CRISC Practice Test 48 — 15 Questions

Question 1

A healthcare organization operates a legacy electronic health record (EHR) system that is manually monitored for access anomalies by a small IT team. The organization is planning to migrate to a new cloud-based EHR with integrated logging and monitoring. However, due to budget constraints, the migration will take two years. In the interim, the risk manager wants to improve monitoring for unauthorized access to patient data. The current manual process involves weekly log reviews, but recent audits have identified instances of delayed detection (up to two weeks) and missed incidents. The IT team can dedicate only 10 additional hours per week for monitoring. What is the best approach to enhance monitoring during the transition period?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a phased risk-based approach, prioritizing monitoring of high-risk areas such as privileged accounts and sensitive patient data.. A phased approach focusing on high-risk areas (e.g., privileged accounts, sensitive data) optimizes limited resources. Full automation (Option B) is too costly; outsourcing (Option A) may have data privacy issues; accepting the state (Option D) is irresponsible given audit findings.

Answer

Outsource the monitoring to a third-party managed security service provider.

Answer

Implement a full automation suite for access monitoring immediately.

Answer

Accept the current monitoring state as adequate given the upcoming migration.

Question 2

Refer to the exhibit. The SIEM alert triggered, but the security team did not respond because they were investigating another incident. What is the BEST way to prevent such monitoring gaps in the future?

Accepted Answer

Configure automatic escalation to a secondary response team if the alert is not acknowledged within a set time.. It directly addresses the monitoring gap caused by analyst unavailability. By configuring automatic escalation to a secondary response team if an alert is not acknowledged within a set time, the organization ensures that no alert is left unattended even when the primary team is occupied. This is a standard operational resilience control in SIEM workflows, often implemented via playbook automation or SOAR integration.

Answer

Implement a ticketing system to track alert handling.

Answer

Hire additional security analysts to handle peak loads.

Answer

Increase the threshold to reduce false positives.

Question 3

An IT risk report for the board of directors should primarily focus on:

Accepted Answer

Top risks, trends, and control performance metrics. Strategic risk reporting to the board should highlight top risks, trends, and high-level metrics in business terms, avoiding excessive technical detail.

Answer

Specific control failures with root cause analysis

Answer

Detailed technical vulnerability scan results

Answer

Operational incident counts

Question 4

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Accepted Answer

Actor. In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

Answer

Event

Answer

Threat type

Answer

Asset/Resource

Question 5

A risk assessment identifies that a critical application has a vulnerability with a high likelihood of exploitation. The risk owner proposes to implement a web application firewall (WAF) as a mitigating control. Which TWO of the following are likely benefits of this control?

Accepted Answer

Reduces the likelihood of successful exploitation. A WAF reduces the likelihood of successful exploitation by inspecting and filtering HTTP/HTTPS traffic for common attack patterns such as SQL injection and cross-site scripting (XSS). It blocks malicious payloads before they reach the application, directly lowering the probability that a vulnerability will be exploited. This aligns with the risk mitigation strategy of reducing threat exposure.

Answer

Transfers the risk to the vendor

Answer

Eliminates the need for other controls

Answer

Eliminates all residual risk

Question 6

A company is developing risk scenarios for business impact analysis. Which of the following scenario components directly links the risk event to potential financial loss?

Accepted Answer

Consequence. The consequence describes the outcome of the risk event, which includes financial loss. Other components describe the cause or context but not the impact.

Answer

Vulnerability

Answer

Threat actor

Answer

Asset

Question 7

A risk owner is reviewing a control that has a deficiency rate of 15%. The target deficiency rate is less than 5%. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Investigate the root cause of the high deficiency rate. A deficiency rate of 15% against a target of less than 5% indicates a control failure that requires immediate remediation. Investigating the root cause is the first step in the risk response process to identify why the control is failing and to determine the appropriate corrective action, aligning with the Risk Response and Reporting domain's emphasis on addressing control deficiencies before considering acceptance or reporting.

Answer

Increase the target deficiency rate to 15%

Answer

Report the deficiency to the external auditor

Answer

Accept the risk and document the decision

Question 8

A risk practitioner is using a 5×5 heat map to assess IT risks. Which of the following is the primary advantage of this qualitative approach?

Accepted Answer

Requires less data and time to implement. A 5×5 heat map is a qualitative risk assessment tool that uses ordinal scales (e.g., low, medium, high) for likelihood and impact. Its primary advantage is that it requires less data and time to implement compared to quantitative methods, which demand detailed financial data and complex calculations. This makes it practical for rapid, high-level IT risk prioritization when precise data is unavailable.

Answer

Produces financially meaningful loss estimates

Answer

Provides objective and comparable risk scores across organizations

Answer

Eliminates subjectivity in risk ratings

Question 9

Which TWO of the following are examples of continuous monitoring techniques for IT controls? (Select TWO)

Accepted Answer

Continuous SIEM monitoring for security alerts. Continuous monitoring involves automated, ongoing processes. SIEM monitoring for security alerts and automated vulnerability scanning are continuous. Quarterly audits and annual penetration tests are periodic, not continuous.

Answer

Quarterly internal audit reviews

Answer

Annual penetration testing

Answer

Monthly manual log review

Question 10

An organization uses AI/ML for credit scoring decisions. The risk manager is concerned about regulatory compliance if the model cannot explain its decisions. Which AI risk is most directly addressed by requiring explainability?

Accepted Answer

Model bias. Requiring explainability in an AI/ML credit scoring model directly addresses model bias because it forces the model to reveal which input features (e.g., income, zip code) drive its decisions. Without explainability, the organization cannot detect or prove that the model is not discriminating against protected groups, violating regulations like the Equal Credit Opportunity Act (ECOA) or GDPR's right to explanation. Explainability is the primary technical control to audit and mitigate bias in automated decision-making.

Answer

Data privacy in AI training

Answer

Vendor lock-in

Answer

Adversarial attacks

Question 11

An organization uses a third-party vendor for critical data processing. The vendor has experienced two minor security incidents in the past year with no data loss. The risk manager is updating the vendor risk assessment. Which approach best aligns with ISACA's guidance?

Accepted Answer

Initiate a formal reassessment of the vendor's security controls and contractual protections.. ISACA's guidance emphasizes that even minor security incidents without data loss indicate potential control weaknesses that require reassessment. A formal reassessment (A) ensures the vendor's security controls and contractual protections are re-evaluated to address underlying risks, aligning with the principle of continuous risk monitoring and response.

Answer

Increase the frequency of vendor audits to quarterly.

Answer

Request a copy of the vendor's SOC 2 report from last year.

Answer

Accept the risk because the incidents did not result in data loss.

Question 12

An organization's risk register contains a risk with a very high impact but very low likelihood. The risk response strategy should be:

Accepted Answer

Accept. When a risk has very high impact but very low likelihood, the most cost-effective response is often acceptance, because the probability of occurrence is so low that the cost of mitigation, avoidance, or transfer would exceed the expected benefit. Accepting the risk means the organization formally acknowledges it and monitors it, but does not allocate resources to reduce or transfer it. This aligns with the principle of risk appetite and cost-benefit analysis in IT risk management.

Answer

Mitigate

Answer

Avoid

Answer

Transfer

Question 13

Which of the following is a leading Key Risk Indicator (KRI) for the risk of a data breach?

Accepted Answer

Percentage of systems with unpatched critical vulnerabilities. A leading KRI predicts future risk events. The percentage of systems with unpatched critical vulnerabilities directly indicates an increasing attack surface and likelihood of exploitation, making it a leading indicator for a data breach. In contrast, lagging indicators like detection time or breach count measure past incidents.

Answer

Average time to detect a breach

Answer

Number of data breaches in the past quarter

Answer

Number of security incidents closed

Question 14

Refer to the exhibit. Which risk is MOST directly identified?

Accepted Answer

Unauthorized remote access to a critical server. The exhibit (not shown) likely depicts a network diagram or access control list (ACL) configuration that allows inbound traffic from the internet to a critical server on a restricted port (e.g., RDP on TCP 3389 or SSH on TCP 22). This directly identifies the risk of unauthorized remote access, as an attacker could exploit this exposed management interface to gain control of the server. The other options are not directly indicated by such a configuration.

Answer

Denial of service vulnerability

Answer

Malware propagation across subnets

Answer

Weak password policy

Question 15

A financial institution uses a third-party cloud service for data analytics. The service has access to non-public personal information (NPI). During a risk assessment, the risk manager discovers that the cloud provider uses subprocessors without notifying the institution. The contract does not require notification of subprocessor changes. What should the risk manager do FIRST?

Accepted Answer

Notify the vendor of the contract breach and request a list of all subprocessors and their compliance certifications.. The first step is to notify the vendor of the contract breach and request a list of all subprocessors to assess the risk. Option B is wrong because reporting to the data protection authority before attempting to resolve the issue with the vendor is premature. Option C is wrong because accepting risk without understanding the subprocessors' controls is not prudent; the risk manager should first gather information. Option D is wrong because immediately terminating the contract could cause significant business disruption and is not the first step.

Answer

Report the incident to the data protection authority as a breach of contract.

Answer

Accept the risk since the vendor remains SOC 2 Type II certified.

Answer

Terminate the contract immediately to mitigate the risk of unauthorized data access.