CRISC Practice Exam 51 — 20 Questions

Question 1

Which TWO controls are most effective for reducing the risk of data leakage from endpoints in a remote work environment?

Accepted Answer

Implement Data Loss Prevention (DLP) software.. Data Loss Prevention (DLP) software is highly effective because it monitors, detects, and blocks unauthorized transfers of sensitive data (e.g., PII, IP) from endpoints by inspecting content in motion, at rest, and in use. Full-disk encryption (FDE) protects data at rest by rendering the drive unreadable without the decryption key, mitigating leakage if a device is lost or stolen. Together, they address both active exfiltration and passive physical theft.

Answer

Conduct regular phishing simulation campaigns.

Answer

Enforce complex password policies for local accounts.

Answer

Use a VPN for all remote connections.

Question 2

A risk manager is designing a third-party risk management program. Which THREE factors should be considered when determining the risk tier of a vendor?

Accepted Answer

The type of data the vendor will access. Data access, service criticality, and the vendor's security posture are key factors in risk tiering.

Answer

The vendor's physical location

Answer

The vendor's annual revenue

Question 3

A risk practitioner is designing a monitoring dashboard for operational risk. Which of the following is the most important consideration?

Accepted Answer

Tailor the information to the needs of the target audience.. The primary goal of a monitoring dashboard is to enable effective decision-making. Tailoring information to the target audience ensures that stakeholders receive relevant, actionable data, reducing cognitive load and preventing alert fatigue. Without this alignment, even the most technically sophisticated dashboard fails its core purpose of supporting risk-informed decisions.

Answer

Automate the generation of reports.

Answer

Use real-time data feeds.

Answer

Include all available risk indicators.

Question 4

The policy requiring TLS 1.2 or higher for all data transmissions is intended to enforce what security control?

Accepted Answer

Encryption in transit. The policy explicitly requires TLS 1.2 or higher for all data transmissions, which enforces encryption in transit. This ensures that data is protected from interception or tampering while moving across networks, as opposed to being stored (at rest) or managed via classification or access rules.

Answer

Data classification

Answer

Access control

Answer

Encryption at rest

Question 5

During an IT risk assessment for a new cloud-based customer relationship management (CRM) system, the risk practitioner identifies that the vendor's data center is located in a country with different data protection regulations. Which of the following is the MOST appropriate next step?

Accepted Answer

Conduct a legal review to assess regulatory implications and contractual safeguards.. When a cloud vendor's data center is in a jurisdiction with different data protection regulations, the immediate priority is to understand the legal and contractual implications before making any technical or risk acceptance decisions. A legal review will identify specific regulatory conflicts (e.g., GDPR vs. local law) and assess whether existing contractual safeguards (such as Standard Contractual Clauses or Binding Corporate Rules) adequately address the gap. This step ensures that subsequent risk treatment decisions are informed by compliance requirements rather than assumptions.

Answer

Recommend migrating to a different cloud provider.

Answer

Implement technical controls to encrypt data in transit and at rest.

Answer

Accept the risk because the vendor is compliant with industry standards.

Question 6

During a vendor risk tiering exercise, a vendor that stores the organization's customer PII and is critical for daily operations should be classified as which tier?

Accepted Answer

Critical. Vendors with access to sensitive data and high service criticality are typically classified as critical (highest tier).

Answer

Medium

Answer

High

Answer

Low

Question 7

Which TWO of the following are types of insider threats?

Accepted Answer

Malicious. Insider threats can be malicious (intentional harm) or negligent (unintentional mistakes).

Answer

Nation-state

Answer

Hacktivist

Answer

Script kiddie

Question 8

A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?

Accepted Answer

Categorize the risks. After identification, risks should be categorized to enable proper analysis and response. Categorization helps in understanding the nature of each risk and assigning ownership.

Answer

Assign risk owners

Answer

Determine risk response

Answer

Assess the inherent risk level

Question 9

When identifying vulnerabilities, which of the following is the BEST source for configuration-related vulnerabilities in operating systems?

Accepted Answer

CIS Benchmarks. CIS Benchmarks are industry-recognized configuration guidelines that help identify and remediate configuration-related vulnerabilities in operating systems. Unlike NVD or CVE which catalog known vulnerabilities, CIS Benchmarks provide actionable hardening steps for system configurations.

Answer

NVD

Answer

CVE database

Answer

OWASP Top 10

Question 10

A security team is using the STRIDE threat modeling methodology for a new web application. Which threat type under STRIDE would be MOST relevant to a SQL injection vulnerability?

Accepted Answer

Tampering. SQL injection allows an attacker to tamper with data, violating integrity. STRIDE includes Tampering as the threat that involves unauthorized modification of data.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing

Question 11

An organization is assessing risks related to a third-party cloud provider. Which of the following is the BEST source of threat intelligence for identifying threats targeting the cloud infrastructure?

Accepted Answer

ISACs. ISACs (Information Sharing and Analysis Centers) provide sector-specific threat intelligence and can share information about threats targeting cloud infrastructure relevant to the organization's industry.

Answer

Government advisories

Answer

OSINT

Answer

Commercial feeds

Question 12

During a threat modeling exercise using the STRIDE methodology, a security analyst identifies a threat where an attacker can modify data in transit between a web server and database. Which STRIDE category does this threat belong to?

Accepted Answer

Tampering. Tampering involves unauthorized modification of data, which is the 'T' in STRIDE.

Answer

Repudiation

Answer

Spoofing

Answer

Information Disclosure

Question 13

A risk practitioner is categorizing IT risks for a manufacturing company. Which of the following risks would be classified as an 'operational' IT risk?

Accepted Answer

Risk of production line downtime due to a server failure. Operational IT risks relate to the day-to-day functioning of IT systems and processes. Production line downtime due to a system failure directly impacts operations.

Answer

Risk of financial loss from a ransomware payment

Answer

Risk of non-compliance with GDPR for customer data stored in the EU

Answer

Risk of reputational damage from a data breach

Question 14

During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?

Accepted Answer

It is tailored for use in agile and DevOps environments. VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.

Answer

It requires detailed system architecture upfront

Answer

It replaces the need for vulnerability scanning

Answer

It focuses on compliance requirements only

Question 15

An organization uses the PASTA threat modeling methodology. In which stage would the team identify threat agents and their capabilities?

Accepted Answer

Threat analysis. PASTA's third stage involves profiling threat agents and their capabilities.

Answer

Define objectives

Answer

Vulnerability analysis

Answer

Decompose application

Question 16

A risk practitioner is using the TRIKE threat modeling methodology. Which TWO of the following are characteristics of TRIKE?

Accepted Answer

It is a requirements-based model. TRIKE is requirements-based and uses actor- and asset-centric views.

Answer

It is designed for analyzing denial-of-service threats

Answer

It is a visual, agile methodology for DevSecOps

Answer

It focuses on attack trees and threat libraries

Question 17

Which threat modeling technique is specifically designed to be integrated into Agile and DevSecOps processes, providing a visual and simple approach?

Accepted Answer

VAST. VAST (Visual Agile and Simple Threat) is tailored for Agile and DevSecOps environments, emphasizing simplicity and visual representation.

Answer

TRIKE

Answer

PASTA

Answer

STRIDE

Question 18

A financial institution uses threat intelligence from an Information Sharing and Analysis Center (ISAC). This is an example of which type of threat intelligence source?

Accepted Answer

ISAC. ISACs are industry-specific, trusted communities for sharing threat intelligence.

Answer

Open-source intelligence (OSINT)

Answer

Government advisories

Answer

Commercial feeds

Question 19

Which of the following is a detective control?

Accepted Answer

Intrusion detection system. Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.

Answer

Data encryption

Answer

Backup and restore

Answer

Firewall

Question 20

In the FAIR framework, loss magnitude (LM) is composed of primary loss and secondary loss. Which of the following is an example of secondary loss?

Accepted Answer

Lost business due to reputation damage. Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.

Answer

Incident response costs

Answer

Legal notification costs

Answer

System restoration expenses