CRISC Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 2

Which TWO of the following factors should be considered when determining the frequency of control monitoring?

Accepted Answer

The criticality of the control to risk mitigation.. The frequency of control monitoring should be based on risk and criticality. Options D and E are correct because controls that are more critical to risk mitigation and processes with higher inherent risk levels require more frequent monitoring. Option A is incorrect because monitoring frequency should be driven by risk, not cost; cost is a secondary consideration. Option B is incorrect because the number of IT projects does not directly affect the monitoring frequency of existing controls. Option C is incorrect because external auditor preferences may influence the approach but are not a primary factor in determining monitoring frequency.

Answer

The cost of monitoring relative to control cost.

Answer

The number of IT projects in progress.

Answer

The preferences of the external auditor.

Question 3

During a risk assessment, a risk owner is unsure about the likelihood rating for a specific threat. Which of the following is the BEST source of information to determine the likelihood?

Accepted Answer

Historical incident data from industry reports. Historical incident data from industry reports provides empirical evidence of threat frequency and impact across similar environments, making it the most objective and reliable source for determining likelihood. Unlike subjective opinions or unrelated financial data, industry reports aggregate real-world occurrences, enabling a data-driven risk assessment that aligns with the organization's threat landscape.

Answer

Vendor documentation

Answer

The risk owner's personal opinion

Answer

The organization's financial statements

Question 4

Which THREE of the following are effective risk treatment strategies?

Accepted Answer

Avoid the risk by discontinuing the activity. Avoiding risk by discontinuing the activity is a recognized risk treatment strategy under the ISACA Risk IT framework. By ceasing the activity that introduces the risk, the organization eliminates the possibility of the risk event occurring, which is a valid and often necessary response when the risk exceeds the organization's risk appetite and cannot be cost-effectively mitigated or transferred.

Answer

Accept the risk without any analysis

Answer

Ignore the risk if it has not materialized yet

Question 5

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols

Question 6

Match each information security objective to its description.

Accepted Answer

Confidentiality: Ensures that information is not disclosed to unauthorized individuals.. The CIA triad (Confidentiality, Integrity, Availability) plus Accountability are core security principles. Correct matches: Confidentiality prevents unauthorized disclosure, Integrity ensures accuracy, Availability guarantees access, and Accountability enables traceability.

Answer

Confidentiality: Ensures that information is accurate and complete, and not modified improperly.

Answer

Integrity: Ensures that information is not disclosed to unauthorized individuals.

Question 7

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register is a foundational artifact in IT risk management, and during the identification phase, its essential components are the risk description (to uniquely identify the risk), the risk owner (to assign accountability), and the root cause (to understand the underlying source). These three elements are documented before any quantitative analysis or mitigation planning occurs, as they form the basis for subsequent risk assessment and response.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 8

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 9

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

Accepted Answer

Provides real-time detection of security events. Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Answer

Reduces the need for security staff

Answer

Is less expensive than periodic testing

Answer

Eliminates all false positives

Question 10

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)

Accepted Answer

Contract compliance reviews. Contract compliance reviews (A) are a key component because they verify that vendors are meeting agreed-upon service level agreements (SLAs), security clauses, and regulatory requirements. This ensures that contractual obligations, such as data protection standards and incident response timelines, are being enforced and that any deviations are identified and remediated. Without this review, the organization cannot confirm that the vendor's actual practices align with the risk posture agreed upon during onboarding.

Answer

Review of vendor's cyber insurance policy

Answer

Vendor self-assessment without validation