CRISC Practice Test 47 — 15 Questions

Question 1

An organization decides to outsource its data center operations to a cloud provider with strict contractual penalties for security breaches. This is an example of which risk treatment option?

Accepted Answer

Transfer. Outsourcing data center operations to a cloud provider with contractual penalties for security breaches shifts the financial impact of a risk event to a third party. This is the definition of risk transfer, where the organization pays another party (via contract, insurance, or outsourcing) to bear the risk. The strict contractual penalties ensure the provider absorbs the cost if a breach occurs, which is the hallmark of transfer.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 2

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Accepted Answer

Escalate to senior management. When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Answer

Update the risk register

Answer

Implement additional controls

Answer

Reduce the risk appetite

Question 3

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

Accepted Answer

Investigate the KRI calculation methodology. The KRI showing green while the underlying control has a high failure rate indicates a misalignment between the KRI and the actual control effectiveness. The first step is to investigate the KRI calculation methodology to determine if the KRI is measuring the wrong metric, using stale data, or has an incorrect threshold. Only after understanding why the KRI is misleading can the risk manager take appropriate corrective action.

Answer

Escalate to the risk committee

Answer

Change the KRI threshold to amber

Answer

Re-test the control

Question 4

Which of the following is a common exclusion in cyber insurance policies that a risk manager should be aware of?

Accepted Answer

Acts of war. Acts of war (and sometimes terrorism, nation-state cyber operations, or hostile acts) are a common exclusion in cyber insurance policies. Insurers exclude them because the potential for catastrophic, correlated losses across many policyholders is uninsurable. A risk manager must be aware of this exclusion because it can leave the organization without coverage for state-sponsored cyberattacks.

Answer

Business interruption

Answer

Ransomware attacks

Answer

Social engineering fraud

Question 5

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

Accepted Answer

$10,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given SLE = $50,000 and ARO = 0.2, the ALE is $50,000 × 0.2 = $10,000. This aligns with the FAIR framework's quantitative risk analysis formula.

Answer

$250,000

Answer

$100,000

Answer

$50,000

Question 6

When prioritizing risk treatment actions, which of the following should be the primary consideration?

Accepted Answer

Risk level and cost-benefit analysis. Risk treatment prioritization should be driven by the level of risk (likelihood and impact) combined with a cost-benefit analysis of the treatment options. This ensures that resources are allocated to the most significant risks where the treatment provides the greatest reduction in risk relative to its cost, aligning with business objectives and risk appetite.

Answer

Ease of implementation

Answer

Compliance requirements only

Answer

Risk owner preference

Question 7

Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?

Accepted Answer

Investigate Wednesday and Thursday spikes as they are above the Green threshold.. In KRI monitoring, values above the Green threshold but below the Red threshold (Amber zone) indicate a potential emerging risk that warrants investigation before escalation. Wednesday and Thursday spikes exceed the Green threshold, so the risk manager should first investigate these anomalies to determine if they are false positives or early signs of a real issue. This aligns with the CRISC principle of proactive risk monitoring and timely response.

Answer

Adjust the KRI threshold to 15 per day to reduce false positives.

Answer

Continue monitoring as all days are within Green or Amber.

Answer

Escalate to the risk committee because the threshold was breached.

Question 8

You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?

Accepted Answer

Implement automated real-time monitoring of critical configuration changes with alerts.. The most effective recommendation is to implement automated real-time monitoring of critical configuration changes with alerts. This directly addresses the root cause: a misconfiguration that went undetected for three days. Real-time monitoring would detect such changes immediately, allowing rapid response and reducing the likelihood of similar incidents. Other options are less effective: CAB approval is a preventive control but doesn't improve monitoring; increasing access reviews frequency is not directly related to configuration changes; additional training is useful but not as immediate and reliable as automated monitoring.

Answer

Require all change requests to be approved by the change advisory board (CAB).

Answer

Increase the frequency of access reviews to monthly.

Answer

Provide additional training to cloud administrators on security policies.

Question 9

Which of the following is an example of a leading indicator?

Accepted Answer

Percentage of employees trained.. A leading indicator is a proactive metric that predicts future risk events or control effectiveness. The percentage of employees trained is a leading indicator because it measures a preventive control (security awareness) that reduces the likelihood of future incidents, such as phishing or data breaches. In contrast, lagging indicators like incident counts or loss amounts reflect past events.

Answer

Number of security incidents.

Answer

Audit findings count.

Answer

Loss amount from fraud.

Question 10

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

Accepted Answer

Deploy an automated monitoring tool that ingests audit logs from the CRM and cloud infrastructure APIs to trigger alerts on anomalies.. It establishes a continuous, automated monitoring feedback loop by ingesting audit logs from both the CRM application (e.g., user activity logs) and cloud infrastructure APIs (e.g., AWS CloudTrail, Azure Monitor). This approach enables real-time anomaly detection and alerting, which is essential for maintaining control effectiveness across the entire stack without manual intervention.

Answer

Implement a generic Security Information and Event Management (SIEM) system with standard rules.

Answer

Rely on the CRM vendor's SOC 2 Type II report for control assurance.

Answer

Schedule quarterly manual reviews of user access logs and system configurations.

Question 11

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Accepted Answer

Implement a unidirectional gateway that enforces one-way data flow. A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

Answer

Deploy a host-based intrusion detection system on each ICS device

Answer

Upgrade the ICS to modern protocols with built-in authentication

Answer

Disconnect the ICS from the corporate network and use manual data transfer

Question 12

Which of the following is the best example of a Key Control Indicator (KCI) for a firewall rule review process?

Accepted Answer

Percentage of firewall rules reviewed within the defined period. A Key Control Indicator (KCI) measures the effectiveness of a control by tracking its operational performance. For a firewall rule review process, the percentage of rules reviewed within the defined period directly indicates whether the control (periodic review) is being executed as intended, ensuring that stale or overly permissive rules are identified and remediated on schedule.

Answer

Number of firewall breaches per quarter

Answer

Number of firewall administrators

Answer

Time since last firewall software update

Question 13

During a review of third-party vendor risks, the risk team identifies that a cloud service provider's data center is located in a country with unstable political conditions. What should the risk practitioner do FIRST?

Accepted Answer

Document the risk and assess its potential impact.. The risk practitioner's first step should be to document the identified risk and assess its potential impact on the organization. This aligns with the CRISC framework's emphasis on risk identification and assessment before any treatment decisions are made. Without a thorough impact assessment, the organization cannot determine whether the risk is acceptable, requires mitigation, or warrants contract termination.

Answer

Accept the risk based on the vendor's SLA.

Answer

Request the vendor to move data to another region.

Answer

Terminate the contract immediately.

Question 14

A power utility must comply with NERC CIP standards. Which of the following is a key requirement under these standards?

Accepted Answer

Identifying and securing Critical Cyber Assets (CCAs). NERC CIP (Critical Infrastructure Protection) standards require utilities to identify and protect Critical Cyber Assets (CCAs) — later evolved into BES Cyber Systems — that support the reliable operation of the Bulk Electric System. Identification, categorization, and implementation of security controls for these assets is a foundational requirement across the CIP standards (CIP-002 through CIP-014).

Answer

Implementing IEC 62443 for all control systems

Answer

Deploying AI for threat detection

Answer

Using only air-gapped networks

Question 15

A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?

Accepted Answer

Scenario analysis with a focus on likelihood and impact. Scenario analysis is most appropriate because the risk of data exfiltration by a malicious insider at the cloud provider is a complex, low-frequency, high-impact threat that is difficult to quantify with historical data. This approach allows the risk manager to systematically evaluate specific attack paths (e.g., an insider with database access copying customer records) by focusing on likelihood and impact, which aligns with the qualitative nature of insider threat assessment in a cloud environment.

Answer

Quantitative risk assessment using ALE and SLE

Answer

Application of the COSO ERM framework

Answer

Control self-assessment (CSA) against ISO 27001