CRISC Practice Test 50 — 15 Questions

Question 1

A manufacturing company uses IoT sensors on the factory floor to monitor equipment performance. The sensors transmit data to a central server via Wi-Fi. During a risk identification workshop, the operations manager reveals that some sensors are operating on outdated firmware with known vulnerabilities. The IT director proposes replacing all sensors at a high cost. The risk team notes that a breach could cause production downtime but the sensors only collect non-sensitive operational data. The company has a low tolerance for downtime. What should the risk team identify as the most critical risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Operational disruption from a potential cyber attack exploiting sensor vulnerabilities.. The most critical risk is operational disruption from a cyber attack exploiting the known vulnerabilities in the outdated IoT sensor firmware. Since the company has a low tolerance for downtime, any breach that causes production stoppage directly impacts business continuity, outweighing the non-sensitive nature of the data collected. The sensors' Wi-Fi connectivity provides an attack surface for lateral movement or denial-of-service, making exploitation a high-probability, high-impact event.

Answer

Legal liability from non-compliance with safety standards.

Answer

Reputational damage from a data leak.

Answer

Financial loss from replacing sensors.

Question 2

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?

Accepted Answer

Expansion of the attack surface from IT to OT environments. Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.

Answer

Increased complexity in managing network bandwidth

Answer

Potential for increased data redundancy

Answer

Higher licensing costs for security software

Question 3

During a quarterly risk review, the CISO notes that the number of failed authentication attempts has increased by 300% over the last month. The IT team confirms no changes to authentication systems. This metric is BEST categorized as which of the following?

Accepted Answer

Key Risk Indicator (KRI). A Key Risk Indicator (KRI) is a metric used to signal a change in risk exposure. A 300% increase in failed authentication attempts, with no changes to the authentication system, strongly indicates a potential ongoing brute-force attack or credential stuffing campaign, directly elevating the risk of unauthorized access. This metric is not measuring performance (KPI), contractual service levels (SLA), or the effectiveness of a specific control (KCI), but rather a change in the risk landscape.

Answer

Key Performance Indicator (KPI)

Answer

Service Level Agreement (SLA) metric

Answer

Key Control Indicator (KCI)

Question 4

A risk manager is evaluating IoT device risks for a smart building project. Which TWO of the following are significant IoT security risks?

Accepted Answer

Firmware update challenges. Option D is correct because IoT devices often lack a reliable mechanism for secure firmware updates: many have limited processing power, no signed-update verification, or no supported update channel, leaving known vulnerabilities unpatched and devices exploitable over their lifetime. Option E is correct because a smart building connects potentially thousands of heterogeneous sensors, actuators, and controllers, each exposing network interfaces and services, which dramatically expands the attack surface and gives adversaries more entry points and lateral-movement paths. The remaining options do not belong: data sovereignty compliance (A) is a legal/regulatory concern rather than a technical IoT security risk, quantum computing (B) is a long-term cryptographic threat affecting all IT rather than a significant near-term IoT-specific risk, and vendor lock-in (C) is a business/procurement issue, not a security vulnerability.

Answer

Data sovereignty compliance

Answer

Quantum computing threat to cryptography

Answer

Vendor lock-in

Question 5

You are the risk manager for a healthcare provider. A risk assessment identified that patient data is transmitted over unencrypted connections between clinics and the data center. The existing controls include strong network perimeter defenses. The risk is rated as high. Management is concerned about the cost of implementing encryption. You have proposed a control that encrypts data in transit. However, the network team argues that the perimeter controls are sufficient. What is the MOST appropriate response?

Accepted Answer

Implement encryption as recommended because it addresses the vulnerability directly.. Encrypting data in transit directly addresses the vulnerability of unencrypted connections, which is the root cause of the high risk. Perimeter controls like firewalls and IDS/IPS do not protect the confidentiality of data once it leaves the protected network boundary, as they cannot prevent interception on the wire. Implementing encryption (e.g., TLS 1.2/1.3 or IPsec) ensures end-to-end confidentiality regardless of perimeter strength.

Answer

Transfer the risk to a third party by outsourcing data transmission.

Answer

Accept the risk because perimeter controls are in place.

Answer

Reduce the risk rating to medium since perimeter controls provide compensating security.

Question 6

Which of the following is a limitation of qualitative risk analysis?

Accepted Answer

It provides subjective results that are not comparable across organizations.. Qualitative risk analysis relies on subjective judgment, expert opinion, and descriptive scales (e.g., High/Medium/Low), which makes results inherently subjective and difficult to compare across different organizations or even different teams. This lack of standardization and reproducibility is its primary limitation.

Answer

It cannot be used for regulatory compliance.

Answer

It requires specialized software to perform.

Answer

It is too data-intensive and time-consuming.

Question 7

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. (Avoid) is correct because risk avoidance involves discontinuing the activity or process that gives rise to the risk. In IT risk management, this means removing the vulnerable system, decommissioning a service, or ceasing a business function entirely to eliminate the risk exposure. For example, if an organization decides to shut down a legacy FTP server to avoid the risk of data interception, it is applying the avoid treatment.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 8

An IT risk manager is developing KRIs for a critical application. Which TWO of the following are leading indicators that the risk level may be increasing? (Select TWO)

Accepted Answer

Average patch lag time increasing. Option A (Average patch lag time increasing) is correct because a growing delay between patch release and deployment is a leading indicator: it signals accumulating unpatched vulnerabilities and weakening patch management before any exploit or incident occurs. Option B (Failed authentication spike) is correct because a sudden rise in failed logons is a leading indicator of credential-stuffing, brute-force, or password-spraying activity, which precedes a potential account compromise. Option C is a lagging indicator because audit findings document control deficiencies that already exist, reflecting past state rather than predicting future risk increase. Option D is a lagging indicator since successful intrusions are realized events that have already occurred. Option E is also lagging because counting past security incidents measures historical impact, not forward-looking risk trajectory.

Answer

Audit findings of control deficiencies

Answer

Number of successful intrusions

Answer

Number of security incidents in the past month

Question 9

An organization's risk register contains a risk with a very high impact but very low likelihood. The risk response strategy should be:

Accepted Answer

Accept. When a risk has very high impact but very low likelihood, the most cost-effective response is often acceptance, because the probability of occurrence is so low that the cost of mitigation, avoidance, or transfer would exceed the expected benefit. Accepting the risk means the organization formally acknowledges it and monitors it, but does not allocate resources to reduce or transfer it. This aligns with the principle of risk appetite and cost-benefit analysis in IT risk management.

Answer

Mitigate

Answer

Avoid

Answer

Transfer

Question 10

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Accepted Answer

Firewall. A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Answer

Outsourcing IT helpdesk

Answer

Cyber insurance

Question 11

Based on the exhibit, which of the following poses the HIGHEST risk to the environment?

Accepted Answer

The database has a direct SSH connection from the internet. A direct SSH connection from the internet to the database server bypasses all network segmentation and firewall controls, exposing the database to brute-force attacks, credential theft, and unauthorized remote access. SSH is a management protocol, not an application protocol, and its exposure on the internet creates a direct attack surface on the most sensitive data tier, which is the highest risk to the environment.

Answer

The web servers are in a public subnet

Answer

The communication between web and application servers is encrypted via HTTPS

Answer

The application servers use embedded credentials to access the database

Question 12

During a risk assessment, a control self-assessment (CSA) indicates that a key control is operating effectively. However, an independent audit finds multiple control failures. Which of the following is the MOST likely reason for this discrepancy?

Accepted Answer

The CSA participants lacked objectivity. The most likely reason for the discrepancy is that the CSA participants lacked objectivity. Control self-assessments are performed by process owners or staff who may have a vested interest in reporting favorable results, leading to biased or incomplete evaluations. In contrast, an independent audit applies objective testing procedures, which are more likely to uncover actual control failures that the CSA missed or downplayed.

Answer

The audit tested different samples

Answer

The control environment changed

Answer

The CSA was conducted too recently

Question 13

A company is performing a qualitative risk analysis for a new cloud migration project. Which TWO of the following are recognized limitations of qualitative risk analysis?

Accepted Answer

Risk ratings are not easily comparable across different organizations. Option A is correct because qualitative risk analysis produces ordinal ratings (such as High/Medium/Low) that are defined by each organization's own scales and risk criteria, so the resulting ratings lack a common quantitative baseline and cannot be reliably compared across different organizations. Option D is correct because qualitative analysis relies on expert opinion, experience, and judgment rather than numeric measurement, making the ratings inherently subjective and dependent on the assessor's bias, expertise, and interpretation. Options B, C, and E are not limitations of qualitative analysis: it is specifically chosen because it requires little historical data (B is wrong), it is generally faster and simpler than quantitative analysis (C is wrong), and it does not produce financially precise loss estimates—that is the domain of quantitative risk analysis using techniques like Monte Carlo simulation or expected monetary value (E is wrong).

Answer

It requires extensive historical data

Answer

It is time-consuming and complex to perform

Answer

It provides financially precise loss estimates

Question 14

An organization is integrating IT risk into its enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It ensures IT risks are viewed in the context of business objectives. Integrating IT risk into enterprise risk management (ERM) ensures that IT risks are evaluated in the context of business objectives, enabling prioritization of risk responses that align with strategic goals. This alignment prevents IT from operating in a silo and ensures that risk decisions support overall business value, not just technical compliance.

Answer

It allows IT to operate independently

Answer

It eliminates all IT risks

Answer

It reduces the need for IT controls

Question 15

Based on the exhibit, which of the following is the MOST likely risk scenario?

Accepted Answer

A brute-force attack targeting the root account. The exhibit shows repeated failed login attempts for the root account, which is a classic indicator of a brute-force attack. SSH logs typically record authentication failures, and a high frequency of 'Failed password for root' entries from a single source IP strongly suggests an automated password guessing attempt. This aligns with the risk scenario of a brute-force attack targeting the root account.

Answer

A denial-of-service attack on the SSH service

Answer

A successful privilege escalation by an insider

Answer

A misconfigured firewall allowing unauthorized access