CRISC Practice Questions 2 — 50 Questions

Question 1

You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement automated real-time monitoring of critical configuration changes with alerts.. Implementing automated real-time monitoring of critical configuration changes with alerts would have detected the misconfiguration immediately, allowing the SOC to respond within minutes rather than days. This directly addresses the monitoring gap (24-hour review cycle) and aligns with the low risk appetite for availability. Option B is incorrect because while CAB approval improves change control, it does not improve real-time detection; the change was made without following process, so additional approval steps would not prevent a rogue administrator. Option C is incorrect because monthly access reviews are still too infrequent to catch real-time configuration changes. Option D is incorrect because training does not provide immediate detection of unauthorized changes.

Answer

Require all change requests to be approved by the change advisory board (CAB).

Answer

Increase the frequency of access reviews to monthly.

Answer

Provide additional training to cloud administrators on security policies.

Question 2

An organization is evaluating threat intelligence feeds to improve IT risk identification. Which of the following criteria should be given the HIGHEST priority when selecting a feed?

Accepted Answer

Relevance to the organization's industry and technology stack. Relevance to the organization's industry and technology stack is the highest priority because threat intelligence that does not align with the specific attack surface, software versions, and threat actors targeting that industry will generate excessive false positives and irrelevant alerts. For example, a healthcare organization using Epic EHR would prioritize feeds covering healthcare-specific ransomware (e.g., Ryuk) and medical device vulnerabilities over generic indicators, ensuring risk identification is actionable and contextually accurate.

Answer

Ease of integration with existing security tools

Answer

The feed's update frequency

Answer

The number of indicators provided per day

Question 3

An organization is integrating IT risk into its enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It ensures IT risks are viewed in the context of business objectives. Integrating IT risk into enterprise risk management (ERM) ensures that IT risks are evaluated in the context of business objectives, enabling prioritization of risk responses that align with strategic goals. This alignment prevents IT from operating in a silo and ensures that risk decisions support overall business value, not just technical compliance.

Answer

It allows IT to operate independently

Answer

It eliminates all IT risks

Answer

It reduces the need for IT controls

Question 4

An organization is selecting a control to prevent unauthorized access to a critical database. Which control type is most appropriate?

Accepted Answer

Preventive control. Preventive control is the most appropriate because it directly stops unauthorized access before it occurs. For a critical database, this includes mechanisms like database firewalls, access control lists (ACLs), or mandatory access control (MAC) policies that enforce authentication and authorization at the point of entry, such as requiring valid credentials and role-based permissions before any query is processed.

Answer

Detective control

Answer

Corrective control

Answer

Directive control

Question 5

When prioritizing risk treatment actions, which factor is most important to consider alongside the risk level?

Accepted Answer

Cost-benefit analysis of controls. Risk treatment prioritization must balance the cost of controls against the expected reduction in risk. A cost-benefit analysis ensures that the selected controls provide a net positive value, preventing over-investment in low-impact risks or under-investment in high-impact ones. This aligns with the ISACA Risk IT Framework, which emphasizes that risk treatment decisions should be economically justified.

Answer

Number of stakeholders involved

Answer

Regulatory requirements only

Answer

Time required to implement controls

Question 6

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Accepted Answer

Segmentation of networks into zones and conduits. IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

Answer

Mandatory cloud-based backup for all control systems

Answer

Annual penetration testing by an external firm

Answer

Use of AES-256 encryption for all communications

Question 7

A risk practitioner is developing risk scenarios for a new cloud service. Which THREE of the following elements should be included in a complete risk scenario?

Accepted Answer

Threat event. A complete risk scenario includes a threat actor, a threat event, and a consequence. Asset/resource is also important but not listed in the options; timing, detection, and response are supplementary. The three core elements from the list are threat actor, threat event, and consequence.

Answer

Response plan

Answer

Detection mechanism

Question 8

Which THREE of the following are key components of an effective risk response plan?

Accepted Answer

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept). A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.

Answer

Detailed implementation timeline

Answer

Regulatory impact analysis

Question 9

Based on the exhibit, which of the following is the MOST likely risk scenario?

Accepted Answer

A brute-force attack targeting the root account. The exhibit shows repeated failed login attempts for the root account, which is a classic indicator of a brute-force attack. SSH logs typically record authentication failures, and a high frequency of 'Failed password for root' entries from a single source IP strongly suggests an automated password guessing attempt. This aligns with the risk scenario of a brute-force attack targeting the root account.

Answer

A denial-of-service attack on the SSH service

Answer

A successful privilege escalation by an insider

Answer

A misconfigured firewall allowing unauthorized access

Question 10

An organization is implementing a new cloud-based CRM system. The risk manager is reviewing the solution architecture for security risks. Which architectural layer should be evaluated to ensure data encryption at rest and in transit?

Accepted Answer

Data architecture. Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

Answer

Application architecture

Answer

Infrastructure architecture

Answer

Business architecture

Question 11

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

Accepted Answer

Conduct a threat modeling workshop with the development team.. Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Answer

Perform a vulnerability scan on the CRM server.

Answer

Run a penetration test against the CRM application.

Answer

Review the business impact analysis for the CRM.

Question 12

A company has identified a risk of data exfiltration through an outdated encryption protocol. The risk assessment team determines that the likelihood is low, but the impact is very high. The company decides to update the encryption protocol. This risk response is an example of:

Accepted Answer

Risk mitigation. Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 13

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

Accepted Answer

Unauthorized access to patient medical records.. The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.

Answer

Denial of service due to excessive login attempts.

Answer

Insufficient encryption of data in transit.

Answer

Phishing attacks targeting portal users.

Question 14

A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?

Accepted Answer

Document the vulnerability and assess the associated risk in the risk register. The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

Answer

Apply a virtual patch via an intrusion prevention system

Answer

Isolate the application from the network

Answer

Notify the application owner and request an emergency patch

Question 15

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Accepted Answer

Risk Avoidance. Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 16

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. A high false positive rate in a detective control leads to alert fatigue, where security personnel may ignore or dismiss alerts, increasing the risk that actual security incidents are missed. Option A is a consequence but not the most significant. Option C may occur but is secondary. Option D is an operational impact but does not directly increase risk.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 17

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

Accepted Answer

To determine the criticality and recovery time objectives of business processes. The primary purpose of a business impact analysis (BIA) is to identify critical business processes, determine their recovery priorities, and establish recovery time objectives (RTOs) and recovery point objectives (RPOs). Option B is incorrect because identifying vulnerabilities is part of a vulnerability assessment, not a BIA. Option C is incorrect because identifying potential threat actors is part of threat modeling. Option D is incorrect because inventorying IT assets is part of asset management, not the primary goal of a BIA.

Answer

To identify vulnerabilities in IT systems

Answer

To identify potential threat actors

Answer

To inventory all IT assets

Question 18

A multinational corporation is conducting a risk assessment for its new online payment platform. The platform processes transactions in multiple currencies and stores sensitive customer financial data. The risk team has identified that the encryption algorithm used for data at rest is outdated and could be vulnerable to advanced attacks. The company's risk appetite is low for data breaches. The security team recommends upgrading the encryption to a modern standard, but the upgrade will require a 48-hour downtime impacting all global transactions. The business unit is concerned about revenue loss during the downtime. As the risk practitioner, what is the BEST course of action to balance security and business continuity?

Accepted Answer

Plan the upgrade during a low-traffic period and implement compensating controls such as additional monitoring during the downtime.. The best course of action because it balances the need to mitigate a high-risk encryption vulnerability with business continuity. By scheduling the upgrade during a low-traffic period and implementing compensating controls (e.g., enhanced monitoring and intrusion detection), the organization reduces the likelihood of exploitation during the 48-hour downtime while minimizing revenue loss. This aligns with the low risk appetite for data breaches and demonstrates a risk-based decision that treats the vulnerability without accepting unacceptable exposure.

Answer

Accept the risk and delay the upgrade until the next scheduled maintenance window in three months.

Answer

Outsource the payment processing to a third-party vendor that already uses modern encryption.

Answer

Implement the upgrade immediately to mitigate the vulnerability, accepting the revenue loss.

Question 19

Which of the following is an example of a 'configuration vulnerability' that should be identified during vulnerability assessment?

Accepted Answer

Default administrative passwords left unchanged on a network device. A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

Answer

A buffer overflow in a custom application

Answer

An SQL injection flaw in a web form

Answer

Missing security patches on a server

Question 20

Which TWO of the following are examples of risk avoidance?

Accepted Answer

Migrating to a different technology platform. Migrating to a different technology platform (Option D) is a risk avoidance strategy because it eliminates the risk entirely by moving away from the vulnerable or high-risk technology. For example, if an organization uses an outdated operating system with known unpatched vulnerabilities, migrating to a modern, supported platform removes the attack surface, avoiding the risk rather than mitigating or transferring it.

Answer

Implementing a firewall

Answer

Purchasing cyber insurance

Answer

Accepting the risk