CRISC Practice Test 48 — 15 Questions

Question 1

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

Accepted Answer

Implement flood barriers and redundant cooling systems. Implementing flood barriers and redundant cooling systems directly reduces the likelihood and impact of a flood event on the data center's physical infrastructure. This is a risk mitigation strategy that proactively addresses the root cause of the risk (flooding) by hardening the facility, which is the most effective treatment for a high-probability, high-impact physical threat.

Answer

Purchase business interruption insurance

Answer

Move all operations to a cloud provider

Answer

Accept the risk and document it in the risk register

Question 2

Which TWO of the following are leading indicators that could be used as KRIs for information security risk? (Select TWO.)

Accepted Answer

Patch lag (average time to apply critical patches). Option C (patch lag, the average time to apply critical patches) is a leading indicator because it measures an exposure window that predicts future compromise likelihood — the longer critical patches remain unapplied, the greater the chance an attacker exploits a known CVE — so it signals risk before incidents occur. Option D (a spike in failed authentication attempts) is a leading indicator because it reflects anomalous activity such as brute-force or credential-stuffing attempts that typically precede a breach, giving early warning of an imminent attack. The unmarked options are lagging or outcome metrics: A (number of security incidents in the past quarter) and B (number of audit findings from the last audit) both report events that have already happened, and E (percentage of employees who completed security awareness training) is a compliance/training completion metric rather than a predictive signal of attack activity.

Answer

Number of security incidents in the past quarter

Answer

Number of audit findings from the last audit

Answer

Percentage of employees who completed security awareness training

Question 3

According to COBIT 2019, which governance objective is primarily concerned with evaluating, directing, and monitoring the management of IT risk?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the governance objective that focuses on evaluating, directing, and monitoring risk management to ensure the enterprise's risk appetite and risk tolerance are understood and articulated.

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 4

An organization calculated the inherent risk for a critical system as 'High' using a 5x5 heat map. After implementing controls, the residual risk is assessed as 'Medium'. What does this indicate about the control effectiveness?

Accepted Answer

Controls are partially effective, reducing risk but not to the target level. The movement from 'High' inherent risk to 'Medium' residual risk indicates that the implemented controls have reduced the risk level by one step on the 5x5 heat map, but have not eliminated it entirely. Since the residual risk is still 'Medium' rather than 'Low' or 'Very Low', the controls are only partially effective—they mitigate some of the risk but do not bring it down to the organization's target risk appetite or tolerance level.

Answer

Controls are fully effective and risk is now acceptable

Answer

Controls are ineffective and need replacement

Answer

Residual risk should equal inherent risk if controls are effective

Question 5

A risk manager decides to accept a risk because the cost of controls exceeds the potential loss. Which of the following is required for this risk treatment option?

Accepted Answer

Formal sign-off by the risk owner. When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

Answer

Elimination of the business process

Answer

Transfer of risk via insurance

Answer

Implementation of compensating controls

Question 6

A company is implementing a new continuous monitoring tool for its network security controls. Which of the following is the MOST important step to ensure the tool provides meaningful risk information?

Accepted Answer

Align the tool's monitoring parameters with key risk indicators and critical controls.. A continuous monitoring tool only delivers meaningful risk information when its monitoring parameters are directly aligned with key risk indicators (KRIs) and critical controls. Without this alignment, the tool may generate noise or miss high-severity events, failing to support risk-based decision-making.

Answer

Configure the tool to generate real-time alerts for all events.

Answer

Provide training to all users on how to interpret the tool's output.

Answer

Ensure the tool is integrated with the existing SIEM system.

Question 7

During a risk assessment, a risk owner is unsure about the likelihood rating for a specific threat. Which of the following is the BEST source of information to determine the likelihood?

Accepted Answer

Historical incident data from industry reports. Historical incident data from industry reports provides empirical evidence of threat frequency and impact across similar environments, making it the most objective and reliable source for determining likelihood. Unlike subjective opinions or unrelated financial data, industry reports aggregate real-world occurrences, enabling a data-driven risk assessment that aligns with the organization's threat landscape.

Answer

Vendor documentation

Answer

The risk owner's personal opinion

Answer

The organization's financial statements

Question 8

In a qualitative risk assessment, a risk owner argues that the likelihood of a cyberattack is low because the organization has strong perimeter defenses. However, the analyst notes that the impact would be catastrophic. Which limitation of qualitative analysis is most relevant?

Accepted Answer

It relies on subjective judgments. Qualitative risk assessment relies on subjective judgments, such as the risk owner's belief that strong perimeter defenses make an attack unlikely, despite the analyst's view that impact would be catastrophic. This subjectivity can lead to inconsistent or biased risk ratings. The scenario highlights how personal opinion can skew likelihood estimates, which is a core limitation of qualitative analysis.

Answer

It is not comparable across organizations

Answer

It is time-consuming and data-intensive

Answer

It does not produce financial values

Question 9

A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.

Answer

Multi-tenancy isolation failures

Answer

Shared responsibility model gaps for patching

Answer

Vendor lock-in due to proprietary APIs

Question 10

Which risk treatment option is being used when an organization decides to stop a business activity that creates a high-risk exposure?

Accepted Answer

Avoid. When an organization stops a business activity that creates high-risk exposure, it is applying the risk avoidance treatment option. This is a deliberate decision to eliminate the risk entirely by discontinuing the associated process, system, or operation, rather than attempting to reduce or transfer the residual risk. In IT risk management, avoidance is often chosen when the cost or impact of mitigation exceeds the benefit of the activity, or when the risk level is intolerable under any control scenario.

Answer

Accept

Answer

Mitigate

Answer

Transfer

Question 11

A risk manager is designing an IT risk management program. According to COBIT 2019, which governance objective is specifically focused on ensuring that risk management is optimized?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's governance objectives are organized under the EDM (Evaluate, Direct, Monitor) domain. EDM03 — Ensure Risk Optimization is the specific governance objective that ensures enterprise risk is identified, assessed, and managed within the entity's risk appetite, and that risk management activities are optimized. It is the governance-level counterpart to the management-level APO12 (Manage Risk) objective.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 12

An organization is evaluating the risk of a data breach using the FAIR framework. Which of the following components is part of Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency. In the FAIR (Factor Analysis of Information Risk) ontology, Loss Event Frequency (LEF) is composed of Threat Event Frequency (TEF) and Vulnerability (the probability that a threat event becomes a loss event). Threat Event Frequency is therefore a direct component of LEF. Annualized Loss Expectancy, Primary Loss, and Secondary Loss belong to the loss magnitude side of the model, not LEF.

Answer

Annualized Loss Expectancy

Answer

Primary Loss

Answer

Secondary Loss

Question 13

A risk practitioner is using the FAIR model to quantify cyber risk for a proposed new online payment system. Which factor must be estimated to calculate the probable financial impact of a data breach?

Accepted Answer

Loss magnitude. In the FAIR (Factor Analysis of Information Risk) model, risk is quantified as the probable frequency and probable magnitude of future loss. To calculate the probable financial impact of a data breach, the practitioner must estimate Loss Magnitude — the monetary value of the loss event, typically broken down into primary loss (response, replacement, fines) and secondary loss (reputation, legal, competitive advantage). Threat event frequency drives the probability side of the equation, not the impact side.

Answer

Threat event frequency

Answer

Vulnerability severity score

Answer

Annualized rate of occurrence

Question 14

A financial institution is adopting a cloud-based analytics platform. The data includes sensitive customer information subject to multiple jurisdictions' data residency laws. Which of the following poses the greatest compliance risk?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. Data sovereignty issues arise when data is stored in jurisdictions with conflicting or unknown legal frameworks, posing significant compliance risk.

Answer

Multi-tenancy isolation vulnerabilities

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Question 15

A company's control monitoring shows that a detective control has been 100% effective for the past year. However, a recent incident revealed that a data breach went undetected for three months. What is the MOST likely cause?

Accepted Answer

The control was not designed to detect the type of breach that occurred.. The detective control was 100% effective based on monitoring data, but it failed to detect a data breach for three months. This indicates the control was not designed to detect the specific type of breach that occurred, such as an exfiltration via an encrypted tunnel or a non-standard protocol. A control can be perfectly effective against known patterns while being blind to novel or out-of-scope attack vectors, which is why option C is correct.

Answer

The control failure occurred but was not recorded.

Answer

The monitoring frequency was insufficient to detect the breach.

Answer

The control monitoring logs were tampered with.