test failed because unauthorized access attempts were detected. The remediation plan suggests additional logging. Is this remediation appropriate?

Accepted Answer

No, the remediation should focus on strengthening access controls.. The control test failure was due to unauthorized access attempts, which indicates a weakness in preventive controls. Adding logging (a detective control) does not address the root cause; the remediation should focus on strengthening access controls (e.g., tightening authentication, authorization, or firewall rules) to prevent unauthorized access in the first place. Logging alone would only record future incidents without reducing their likelihood.

Answer

No, the control test methodology is flawed.

Answer

Yes, because the control is detective in nature.

Answer

Yes, additional logging will help detect future attempts.

Question 4

An organization has received a critical vulnerability alert for a web application firewall. The risk owner is on leave. What should the risk manager do?

Accepted Answer

Escalate to the designated alternate risk owner for decision.. When the risk owner is unavailable, the risk manager must ensure that risk decisions are still made in a timely manner, especially for critical vulnerabilities. Escalating to the designated alternate risk owner is the correct action because it maintains the chain of accountability and enables an informed decision on whether to apply mitigations, such as patching the WAF, without unnecessary delay.

Answer

Apply the patch immediately without consultation.

Answer

Accept the risk since the impact is unknown.

Answer

Wait for the risk owner to return to avoid overstepping authority.

Question 5

A healthcare organization is migrating its electronic health records (EHR) system to a public cloud. The risk manager identifies several risks. Which TWO of the following are the MOST significant risks related to data privacy and regulatory compliance?

Accepted Answer

Data residency and jurisdiction issues.. Data residency and jurisdiction issues (B) are a top risk because healthcare data is subject to strict regulations like HIPAA and GDPR, which may require data to remain within specific geographic boundaries. Migrating EHRs to a public cloud can inadvertently place data in regions with different legal protections, exposing the organization to non-compliance and legal penalties.

Answer

Potential for service downtime affecting patient care.

Answer

Loss of control over the cloud provider's internal access controls.

Answer

Vendor lock-in due to proprietary APIs.

Question 6

A company uses cyber insurance to cover losses from data breaches. This is an example of which risk treatment?

Accepted Answer

Transfer. Transfer shifts risk to a third party, such as an insurance company.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 7

Refer to the exhibit. What is the PRIMARY risk identified from this policy?

Accepted Answer

Unrestricted public read access to confidential data. The policy statement 'All cloud storage buckets must be private by default' directly addresses the risk of public read access to confidential data. If a bucket is misconfigured as public, anyone on the internet can read its objects without authentication, leading to a data breach. This is the primary risk because the policy explicitly targets preventing unauthorized public exposure.

Answer

Inadequate logging

Answer

Lack of encryption for data at rest

Answer

Missing versioning

Question 8

An organization is implementing a new control to address a high-risk finding. The project manager has scheduled a user training session and updated the relevant policies. Which implementation phase is being addressed?

Accepted Answer

Control implementation. These activities (training and documentation updates) are part of the control implementation phase, specifically after the control is designed and before going live.

Answer

Control monitoring

Answer

Risk assessment

Answer

Control design

Question 9

Which of the following is an example of a corrective control?

Accepted Answer

Restoring data from backup after a ransomware attack. Corrective controls are designed to remediate or reverse the effects of an incident after it has occurred. Restoring data from backup after a ransomware attack directly addresses the damage by recovering lost or encrypted data, making it a classic corrective control. In contrast, preventive controls (like firewalls) block incidents before they happen, and detective controls (like IDS alerts or log monitoring) identify incidents after they occur but do not fix the damage.

Answer

Firewall blocking unauthorized traffic

Answer

Intrusion detection system alerting on suspicious activity

Answer

Log monitoring to identify unauthorized access

Question 10

A company has a critical production system with a known vulnerability. Due to the system's age, the vendor no longer supports it. The company decides to implement network segmentation and purchase cyber insurance to cover potential losses. Which TWO risk response options are they applying?

Accepted Answer

Transfer. Network segmentation reduces the attack surface by isolating the vulnerable system, which is a classic risk mitigation technique. Purchasing cyber insurance transfers the financial risk of residual losses to a third party, making 'Transfer' the correct second option. Together, these actions address the risk without removing the vulnerability.

Answer

Accept

Answer

Avoid

Answer

Ignore

Question 11

Which of the following is the primary purpose of a risk and control monitoring program?

Accepted Answer

To provide ongoing assurance that controls are operating effectively.. The primary purpose of a risk and control monitoring program is to provide ongoing assurance that controls are operating effectively. This is achieved through continuous or periodic testing, observation, and analysis of control activities to confirm they are designed correctly and functioning as intended to mitigate risks. Without this ongoing assurance, an organization cannot reliably know whether its risk responses remain effective over time.

Answer

To identify new risks as they emerge.

Answer

To reduce the frequency of internal audits.

Answer

To calculate key risk indicators.

Question 12

A risk manager is identifying risks for an organization that uses a hybrid cloud environment. The organization stores sensitive data on-premises and in the cloud. Which of the following is the MOST effective method for identifying risks related to data residency and compliance?

Accepted Answer

Review data flow diagrams and legal requirements for each jurisdiction. Reviewing data flow diagrams alongside legal requirements for each jurisdiction is the most effective method because it directly maps where sensitive data resides, transits, and is processed across on-premises and cloud environments, enabling precise identification of residency and compliance gaps. This approach aligns with CRISC's emphasis on risk identification through understanding data lineage and regulatory obligations, rather than relying on post-deployment security tests or generic reports.

Answer

Conduct a penetration test of the cloud environment

Answer

Perform a configuration review of cloud security settings

Answer

Review the cloud provider's SOC 2 report

Question 13

A company outsourced its payroll processing to a third-party vendor. During the risk assessment, it was found that the vendor's data centers are in a country with weak data protection laws. What is the BEST way to treat this risk?

Accepted Answer

Require contractual clauses and verify compliance. The best way to treat this risk is to implement contractual controls that require the vendor to adhere to data protection standards equivalent to the company's requirements, and to verify compliance through audits or certifications. This directly addresses the root cause—weak local data protection laws—by imposing enforceable obligations on the vendor, rather than transferring, avoiding, or accepting the risk without mitigation. Contractual clauses with compliance verification are a recognized risk mitigation technique in third-party risk management, as they create a legal framework for data protection regardless of the vendor's jurisdiction.

Answer

Terminate the contract and bring payroll in-house

Answer

Purchase cyber insurance to cover potential losses

Answer

Accept the risk because the vendor has never had a breach

Question 14

A financial institution uses a quantitative risk assessment for a core banking system. The annual loss expectancy (ALE) is calculated as $500,000 with a single loss expectancy (SLE) of $2,500,000. What is the annualized rate of occurrence (ARO)?

Accepted Answer

0.2. The annualized rate of occurrence (ARO) is derived from the formula ALE = SLE × ARO. Given ALE = $500,000 and SLE = $2,500,000, solving for ARO yields $500,000 / $2,500,000 = 0.2. This means the core banking system is expected to experience a loss event once every five years on average.

Answer

5.0

Answer

2.0

Answer

0.5

Question 15

During a qualitative risk assessment, the risk owner rates the likelihood of a threat as 'high' and the impact as 'medium'. According to standard risk matrices, what is the resulting risk level?

Accepted Answer

High. In a standard 3x3 or 5x5 risk matrix, a 'high' likelihood combined with a 'medium' impact typically maps to a 'high' risk level. This is because the risk level is determined by the intersection of likelihood and impact, and the product or matrix cell for these two ratings falls into the high category, indicating a significant risk that requires management attention.

Answer

Low

Answer

Medium

Answer

Critical