CRISC Practice Test 5 — 10 Questions

Question 1

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer

$25,000

Answer

$50,000

Answer

$200,000

Question 2

During a risk assessment for a new financial application, the risk manager identifies that the application processes sensitive customer data and is accessible from the internet. Which of the following is the MOST appropriate risk scenario to document?

Accepted Answer

An attacker could exploit weak authentication mechanisms to gain unauthorized access and exfiltrate customer data, resulting in regulatory fines and reputational damage.. The most appropriate risk scenario because it follows the standard risk scenario structure: threat (attacker), vulnerability (weak authentication), impact (unauthorized access, data exfiltration, regulatory fines, reputational damage). It directly ties the technical weakness to a business consequence, which is essential for communicating risk to stakeholders. The scenario is specific to the application's internet-facing nature and sensitive data processing, making it actionable for risk treatment.

Answer

The application has several unpatched vulnerabilities that increase the likelihood of a security incident.

Answer

The application will implement multi-factor authentication to prevent unauthorized access.

Answer

The application must comply with PCI DSS requirements for data protection.

Question 3

Order the steps for incident response handling.

Accepted Answer

Step 1: Preparation, Step 2: Detection, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting. Incident response follows preparation, detection, containment/eradication/recovery, lessons learned, and reporting.

Answer

Step 1: Detection, Step 2: Preparation, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting

Answer

Step 1: Reporting, Step 2: Preparation, Step 3: Detection, Step 4: Containment/Eradication/Recovery, Step 5: Lessons Learned

Answer

Step 1: Preparation, Step 2: Containment/Eradication/Recovery, Step 3: Detection, Step 4: Lessons Learned, Step 5: Reporting

Question 4

Which THREE of the following are key components of a risk assessment report?

Accepted Answer

Risk register with identified risks. A risk assessment report must document the identified risks in a structured format, so option A (Risk register with identified risks) is correct because the risk register is the core artifact that catalogs each risk, its owner, and its status. Option C (Recommended risk response actions) is correct because the report must translate findings into actionable treatment options such as mitigate, transfer, avoid, or accept, guiding decision-makers on next steps. Option E (Risk analysis (likelihood and impact)) is correct because quantifying or qualifying each risk by its probability and potential impact is the analytical heart of the assessment, typically expressed as a risk score (e.g., likelihood × impact). Options B (Copies of vendor contracts) and D (Network topology diagram) are supporting evidence or technical artifacts that may inform the assessment but are not key components of the risk assessment report itself.

Answer

Copies of vendor contracts

Answer

Network topology diagram

Question 5

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Accepted Answer

Risk assessment. The NIST Cybersecurity Framework's Identify function includes categories such as Asset Management, Business Environment, Governance, Risk Assessment, and Risk Management Strategy. Risk assessment is explicitly a key component of Identify because understanding organizational risk is foundational to prioritizing cybersecurity activities. It is listed under ID.RA in the framework core.

Answer

Recovery planning

Answer

Response planning

Answer

Anomalies and events detection

Question 6

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Accepted Answer

Actor. In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

Answer

Event

Answer

Threat type

Answer

Asset/Resource

Question 7

A company uses a third-party SaaS application for payroll processing. What is the most important activity to identify IT risks associated with this service?

Accepted Answer

Conducting a vendor risk assessment. A vendor risk assessment is the most important activity because it systematically evaluates the third-party SaaS provider's security controls, compliance posture, and operational resilience before and during service use. For a payroll SaaS, this includes reviewing data protection measures for sensitive employee PII, understanding the provider's SOC 2 Type II report, and assessing their incident response capabilities. Without this assessment, the organization cannot identify inherent risks like unauthorized data access, service downtime, or regulatory non-compliance specific to the third-party environment.

Answer

Performing penetration testing on the SaaS application

Answer

Reviewing the service-level agreement (SLA)

Answer

Implementing multi-factor authentication (MFA)

Question 8

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness. Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 9

Which of the following is the primary purpose of a risk and control monitoring program?

Accepted Answer

To provide ongoing assurance that controls are operating effectively.. The primary purpose of a risk and control monitoring program is to provide ongoing assurance that controls are operating effectively. This is achieved through continuous or periodic testing, observation, and analysis of control activities to confirm they are designed correctly and functioning as intended to mitigate risks. Without this ongoing assurance, an organization cannot reliably know whether its risk responses remain effective over time.

Answer

To identify new risks as they emerge.

Answer

To reduce the frequency of internal audits.

Answer

To calculate key risk indicators.

Question 10

Which THREE of the following are components of an effective IT risk reporting structure for a large enterprise? (Select THREE)

Accepted Answer

Strategic risk reporting to the board on a semi-annual basis. Option A is correct because strategic risk reporting to the board on a semi-annual basis aligns with the board's governance and oversight role, giving directors a periodic, high-level view of enterprise risk posture without overwhelming them with operational detail. Option B is correct because tactical risk reporting to the CISO on a quarterly basis matches the CISO's responsibility for managing the information security risk program and provides a cadence suitable for tracking risk treatment progress and emerging threats. Option E is correct because operational risk reporting to IT management on a weekly basis supports timely decision-making on day-to-day control failures, incidents, and remediation activities that require rapid attention. Option C is not appropriate because annual reporting to IT operational staff is too infrequent for the operational level, where risks change quickly and require continuous awareness. Option D is not appropriate because daily risk reporting to the board is excessive and misaligned with the board's strategic oversight role, which relies on summarized, periodic reporting rather than daily operational data.

Answer

Annual risk reporting to IT operational staff

Answer

Daily risk reporting to the board