CRISC Practice Test 50 — 15 Questions

Question 1

During a review of third-party vendor risks, the risk team identifies that a cloud service provider's data center is located in a country with unstable political conditions. What should the risk practitioner do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the risk and assess its potential impact.. The risk practitioner's first step should be to document the identified risk and assess its potential impact on the organization. This aligns with the CRISC framework's emphasis on risk identification and assessment before any treatment decisions are made. Without a thorough impact assessment, the organization cannot determine whether the risk is acceptable, requires mitigation, or warrants contract termination.

Answer

Accept the risk based on the vendor's SLA.

Answer

Request the vendor to move data to another region.

Answer

Terminate the contract immediately.

Question 2

A financial institution has implemented a continuous monitoring solution for its core banking application. The monitoring team receives an alert indicating that the average response time for a critical transaction has exceeded the threshold for the past 15 minutes. The transaction volume during this period is within normal range. What should be the FIRST step in the incident response process?

Accepted Answer

Verify the alert by reviewing real-time logs and metrics, then assess the potential impact on business operations.. The first step in incident response is to validate the alert by reviewing real-time logs and metrics to confirm it is not a false positive, and then assess the potential impact on business operations. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment or escalation. Without verification, subsequent actions like vendor contact or escalation may be premature and waste resources.

Answer

Contact the application vendor to report a potential performance issue.

Answer

Compare current response time with historical baselines to determine if this is an anomaly.

Answer

Escalate the alert to the IT operations manager and the application owner immediately.

Question 3

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

Accepted Answer

HTTP traffic is permitted from any source to any destination. Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.

Answer

The final rule denies all traffic

Answer

HTTPS traffic is permitted to any destination

Answer

SSH access is only allowed from internal network

Question 4

Which of the following is the PRIMARY source for identifying known software vulnerabilities in a systematic manner?

Accepted Answer

National Vulnerability Database (NVD). The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data, including CVE entries and severity scores.

Answer

OSINT feeds from social media

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 5

A company operates a legacy system for which the vendor no longer provides security patches. What is the most critical risk to identify regarding this system?

Accepted Answer

Unpatched vulnerabilities. Unpatched vulnerabilities are the most critical risk because the legacy system is exposed to known exploits that the vendor no longer addresses. Without security patches, attackers can leverage published CVEs to compromise the system, leading to data breaches or system takeover. This directly threatens the confidentiality, integrity, and availability of the system and its data.

Answer

Incompatibility with new systems

Answer

Lack of vendor support

Answer

Skill shortage for maintenance

Question 6

A company has a control that automatically rejects transactions over $10,000. During a review, it is found that 2% of transactions over $10,000 were approved due to a system glitch. The control owner says the glitch has been fixed. What should the risk practitioner do next?

Accepted Answer

Request evidence of the fix and perform a sample test of recent transactions.. The risk practitioner must independently verify that the system glitch has been resolved before closing the finding. Requesting evidence of the fix (e.g., change logs, patch notes) and performing a sample test of recent transactions provides objective assurance that the control is now operating effectively. This aligns with the CRISC principle that control owner assurances alone are insufficient without validation, especially for automated controls where residual risk from the glitch could persist.

Answer

Accept the control owner's assurance and close the finding.

Answer

Recommend a compensating control until the fix is confirmed.

Answer

Report the issue to the audit committee.

Question 7

During a quantitative risk analysis, the risk team calculates the loss event frequency (LEF) using the FAIR framework. If the threat event frequency (TEF) is 10 per year and the vulnerability (V) is 0.3, what is the LEF?

Accepted Answer

3 per year. In the FAIR framework, loss event frequency (LEF) is calculated as the product of threat event frequency (TEF) and vulnerability (V). Given TEF = 10 per year and V = 0.3, LEF = 10 × 0.3 = 3 per year. This represents the expected number of loss events per year, accounting for the probability that a threat event will actually result in a loss.

Answer

10.3 per year

Answer

30 per year

Answer

0.3 per year

Question 8

A financial institution is implementing a new online banking platform. The risk assessment identified that the platform will handle sensitive customer data and must comply with GDPR and local banking regulations. The project team proposes encrypting all data at rest and in transit, implementing multi-factor authentication (MFA), and conducting quarterly penetration tests. However, the risk owner is concerned about the residual risk of a sophisticated phishing attack that could bypass MFA. The board has a low risk appetite. What is the BEST way to address this residual risk?

Accepted Answer

Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.. It addresses the specific residual risk with a targeted control (phishing simulations and training) without overcomplicating the project. Option A is wrong because purchasing insurance does not reduce the likelihood of an attack. Option C is wrong because stopping the project is a disproportionate response to a manageable risk. Option D is wrong because accepting the residual risk conflicts with the board's low risk appetite.

Answer

Purchase cyber insurance to transfer the financial impact of a potential phishing attack.

Answer

Reduce the project scope to exclude online banking and revert to a less risky channel.

Answer

Accept the residual risk because the existing controls (encryption, MFA, pen tests) already provide reasonable assurance.

Question 9

An IT risk manager is facilitating a brainstorming session to identify threats. Which technique is BEST suited for identifying a wide range of potential threats?

Accepted Answer

Conduct a facilitated workshop with cross-functional stakeholders. A facilitated workshop with cross-functional stakeholders is best suited for brainstorming because it leverages diverse perspectives from IT, business, legal, and operations teams to identify a wide range of threats, including emerging and non-obvious ones. This collaborative approach aligns with the CRISC emphasis on qualitative risk assessment techniques that surface unknown unknowns, which static checklists or historical data cannot capture.

Answer

Use a standard threat checklist

Answer

Review historical incident logs

Answer

Interview the heads of each department individually

Question 10

A global organization is consolidating risk data from multiple business units into a single enterprise risk management (ERM) system. The risk practitioner notices that KRIs for the same risk type (e.g., cybersecurity) are calculated differently across units. What is the BEST approach to ensure consistent and reliable risk monitoring and reporting?

Accepted Answer

Establish a common definition and calculation methodology for each KRI across all business units.. Consistent risk monitoring and reporting requires a standardized definition and calculation methodology for each KRI across all business units. Without this common baseline, the aggregated risk data in the ERM system will be incomparable and unreliable, leading to flawed decision-making. Establishing common definitions ensures that the same risk type (e.g., cybersecurity) is measured uniformly, enabling accurate trend analysis and risk aggregation.

Answer

Require all units to adopt a common set of key performance indicators for their control environment.

Answer

Allow each business unit to maintain its own KRI definitions but report explanations for variances.

Answer

Implement automated data feeds from each unit's system to the ERM system without changing the KRI definitions.

Question 11

During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?

Accepted Answer

Implement a web application firewall (WAF) as a compensating control.. A web application firewall (WAF) is the appropriate compensating control because it can inspect and block SQL injection payloads at the HTTP/HTTPS layer without modifying the application code. This provides immediate risk reduction while the development team works on the permanent fix, aligning with the principle of defense-in-depth and the risk manager's responsibility to treat unacceptable risk during the remediation window.

Answer

Accept the risk due to the low likelihood of exploitation.

Answer

Document the risk and defer action to the next assessment.

Answer

Request an immediate emergency patch deployment.

Question 12

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. Risk avoidance means avoiding the risk by discontinuing the activity that generates it.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 13

A risk assessment report includes both inherent and residual risk ratings. The inherent risk for a process is rated as 'high' based on a 5×5 heat map. After applying a set of controls, the residual risk is rated as 'medium'. What does this indicate about the control effectiveness?

Accepted Answer

Controls are partially effective in reducing risk.. The reduction from high to medium indicates that controls are partially effective in reducing risk, but not completely.

Answer

Controls increased the risk level.

Answer

Controls are fully effective and eliminate all risk.

Answer

Controls are not effective at all.

Question 14

A multinational corporation is expanding its cloud infrastructure to include a new SaaS application that stores sensitive customer data. The vendor claims compliance with SOC 2 Type II and ISO 27001. The risk manager must determine if the remaining residual risk after vendor controls is within the company's risk appetite. Which of the following is the MOST critical next step?

Accepted Answer

Conduct a data classification and legal review to identify applicable regulatory obligations.. Classifying the data and identifying applicable regulatory obligations is critical to determine if the vendor's controls are sufficient for the company's risk appetite. Option A is wrong because a vendor's risk assessment report may not address the company's specific regulatory requirements or data sensitivity. Option C is wrong because a pilot deployment monitors for security incidents but does not evaluate compliance with regulatory obligations. Option D is wrong because accepting certifications alone may overlook specific legal or regulatory requirements that the vendor's controls do not cover.

Answer

Request the vendor's latest risk assessment report.

Answer

Perform a pilot deployment and monitor for security incidents.

Answer

Accept the vendor's certifications as sufficient evidence of control effectiveness.

Question 15

A company is conducting a risk assessment of a critical third-party service provider. Which of the following is the BEST source of information to identify risks associated with the provider's sub-processors?

Accepted Answer

The provider's documented vendor risk management program and audit reports of sub-processors. The provider's documented vendor risk management program and audit reports of sub-processors are the best source because they directly detail the controls, security posture, and compliance status of the sub-processors. This information is specific to the sub-processors' operations, unlike general reports or contracts that may not cover their unique risks. It enables the company to assess third-party and fourth-party risks as part of a comprehensive IT risk identification process.

Answer

Service level agreements in the contract

Answer

SOC 2 Type II reports of the primary provider

Answer

Public announcements of data breaches involving the provider