CRISC Practice Test 49 — 15 Questions

Question 1

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability severity. In FAIR, Loss Event Frequency (LEF) is directly influenced by the probability that a threat actor will successfully exploit a vulnerability. Vulnerability severity (how easily a vulnerability can be exploited) is a key component of the 'Vulnerability' factor in FAIR's decomposition, which feeds into LEF. Even with high threat capability and severe impact, if vulnerability is low (strong patching), LEF remains low because the attack is unlikely to succeed.

Answer

Threat actor capability and motivation

Answer

Control effectiveness

Answer

Business impact severity

Question 2

Which TWO of the following are key elements that should be included in an IT risk assessment report?

Accepted Answer

A list of identified risks and their ratings. The IT risk assessment report must document all identified risks along with their inherent and residual risk ratings (typically using a qualitative or quantitative scale such as 1-5 for likelihood and impact). This provides a clear, prioritized view of the risk landscape, enabling stakeholders to understand which risks require immediate attention. Without this list and ratings, the report lacks the foundational data needed for decision-making.

Answer

Copies of vendor contracts

Answer

Network topology diagrams

Answer

Detailed financial budgets of the IT department

Question 3

During a risk assessment, an organization identifies that its remote workforce uses personal devices for work. The risk manager is concerned about data leakage. The organization has a risk appetite that is 'moderate' and wants to treat the risk. Which of the following is the MOST effective risk treatment option?

Accepted Answer

Implement a Mobile Device Management (MDM) policy with containerization. The most effective because MDM with containerization creates a separate, encrypted work profile on the personal device, isolating corporate data from personal apps and data. This directly addresses data leakage by enforcing security policies (e.g., remote wipe of the work container only) without requiring full control over the entire device, aligning with a 'moderate' risk appetite that seeks a balance between security and usability.

Answer

Implement a VPN for remote access

Answer

Require full disk encryption on all personal devices

Answer

Ban the use of personal devices for work

Question 4

During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?

Accepted Answer

Obtain a third-party audit report (e.g., SOC 2 Type II).. A SOC 2 Type II report provides an independent, third-party assessment of a cloud provider's controls over a period of time, directly addressing the lack of visibility by offering verifiable evidence of control effectiveness. This is the standard approach for gaining assurance over a provider's security posture without relying on internal access or self-reporting.

Answer

Request the provider to self-attest their controls.

Answer

Accept the risk based on the provider's reputation.

Answer

Conduct a penetration test on the provider's infrastructure.

Question 5

A financial institution is integrating a new cloud-based analytics platform that will process sensitive customer data. The project team is conducting risk identification. Which technique would be MOST effective for identifying risks related to the integration of this platform with existing on-premises systems?

Accepted Answer

Threat modeling of the integration architecture.. Threat modeling of the integration architecture is the most effective technique because it systematically identifies potential security threats, attack vectors, and vulnerabilities specific to the data flows, trust boundaries, and API interactions between the cloud-based analytics platform and existing on-premises systems. Unlike generic methods, threat modeling (e.g., STRIDE or PASTA) focuses on the unique integration points, such as authentication handshakes, data-in-transit encryption (TLS 1.2/1.3), and session management, which are critical for protecting sensitive customer data during integration.

Answer

Vulnerability scanning of the cloud platform's API endpoints.

Answer

Brainstorming sessions with the project team.

Answer

SWOT analysis to assess strengths, weaknesses, opportunities, and threats.

Question 6

An organization uses threat intelligence feeds from an Information Sharing and Analysis Center (ISAC). What is the PRIMARY benefit of using ISACs?

Accepted Answer

They facilitate sharing of sector-specific threat intelligence. ISACs provide sector-specific threat intelligence and enable trusted information sharing among members, often with real-time alerts on relevant threats.

Answer

They provide free antivirus software to members

Answer

They offer legally binding threat response protocols

Answer

They replace the need for internal threat hunting

Question 7

A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?

Accepted Answer

Risk mitigation. Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 8

During a control self-assessment, an operational manager reports that a manual review control is performed quarterly instead of monthly as documented. What should the risk practitioner do?

Accepted Answer

Update the control frequency in the risk register and assess residual risk. The risk practitioner must update the control frequency in the risk register to reflect the actual operating reality (quarterly instead of monthly) and then reassess the residual risk. This ensures the risk register remains accurate and the risk exposure is properly evaluated based on the current control effectiveness. Simply accepting the change without documentation (A) or forcing immediate resumption (D) ignores the need for risk reassessment, while escalating for disciplinary action (B) is premature and not the primary risk management action.

Answer

Accept the change without documentation since risk level is unchanged

Answer

Escalate the deviation to senior management for disciplinary action

Answer

Require the manager to resume monthly reviews immediately

Question 9

A company is assessing the impact of a potential ransomware attack. Which TWO impact categories are considered operational impacts?

Accepted Answer

System downtime. Operational impacts include system downtime and productivity loss. Financial impacts like fines and reputation are separate categories.

Answer

Share price impact

Answer

Regulatory fines

Answer

Customer trust loss

Question 10

A company uses a dashboard to monitor KRIs. One KRI shows a warning level, but the data is two months old. What is the primary concern?

Accepted Answer

The monitoring is not timely.. The primary concern with a KRI showing a warning level based on data that is two months old is that the monitoring is not timely. Timeliness is a critical attribute of effective Key Risk Indicators (KRIs) because risk conditions can change rapidly; stale data renders the warning obsolete and may lead to incorrect risk decisions. Without current data, the organization cannot respond to emerging threats or control failures in a relevant timeframe, undermining the entire monitoring process.

Answer

The KRI is not relevant.

Answer

The dashboard is not user-friendly.

Answer

The threshold is too low.

Question 11

Which THREE of the following are indicators of potential IT risk in an organization? (Select exactly THREE.)

Accepted Answer

High employee turnover in IT. High employee turnover in IT is a risk indicator because it can lead to loss of institutional knowledge, inconsistent security practices, and increased likelihood of misconfigurations or unpatched systems. When experienced staff leave, remaining or new employees may lack the context to properly manage firewall rules, access controls, or incident response, creating vulnerabilities.

Answer

Strong password policy

Answer

Regular patching cycles

Question 12

Refer to the exhibit. What risk is introduced by this IAM policy?

Accepted Answer

Excessive permissions. The IAM policy grants `s3:*` actions on all S3 resources (`"Resource": "*"`), which allows any user or service assuming this role to perform any S3 operation, including deleting buckets, modifying permissions, or accessing all objects. This violates the principle of least privilege and introduces the risk of excessive permissions, as the policy does not restrict actions or resources to only what is necessary for the intended function.

Answer

Misconfigured encryption

Answer

Lack of logging

Answer

Weak authentication

Question 13

A bank's fraud detection system generates an alert for a transaction, but subsequent investigation finds it false. What should be done?

Accepted Answer

Document the false positive for trend analysis.. Documenting false positives enables trend analysis to identify patterns in detection logic errors, such as rule misconfigurations or data quality issues. This aligns with the CRISC domain of risk and control monitoring, where logging and analyzing false alerts improves detection accuracy over time without prematurely adjusting thresholds.

Answer

Report to the board.

Answer

Ignore future similar alerts.

Answer

Reduce the sensitivity of the detection system.

Question 14

An organization wants to identify risks related to third-party vendors. Which approach best supports continuous risk identification?

Accepted Answer

Automated monitoring of vendor security controls via a third-party risk platform. Automated monitoring via a third-party risk platform enables continuous, real-time visibility into vendor security controls, such as firewall rule changes, vulnerability scan results, and compliance posture. This approach aligns with the CRISC principle of ongoing risk identification, as it detects changes in risk exposure between formal assessment cycles without relying on periodic snapshots.

Answer

Contractual clauses requiring self-assessment

Answer

On-site audits every two years

Answer

Annual vendor risk assessments

Question 15

Which enterprise architecture layer is most directly responsible for managing the storage and processing of data, and for which data classification and encryption controls are critical?

Accepted Answer

Data architecture. Data architecture is the enterprise architecture layer that defines how data is stored, managed, and processed, including data models, data flows, and storage structures. Data classification and encryption controls are critical at this layer because they directly protect the confidentiality and integrity of data at rest and in transit, ensuring compliance with policies and regulations.

Answer

Application architecture

Answer

Technology architecture

Answer

Business architecture