CRISC Practice Test 49 — 15 Questions

Question 1

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tune the system to reduce false positives. B is correct because tuning the system involves adjusting detection thresholds, rules, or machine learning models to reduce false positives while maintaining sensitivity to actual fraud. This directly addresses the root cause—poorly calibrated detection logic—without sacrificing the system's primary function or incurring unsustainable costs.

Answer

Accept the false positives as a cost of doing business

Answer

Remove the monitoring system to focus on other controls

Answer

Hire additional analysts to review all alerts

Question 2

An organization has implemented a new key risk indicator (KRI) for vendor management that measures the percentage of vendors without a signed contract. The current value is 15%, exceeding the risk appetite threshold of 10%. The risk owner wants to know the most appropriate action to take based on this KRI. What should the risk practitioner recommend?

Accepted Answer

Analyze the root cause of the high percentage and develop a remediation plan.. When a KRI exceeds the risk appetite threshold, the immediate priority is to understand why the breach occurred and to implement corrective actions. Analyzing the root cause and developing a remediation plan directly addresses the underlying issue—vendors without signed contracts—rather than merely monitoring or adjusting thresholds. This aligns with the CRISC principle that KRIs are leading indicators that should trigger risk response, not just reporting changes.

Answer

Increase the frequency of KRI reporting from monthly to weekly to monitor the trend.

Answer

Update the risk appetite threshold to 15% to align with the current value.

Answer

Immediately communicate the KRI breach to the board of directors.

Question 3

In the FAIR framework, which of the following correctly represents the calculation of Loss Event Frequency (LEF)?

Accepted Answer

LEF = Threat Event Frequency × Vulnerability. In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is calculated as the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This reflects that the frequency of loss events depends on how often a threat event occurs and the probability that the threat event will result in a loss, which is the vulnerability component. The multiplication captures the dependency: even if threats are frequent, low vulnerability reduces LEF, and vice versa.

Answer

LEF = Threat Event Frequency + Vulnerability

Answer

LEF = Asset Value × Vulnerability

Answer

LEF = Annualized Rate of Occurrence × Single Loss Expectancy

Question 4

A risk officer is evaluating the effectiveness of a control that prevents unauthorized changes to configuration files. The control has not detected any unauthorized changes in the past year. What does this indicate?

Accepted Answer

Further testing is needed to determine control effectiveness.. The absence of detected unauthorized changes does not automatically confirm control effectiveness; it could also indicate that the control is not properly configured to detect changes (e.g., missing file integrity monitoring rules, incorrect baseline, or disabled logging). Further testing—such as manually introducing a test change or reviewing audit logs—is required to verify that the control can actually detect violations. This aligns with CRISC best practices for validating control effectiveness through testing rather than relying solely on absence of alerts.

Answer

The control is unnecessary because no changes occurred.

Answer

The control is not configured correctly to detect changes.

Answer

The control is operating effectively and no violations occurred.

Question 5

A risk practitioner is analyzing the results of a phishing simulation. The simulation had a 15% click rate on a test email targeting finance department staff. Which of the following conclusions is MOST valid regarding IT risk identification?

Accepted Answer

There is an increased risk of successful targeted phishing attacks against finance staff. A 15% click rate on a targeted phishing simulation indicates that a significant portion of finance staff are susceptible to social engineering, which directly increases the risk of a successful targeted phishing attack. This finding is a key input for IT risk identification because it reveals a control weakness (user awareness) that could be exploited by attackers to gain unauthorized access or initiate fraudulent transactions. The click rate itself is a risk indicator, not a definitive measure of control effectiveness like email filtering.

Answer

The email filtering system is ineffective

Answer

This is an effective red team exercise

Answer

The organization has a low risk of credential theft

Question 6

A company is updating its risk register. Which of the following is the primary purpose of a risk register?

Accepted Answer

To record and track identified risks and their treatment. A risk register's primary purpose is to serve as the central repository that records identified risks, their owners, likelihood/impact ratings, and treatment decisions (mitigate, transfer, accept, avoid), enabling ongoing tracking and reporting. It is a living document used by risk managers to monitor status over time. Defining risk appetite is a governance activity that precedes and informs the register, not its purpose.

Answer

To define risk appetite

Answer

To store threat intelligence feeds

Answer

To document all IT assets

Question 7

Which risk treatment option involves purchasing cyber insurance?

Accepted Answer

Transfer. Cyber insurance is a form of risk transfer, where the financial impact of a loss is shifted to the insurer.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 8

After a risk assessment, the risk owner decides to mitigate a high-risk finding by implementing additional access controls. What should the risk manager do NEXT?

Accepted Answer

Reassess the residual risk level after controls are implemented.. After mitigation controls are implemented, the risk manager must reassess the residual risk level to determine whether the controls have effectively reduced the risk to an acceptable level. This step ensures that the risk treatment decision is validated and that any remaining exposure is understood before updating the risk register or closing the issue.

Answer

Update the risk register with the mitigation actions taken.

Answer

Accept the residual risk on behalf of the organization.

Answer

Close the risk issue and move to the next priority.

Question 9

An organization wants to promote a risk-aware culture. Which TWO of the following initiatives are most effective for achieving this?

Accepted Answer

Conducting regular security awareness training for all employees. Option A is correct because regular security awareness training for all employees builds the knowledge and vigilance needed for staff to recognize and respond to risks, which is the foundation of a risk-aware culture. Option B is correct because a 'tone from the top' that emphasizes risk management signals leadership commitment, sets expectations, and drives risk-conscious behavior throughout the organization. Option C, while valuable for encouraging reporting, addresses incident handling rather than directly cultivating organization-wide risk awareness. Option D can motivate specific behavior but risks incentivizing quantity over quality and does not by itself build a sustainable culture. Option E, increasing the IT risk team budget, strengthens resources but does not directly engage employees or shape organizational attitudes toward risk.

Answer

Implementing a blame-free incident reporting system

Answer

Offering financial incentives for risk identification

Answer

Increasing the IT risk team budget

Question 10

A retail company is identifying risks in its supply chain. Which approach is most effective for identifying previously unknown risks?

Accepted Answer

Scenario analysis with supply chain partners. Scenario analysis with supply chain partners is most effective for identifying previously unknown risks because it leverages collaborative brainstorming and 'what-if' thinking to uncover emergent threats that are not captured by historical data or static checklists. This approach is particularly valuable in supply chain contexts where interdependencies, third-party vulnerabilities, and novel disruptions (e.g., a new cyberattack vector targeting a logistics provider) can surface only through joint exploration of hypothetical events. It aligns with the CRISC emphasis on proactive risk identification beyond known patterns.

Answer

Employee surveys

Answer

Financial audit reports

Answer

Review of standard risk checklists

Question 11

The exhibit shows a log entry from a GRC system. Which of the following is the MOST significant concern regarding this risk score update?

Accepted Answer

The control effectiveness status was not updated alongside the risk score. The risk score update without a corresponding update to the control effectiveness status creates a data integrity issue in the GRC system. Since the residual risk score is calculated as inherent risk multiplied by (1 - control effectiveness), changing the score without adjusting the effectiveness metric means the system's risk calculation is now inconsistent and unreliable for monitoring and reporting purposes.

Answer

The inherent risk score decreased without any change in the business environment

Answer

The comment does not provide sufficient detail on the mitigation project

Answer

The risk owner was not notified of the change

Question 12

An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?

Accepted Answer

Implementing continuous security monitoring of network traffic. The NIST Cybersecurity Framework's Detect function (DE) covers activities that identify the occurrence of a cybersecurity event, including continuous security monitoring (DE.CM), anomaly and event detection (DE.AE), and detection processes (DE.DP). Implementing continuous security monitoring of network traffic maps directly to DE.CM-1 (network monitoring) and is the clearest example of a Detect activity. It is about discovering events, not responding to or preventing them.

Answer

Developing an incident response plan

Answer

Conducting a business impact analysis

Answer

Establishing a patch management process

Question 13

Based on the exhibit, what control monitoring deficiency is evident in the DLP policy?

Accepted Answer

The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).. The DLP policy shown in the exhibit only includes rules for monitoring and blocking credit card data exfiltration via webmail (Gmail, Yahoo Mail) and FTP. It completely omits any rule for cloud storage applications such as Dropbox or OneDrive, which are common vectors for data exfiltration. This is a control monitoring deficiency because the policy fails to cover a significant risk surface, leaving the organization blind to unauthorized transfers of sensitive data through these channels.

Answer

Alerts are not sent to the appropriate team.

Answer

Log retention is insufficient for forensic analysis.

Answer

The rules are too broadly defined and may cause false positives.

Question 14

Which of the following is an example of a detective control in IT risk management?

Accepted Answer

Intrusion Detection System (IDS). Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Answer

Firewall

Answer

Data encryption

Answer

Backup restoration

Question 15

During a risk assessment of a web application, the risk owner identifies that the application uses outdated encryption algorithms. What is the most appropriate next step?

Accepted Answer

Document the finding in the risk register and assign a remediation timeline.. The risk owner has identified a specific vulnerability (outdated encryption algorithms) that must be formally recorded in the risk register. The next step is to document the finding and assign a remediation timeline, which aligns with the risk assessment process of treating identified risks. This ensures the issue is tracked, prioritized, and addressed within the organization's risk management framework, rather than being escalated, ignored, or patched without analysis.

Answer

Escalate the issue to senior management for approval to accept the risk.

Answer

Accept the risk without action because encryption is not critical.

Answer

Immediately patch the application to use modern encryption without further analysis.