CRISC Practice Exam 51 — 20 Questions

Question 1

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Controls are effective in reducing the risk level. Inherent risk of 25 (5×5 matrix, maximum) dropping to residual risk of 9 after control evaluation demonstrates that the controls materially reduced the risk exposure. A reduction from 25 to 9 is significant, indicating the controls are functioning as intended to mitigate the identified threat. This is the standard interpretation in CRISC risk analysis.

Answer

Additional controls are unnecessary

Answer

Controls are not effective because residual risk remains

Answer

The inherent risk was overestimated

Question 2

A risk practitioner is asked to reduce the number of KRIs tracked from 50 to 20. Which KRIs should be prioritized for removal?

Accepted Answer

KRIs that are not directly mapped to any risk in the risk register. KRIs that are not directly mapped to any risk in the risk register provide no actionable insight for risk monitoring or decision-making. Removing them reduces noise and ensures the remaining 20 KRIs are all linked to specific risks, which is essential for effective risk-based reporting and resource allocation.

Answer

KRIs that have been consistently below threshold for two years

Answer

KRIs that require manual data collection

Answer

KRIs that have high volatility

Question 3

An organization is evaluating cyber insurance options. Which of the following factors is MOST likely to influence the insurance premium?

Accepted Answer

The organization's cybersecurity maturity and incident history. An organization's cybersecurity maturity and incident history (C) is the most direct factor influencing cyber insurance premiums because insurers assess the likelihood and potential cost of a claim based on the organization's security controls, past breaches, and risk management practices. A mature security posture with few incidents lowers the perceived risk and therefore the premium.

Answer

The organization's annual revenue

Answer

The number of employees in the IT department

Answer

The organization's credit rating

Question 4

During a risk identification workshop, the team identifies several vulnerabilities. Which TWO of the following are examples of operational vulnerability identification? (Select two.)

Accepted Answer

Inadequate access control review process. Operational vulnerability identification focuses on weaknesses in day-to-day processes, procedures, and human/administrative controls rather than specific technical flaws in systems or code. Option A, an inadequate access control review process, is correct because it is a procedural/process weakness—failing to periodically review who has access means operational controls are not being maintained, which is a classic operational vulnerability. Option D, weak password policy enforcement, is correct because it reflects a failure in enforcing an administrative/operational control (e.g., not applying complexity, rotation, or lockout rules), which is a process and governance issue rather than a single technical defect. By contrast, option B (outdated firewall firmware) and option C (missing security patches on servers) are technical vulnerabilities tied to unpatched software/hardware, and option E (SQL injection in the web application) is a technical application flaw, so they fall under technical rather than operational vulnerability identification.

Answer

Outdated firewall firmware

Answer

Missing security patches on servers

Answer

SQL injection vulnerability in the web application

Question 5

In developing a risk scenario, connecting a threat event to business impact is crucial. Which of the following is the BEST example of a properly connected risk scenario?

Accepted Answer

A DDoS attack causes website unavailability for 4 hours, resulting in $500,000 lost sales and customer churn.. A properly connected risk scenario must link a specific threat event to a quantified or clearly articulated business impact. Option D does this precisely: a DDoS attack (threat event) causes website unavailability for 4 hours (operational impact) resulting in $500,000 lost sales and customer churn (financial and reputational business impact). This chain from threat to measurable business consequence is what CRISC expects in risk scenario development.

Answer

A firewall misconfiguration allows unauthorized access, causing a security incident.

Answer

A ransomware attack encrypts files, leading to IT department overtime.

Answer

An insider steals data, leading to legal fees.

Question 6

Which of the following is a key characteristic of a well-maintained risk register?

Accepted Answer

It is updated regularly to reflect changes. A well-maintained risk register must be a living document that is updated regularly to reflect changes in the internal and external environment, such as new threats, changes in business processes, or the effectiveness of risk responses. This ensures that risk information remains current and relevant for decision-making. Regular updates enable timely risk response and support continuous risk monitoring, which is a core principle of risk management frameworks like COSO ERM and ISO 31000.

Answer

It is maintained solely by the IT department

Answer

It is static and reviewed annually

Answer

It includes only high-impact risks

Question 7

After a data breach has been contained, what is the most important action for identifying underlying IT risks?

Accepted Answer

Perform a root cause analysis. Root cause analysis systematically identifies the weaknesses that allowed the breach, directly contributing to risk identification. Updating the risk register, implementing controls, and reviewing insurance are subsequent steps.

Answer

Update the risk register

Answer

Implement new security controls

Answer

Review cyber insurance policy

Question 8

Which TWO of the following are examples of risk avoidance?

Accepted Answer

Migrating to a different technology platform. Risk avoidance means eliminating the activity or exposure that creates the risk entirely, rather than mitigating, transferring, or accepting it. Option D (Migrating to a different technology platform) is correct because replacing a vulnerable or risky platform removes the exposure associated with the original technology, thereby avoiding the risk rather than merely reducing it. Option E (Discontinuing a high-risk business process) is correct because ceasing the process altogether eliminates the risk source, which is the defining characteristic of risk avoidance. Option A (Implementing a firewall) is incorrect because a firewall is a risk mitigation control that reduces likelihood or impact while the underlying activity continues. Option B (Purchasing cyber insurance) is incorrect because it transfers financial risk to an insurer, not avoids it. Option C (Accepting the risk) is incorrect because acceptance means retaining the risk with no action to eliminate it, which is the opposite of avoidance.

Answer

Implementing a firewall

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Question 9

An organization has a risk appetite statement that says 'We accept up to $5 million in operational losses per year.' However, a new cloud migration project is estimated to have a potential operational loss of $8 million if a critical failure occurs. The risk capacity of the organization is $20 million. What should the risk practitioner recommend?

Accepted Answer

Implement risk treatment measures to reduce the potential loss to below $5 million. The risk appetite statement sets a clear threshold of $5 million in acceptable operational losses per year. The project's potential loss of $8 million exceeds this appetite, so the risk practitioner should recommend risk treatment measures to bring the potential loss within the appetite. This aligns with the risk management principle of modifying risk to align with organizational risk tolerance before accepting or rejecting a project outright.

Answer

Reject the project because the risk exceeds the risk appetite

Answer

Increase the risk appetite to $8 million to align with the project

Answer

Accept the risk because the risk capacity is $20 million

Question 10

A quantitative risk analysis using FAIR requires estimating which THREE primary factors?

Accepted Answer

Vulnerability. In FAIR (Factor Analysis of Information Risk), the primary factors estimated for quantitative risk analysis are threat event frequency (D), vulnerability (B), and loss magnitude (C). Threat event frequency (D) captures how often a threat agent is expected to act against an asset, which drives the likelihood side of the risk equation. Vulnerability (B) is the probability that a threat event becomes a loss event, given the resistance strength of the asset's controls, and it modifies threat event frequency into loss event frequency. Loss magnitude (C) represents the probable financial impact per loss event, combining primary and secondary loss forms, and it is multiplied by loss event frequency to produce annualized loss exposure. Risk appetite (A) is a governance-level tolerance statement rather than a FAIR-estimated factor, and control cost (E) is an input to cost-benefit analysis of mitigations, not one of the three primary FAIR estimation factors.

Answer

Risk appetite

Answer

Control cost

Question 11

Which THREE of the following are common consequences in an IT risk scenario?

Accepted Answer

Financial loss. In IT risk scenarios, a common consequence is financial loss (A), because incidents such as data breaches, downtime, or fraud directly incur remediation costs, lost revenue, and legal fees. A regulatory penalty (D) is also a standard consequence, since failures to comply with laws or standards like GDPR, HIPAA, or PCI DSS can result in fines and sanctions. Reputational damage (E) is likewise a typical consequence, as publicized security or availability failures erode customer trust and brand value. By contrast, increased market share (B) and employee satisfaction (C) are generally positive business outcomes, not consequences of risk events, so they do not belong in this list.

Answer

Increased market share

Answer

Employee satisfaction

Question 12

An organization is integrating IT risk into its enterprise risk management (ERM) program. Which TWO of the following are key benefits of this integration?

Accepted Answer

Ensures IT risk is considered in strategic decisions. Option D is correct because integrating IT risk into ERM ensures that technology-related exposures are evaluated alongside financial, operational, and strategic risks when leadership makes strategic decisions, so IT risk becomes part of governance rather than a siloed technical concern. Option E is correct because ERM integration establishes common risk terminology, scales, and criteria (for example, shared likelihood/impact definitions and risk appetite statements), giving the whole organization a consistent risk language for identifying, assessing, and reporting IT and non-IT risks. Option A is incorrect because integration does not inherently reduce the organization's risk appetite; risk appetite is set by leadership and integration only helps align IT risk with it. Option B is incorrect because IT risk still requires its own reporting detail and metrics even when aggregated into ERM. Option C is incorrect because no framework guarantees that all IT risks are mitigated; integration improves visibility and prioritization, not elimination of all risk.

Answer

Reduces the overall risk appetite of the organization

Answer

Eliminates the need for separate IT risk reporting

Answer

Guarantees that all IT risks are mitigated

Question 13

A risk manager is assessing IT/OT convergence risks at a manufacturing plant. Which TWO of the following are primary risks introduced by connecting industrial control systems to the corporate network?

Accepted Answer

Attack path expansion from IT to OT. Option A (Attack path expansion from IT to OT) is correct because bridging the corporate network with industrial control systems creates a conduit through which IT-side threats—such as compromised business workstations, phishing footholds, or lateral-movement tools like PsExec—can pivot into OT environments that were previously air-gapped or isolated behind a DMZ, dramatically widening the adversary's reachable attack surface. Option D (Legacy system vulnerabilities exposed) is correct because many ICS/SCADA devices and protocols (e.g., Modbus, DNP3, older Siemens/Rockwell PLCs) were designed without authentication, encryption, or patchability, so once reachable from corporate subnets their unpatched CVEs become exploitable in ways that were not possible under physical segmentation. Option B is not a primary convergence risk—convergence is typically pursued to improve efficiency through better data visibility and analytics, not to reduce it. Option C is incorrect because increased data storage costs are an incidental IT budgeting concern, not a security risk introduced by IT/OT connectivity. Option E is incorrect because simplified remote access is generally a business benefit of convergence (enabling remote monitoring and diagnostics), even though it must be secured; it is not itself a primary risk introduced by the connection.

Answer

Reduced operational efficiency

Answer

Increased data storage costs

Answer

Simplified remote access

Question 14

A global company is moving its critical applications to a public cloud. Which THREE of the following are key risk considerations in the shared responsibility model?

Accepted Answer

Identity and access management. In the shared responsibility model, the cloud provider secures the physical infrastructure, while the customer remains responsible for securing what they put in the cloud. Option B (Identity and access management) is correct because the customer must manage their own users, roles, permissions, and authentication mechanisms (e.g., IAM policies, MFA) to prevent unauthorized access to cloud resources. Option C (Compliance with regulatory requirements for data handling) is correct because the customer is accountable for ensuring that data stored and processed in the cloud meets applicable laws and standards such as GDPR, HIPAA, or PCI DSS, even though the provider may offer compliant infrastructure. Option D (Data encryption and key management) is correct because protecting data at rest and in transit, along with managing encryption keys (e.g., via KMS or customer-managed keys), is a customer responsibility in the shared model. Option A (Physical security of data centers) is not a customer risk consideration because the cloud provider is responsible for physical security of its facilities. Option E (Network firewall configuration) is not marked correct because, while customers often manage firewalls and security groups, the question asks for key risk considerations in the shared responsibility model, and firewall configuration is a specific control rather than a broad risk category like IAM, compliance, or encryption/key management.

Answer

Physical security of data centers

Answer

Network firewall configuration

Question 15

An organization is performing a business impact analysis (BIA) for its critical applications. Which TWO of the following are primary objectives of a BIA?

Accepted Answer

Prioritize recovery of business processes based on criticality.. Option A is correct because a core purpose of the BIA is to rank business processes and their supporting applications by criticality, so that recovery efforts and resources are directed to the most essential functions first. Option C is correct because the BIA establishes the maximum acceptable outage (MAO), also expressed as maximum tolerable downtime (MTD), which defines how long a process can be unavailable before unacceptable impact occurs and drives the RTO/RPO targets. Option B is not a BIA objective; threat likelihood estimation belongs to risk assessment, not impact analysis. Option D is not a BIA objective; ALE is a quantitative risk calculation (SLE × ARO) performed during risk analysis. Option E is not a BIA objective; selecting risk response strategies (avoid, mitigate, transfer, accept) is part of risk treatment, which follows the assessment.

Answer

Determine the likelihood of each threat event.

Answer

Calculate the annualized loss expectancy (ALE).

Answer

Select appropriate risk response strategies.

Question 16

A risk practitioner is developing risk scenarios for a new cloud service. Which THREE of the following elements should be included in a complete risk scenario?

Accepted Answer

Threat event. A complete risk scenario must describe the threat event (A), i.e., the specific incident or action that could occur (such as data breach, service outage, or misconfiguration), because it defines what risk is being assessed. It must also identify the threat actor (B), the party or source capable of causing the event (e.g., malicious insider, external attacker, or accidental user), since likelihood and motivation depend on who or what triggers it. The consequence (C) is equally essential, as it captures the resulting business impact or harm (e.g., financial loss, regulatory penalty, reputational damage) that the scenario is meant to evaluate. Response plan (D) and detection mechanism (E) are controls or mitigation elements, not core components of the risk scenario itself; they belong to risk treatment and monitoring rather than scenario definition.

Answer

Response plan

Answer

Detection mechanism

Question 17

Which TWO methods are commonly used for continuous monitoring of IT controls?

Accepted Answer

SIEM rules for automated testing. SIEM rules for automated testing (A) are correct because SIEM platforms continuously correlate and analyze log and event data against detection rules, providing real-time, automated monitoring of IT controls such as access violations, configuration changes, and policy breaches. Vulnerability scanning (D) is correct because it is run on a recurring, often automated schedule to continuously identify weaknesses in systems and applications, feeding ongoing control-monitoring and remediation processes. Board risk review (B) is not continuous monitoring; it is a periodic governance activity conducted at scheduled intervals. Annual control self-assessment (C) is a point-in-time, yearly exercise and therefore not continuous. Quarterly internal audit (E) is a periodic assurance activity performed at defined intervals, not real-time or continuous monitoring.

Answer

Board risk review

Answer

Annual control self-assessment

Answer

Quarterly internal audit

Question 18

Which THREE of the following are valid risk identification methods according to ISACA's Risk IT Framework? (Select exactly 3.)

Accepted Answer

Scenario analysis. Scenario analysis (B) is a valid risk identification method in ISACA's Risk IT Framework because it explores plausible future events and their potential impact on IT objectives, helping surface risks that routine monitoring might miss. SWOT analysis (D) is also valid, as it systematically examines internal strengths and weaknesses plus external opportunities and threats to identify risks affecting IT strategy and operations. Brainstorming (E) is likewise a recognized identification technique, using structured group discussion to elicit a broad range of potential IT risk events from stakeholders. Segregation of duties (A) is a preventive control that reduces fraud and error risk rather than a method for identifying risks, and risk acceptance (C) is a risk response option in the Risk IT process, not an identification technique.

Answer

Segregation of duties

Answer

Risk acceptance

Question 19

A risk manager is evaluating the risk of quantum computing for the organization's encryption. The organization uses RSA-2048 for data encryption. What is the PRIMARY consideration in planning for post-quantum cryptography migration?

Accepted Answer

The timeline for quantum computers to break RSA-2048. Quantum computers capable of breaking RSA-2048 are not expected within the next few years, so the primary consideration is the timeline for quantum advantage to prioritize migration efforts.

Answer

The cost of new encryption algorithms

Answer

The availability of quantum-resistant hardware

Answer

The performance impact of post-quantum algorithms

Question 20

Which THREE of the following control monitoring techniques are considered continuous monitoring?

Accepted Answer

Automated logging and alerting from SIEM tools. Automated logging and alerting from SIEM tools is considered continuous monitoring because SIEM systems ingest and analyze log data in near real-time, generating alerts for suspicious activities as they occur. This provides ongoing, automated oversight of security events rather than periodic review.

Answer

Quarterly internal control self-assessments

Answer

Annual penetration testing