CRISC Practice Questions 1 — 50 Questions

Question 1

Which TWO are characteristics of inherent risk?

Accepted Answer

Risk level before controls. Option C is correct because inherent risk is defined as the level of risk that exists before any controls are applied, representing the raw exposure of an asset or process to a threat. Option E is correct because inherent risk is assessed under the assumption that no controls exist, which establishes a baseline against which control effectiveness can later be measured. Together, these two characteristics distinguish inherent risk from residual risk, which is the risk remaining after controls are implemented. Option A is incorrect because basing risk on the effectiveness of current controls describes residual risk, not inherent risk. Option B is incorrect because determining the control gap is a derived analysis activity that compares inherent and residual risk, not a defining characteristic of inherent risk itself. Option D is incorrect because the risk level after controls is the definition of residual risk.

Answer

Based on the effectiveness of current controls

Answer

Used to determine control gap

Answer

Risk level after controls

Question 2

An organization is implementing a new access control system to prevent unauthorized access to sensitive data. Which type of control is being implemented?

Accepted Answer

Preventive control. An access control system that prevents unauthorized access to sensitive data is a preventive control because it enforces security policies before access is granted. Technologies like mandatory access control (MAC) or role-based access control (RBAC) with Access Control Lists (ACLs) block unauthorized users at the point of entry, reducing the risk of data exposure.

Answer

Detective control

Answer

Compensating control

Answer

Corrective control

Question 3

A Key Risk Indicator (KRI) for vulnerability management is the "average patch lag time" (number of days between patch release and deployment). In the last month, this metric increased from 15 days to 45 days. How should the risk practitioner interpret this change?

Accepted Answer

The risk level has increased because exposure to known vulnerabilities has grown.. An increase in average patch lag from 15 to 45 days means critical vulnerabilities remain exploitable for a longer window, directly increasing exposure to known threats. Since KRIs are designed to signal changes in risk levels, a rising KRI indicates the risk level has increased and warrants attention. The correct interpretation is that the organization's exposure to known vulnerabilities has grown.

Answer

The KRI is not relevant because patch lag is a control indicator, not a risk indicator.

Answer

The risk level has decreased because patches are being evaluated more thoroughly.

Answer

The risk level remains unchanged because patch lag is a lagging indicator.

Question 4

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 5

A company's control monitoring dashboard shows that a key control has been operating effectively for six months. However, a recent audit revealed a material weakness. Which of the following is the MOST likely reason?

Accepted Answer

The KRI thresholds were set incorrectly.. The dashboard shows the control operating effectively for six months, yet a material weakness was found. This discrepancy most likely arises because the Key Risk Indicator (KRI) thresholds were set incorrectly, meaning the monitoring system was calibrated to report acceptable risk levels even when the control was actually failing. Incorrect thresholds cause false positives in the dashboard, masking the true control deficiency.

Answer

The control was not tested during the period.

Answer

The monitoring frequency was too low.

Answer

The control owner was not trained.

Question 6

A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?

Accepted Answer

Account lockout policy is not enforced. The repeated login failures followed by a successful authentication indicate that the account lockout policy was not enforced. Without a lockout threshold, an attacker can perform unlimited password attempts until they guess the correct credential. This is a direct failure of the account lockout control, which is designed to prevent brute-force attacks by disabling the account after a defined number of failed attempts (e.g., 5 failures within 15 minutes per NIST SP 800-63B).

Answer

No multi-factor authentication

Answer

Insufficient failed login monitoring

Answer

Weak password policy

Question 7

A university is implementing a new online learning management system (LMS) that will store student records, grades, and personal information. During the risk assessment, the IT team identifies that the LMS vendor's default configuration allows students to see each other's email addresses in the class roster. This could lead to privacy violations under FERPA regulations. The vendor states that this feature can be disabled in the settings but doing so will require manual configuration for each course. The university has a moderate risk appetite and wants to launch the system within two weeks. Which of the following is the MOST appropriate risk response?

Accepted Answer

Reduce the risk by disabling the feature globally through a script or administrative override before launch.. The most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.

Answer

Transfer the risk by requiring students to sign a consent form allowing email disclosure.

Answer

Avoid the risk by selecting a different LMS vendor that does not have this issue.

Answer

Accept the risk because the exposure is limited to email addresses and not grades.

Question 8

Your organization is undergoing a merger and acquisition. The IT risk assessment team is tasked with evaluating the target company's IT environment. During the assessment, you discover that the target company uses a legacy ERP system that is no longer supported by the vendor. They have no disaster recovery plan for this system, and it contains financial data critical to the merged entity. The integration timeline is aggressive, and replacing the system would delay the merger by 18 months. The executive team is reluctant to delay. What is the BEST risk treatment option?

Accepted Answer

Mitigate by developing a disaster recovery plan and implementing compensating controls such as regular backups and manual procedures.. The legacy ERP system contains critical financial data and cannot be replaced without an 18-month delay, making risk mitigation the most practical approach. Developing a disaster recovery plan and implementing compensating controls (e.g., regular backups, manual procedures) reduces the likelihood and impact of a system failure while allowing the merger to proceed on schedule. This aligns with the CRISC principle of treating risk by reducing residual risk to an acceptable level without blocking business objectives.

Answer

Avoid the risk by excluding the legacy system from the merger and migrating data to a new system.

Answer

Accept the risk because the system has been running for years without issue.

Answer

Transfer the risk to the target company's previous owners.

Question 9

During a risk assessment, an organization identifies that its remote workforce uses personal devices for work. The risk manager is concerned about data leakage. The organization has a risk appetite that is 'moderate' and wants to treat the risk. Which of the following is the MOST effective risk treatment option?

Accepted Answer

Implement a Mobile Device Management (MDM) policy with containerization. The most effective because MDM with containerization creates a separate, encrypted work profile on the personal device, isolating corporate data from personal apps and data. This directly addresses data leakage by enforcing security policies (e.g., remote wipe of the work container only) without requiring full control over the entire device, aligning with a 'moderate' risk appetite that seeks a balance between security and usability.

Answer

Implement a VPN for remote access

Answer

Require full disk encryption on all personal devices

Answer

Ban the use of personal devices for work

Question 10

An organization is updating its asset inventory to improve IT risk identification. Which of the following asset attributes is MOST critical for assessing cybersecurity risk?

Accepted Answer

Criticality rating based on business impact. For assessing cybersecurity risk, the most critical attribute is the criticality rating based on business impact because it directly quantifies the potential harm from a security incident. Without knowing which assets are most vital to business operations, risk prioritization becomes arbitrary, leading to misallocated security controls. This aligns with the CRISC focus on risk-based decision-making, where impact drives the urgency of mitigation.

Answer

IP address and location

Answer

Asset owner contact information

Answer

Software vendor name

Question 11

Arrange the steps for performing a vulnerability assessment.

Accepted Answer

Scope definition, then scanning, then analysis, then prioritization, then reporting. Vulnerability assessment starts with scope, scanning, analysis, prioritization, and reporting.

Answer

Scope definition, then scanning, then prioritization, then analysis, then reporting

Answer

Scanning, then scope definition, then analysis, then prioritization, then reporting

Answer

Scope definition, then analysis, then scanning, then prioritization, then reporting

Question 12

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 13

Sequence the steps for implementing a new control based on risk assessment findings.

Accepted Answer

Design the control, then Procure/Build the control, then Test the control, then Deploy the control, then Monitor the control.. Control implementation involves design, procurement/build, testing, deployment, and monitoring.

Answer

Procure/Build the control, then Design the control, then Test the control, then Deploy the control, then Monitor the control.

Answer

Design the control, then Test the control, then Procure/Build the control, then Deploy the control, then Monitor the control.

Answer

Design the control, then Procure/Build the control, then Deploy the control, then Test the control, then Monitor the control.

Question 14

In the context of IT governance, which COBIT 2019 process is specifically focused on ensuring risk optimization?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's EDM03 — Ensure Risk Optimization is the governance process specifically focused on ensuring that IT-related risk is identified, assessed, and managed within the enterprise's risk appetite. It is part of the Evaluate, Direct, and Monitor (EDM) domain, which is the governance domain.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 15

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 16

Order the steps for implementing a risk treatment plan.

Accepted Answer

Select risk response, then develop risk treatment plan, then obtain approval, then implement the plan, then monitor and review.. Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Answer

Select risk response, then obtain approval, then develop risk treatment plan, then implement the plan, then monitor and review.

Answer

Develop risk treatment plan, then select risk response, then obtain approval, then implement the plan, then monitor and review.

Answer

Select risk response, then develop risk treatment plan, then implement the plan, then obtain approval, then monitor and review.

Question 17

During a risk assessment for a critical financial application, the IT risk manager identifies a vulnerability in the application's authentication module. The exploit would require authenticated access. Which risk rating is most appropriate if the vulnerability has a CVSS base score of 9.0, but the application is behind a strong firewall and requires two-factor authentication?

Accepted Answer

Medium, after considering the compensating controls. The CVSS base score of 9.0 reflects the intrinsic severity of the vulnerability, but the final risk rating must incorporate compensating controls. The strong firewall and two-factor authentication (2FA) significantly reduce the likelihood of exploitation, as the attacker would need to bypass both network-level filtering and an additional authentication factor. In CRISC methodology, risk is a function of likelihood and impact; here, the controls lower the likelihood, resulting in a Medium residual risk rating despite the high base score.

Answer

Low, because the application requires authenticated access

Answer

High, because CVSS base score is 9.0

Answer

Very high, due to the criticality of the application

Question 18

A company is integrating its IT risk management program with the enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It provides a holistic view of risk across the organization.. Integration ensures that IT risks are considered in the context of overall organizational objectives and that risk responses are aligned across the enterprise.

Answer

It allows IT to operate independently from business units.

Answer

It eliminates the requirement for a separate IT risk register.

Answer

It reduces the need for IT-specific risk assessments.

Question 19

A multinational corporation has deployed a centralized log management system that collects security events from all subsidiaries. The CRO notices that the number of critical alerts from the Asia-Pacific region has dropped significantly over the past week. Upon investigation, the log source status shows that 30% of the devices in that region have not sent any logs in 48 hours. What is the MOST likely cause?

Accepted Answer

A configuration change was made to the log forwarder agent on the affected devices, causing it to stop sending logs.. A configuration change to the log forwarder agent (e.g., syslog-ng, rsyslog, or a proprietary agent) is the most plausible cause for a sudden, sustained drop in log volume from a subset of devices. Unlike network segmentation (Option D), which would affect all traffic, or a DDoS (Option B), which would cause intermittent or total loss, an agent misconfiguration selectively stops log generation while the device remains online. The 48-hour window and 30% device impact align with a staged or partial rollout of a faulty agent configuration.

Answer

The security team applied a new log suppression rule that filters out low-severity events.

Answer

The region experienced a distributed denial-of-service (DDoS) attack that overwhelmed the log collection infrastructure.

Answer

The network team recently implemented a segmentation change that blocked log traffic from those devices.

Question 20

A company is conducting an IT risk assessment for the first time. Which of the following should be the FIRST step?

Accepted Answer

Establish the risk assessment context. Before any risk assessment activities can begin, the organization must establish the context—defining the scope, risk appetite, criteria for risk evaluation, and the business objectives the assessment supports. Without this foundational step, subsequent identification of assets, threat analysis, or control implementation would lack alignment with business goals and could produce irrelevant or misleading results. This aligns with the ISACA Risk IT framework and the CRISC domain of IT Risk Assessment.

Answer

Identify all IT assets

Answer

Analyze the likelihood and impact of threats

Answer

Implement mitigating controls