CRISC Practice Exam 52 — 20 Questions

Question 1

During a risk identification workshop, the team identifies a potential data leakage from a legacy system. What is the FIRST step the risk owner should take?

Accepted Answer

Document the risk and its source. The first step for the risk owner is to formally document the risk and its source. This ensures that the identified data leakage from the legacy system is captured in the risk register, establishing a baseline for analysis and treatment. Without documentation, subsequent steps like risk scoring, control implementation, or escalation cannot be properly justified or tracked.

Answer

Implement encryption immediately

Answer

Assign a risk score

Answer

Report to senior management

Question 2

Which of the following is the PRIMARY purpose of a risk register in the risk identification phase?

Accepted Answer

Document identified risks and their characteristics. The primary purpose of a risk register during the risk identification phase is to systematically document each identified risk along with its key characteristics, such as the risk description, cause, impact, and potential triggers. This foundational record ensures that all risks are captured before any subsequent analysis or response planning occurs, aligning with the CRISC domain of IT Risk Identification.

Answer

Assign risk owners

Answer

Calculate risk scores

Answer

Track remediation progress

Question 3

A risk practitioner is reviewing system logs and notices multiple failed login attempts from a foreign IP address. This observation is an example of which type of risk identification activity?

Accepted Answer

Incident and event monitoring. The observation of multiple failed login attempts from a foreign IP address is a direct result of reviewing system logs, which is a core component of incident and event monitoring. This activity involves the continuous surveillance of security events to detect anomalies, such as brute-force attacks, and is a reactive risk identification technique that identifies risks based on actual occurrences.

Answer

Control self-assessment

Answer

Threat intelligence gathering

Answer

Vulnerability scanning

Question 4

A risk analyst is reviewing monthly control test results. One control failed testing twice in a row. What is the FIRST step the analyst should take?

Accepted Answer

Perform a root cause analysis of the control failure.. The first step when a control fails testing twice in a row is to perform a root cause analysis (RCA) to understand why the failure occurred. Without identifying the underlying cause, any corrective action or reporting would be premature and could lead to ineffective remediation. This aligns with the CRISC focus on proactive risk monitoring and control improvement before escalating or updating risk ratings.

Answer

Report the failure in the next risk report to management.

Answer

Update the risk register with a higher inherent risk rating.

Answer

Escalate the failure to the risk committee immediately.

Question 5

A risk assessment reveals a high inherent risk that is within the organization's risk appetite. The risk owner documents the risk and formally accepts it. This is an example of which risk treatment option?

Accepted Answer

Accept. When a risk is within appetite, it may be formally accepted with sign-off.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 6

During a risk assessment, an organization identifies that its legacy ERP system has a high likelihood of failure during peak transaction periods. The system supports critical financial operations. The risk owner proposes to upgrade the system, but the project would take 18 months and require significant capital investment. The CEO questions whether the risk can be reduced to an acceptable level more quickly. Which of the following is the MOST appropriate immediate risk response?

Accepted Answer

Implement enhanced monitoring and manual fallback procedures.. Enhanced monitoring and manual fallback procedures directly address the immediate risk of system failure during peak periods by providing early detection and a contingency plan to maintain critical financial operations. This response can be implemented quickly without the 18-month timeline and capital investment required for a full system upgrade, aligning with the CEO's request for a faster risk reduction.

Answer

Increase cyber insurance coverage.

Answer

Accept the risk and budget for potential losses.

Answer

Outsource the ERP hosting to a cloud provider.

Question 7

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Accepted Answer

Risk reduction by implementing redundant systems. Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Answer

Risk avoidance by decommissioning the system

Answer

Risk transfer through cyber insurance

Answer

Risk acceptance because mitigation is too costly

Question 8

A financial institution is implementing a new continuous monitoring solution for its transaction processing systems. The solution generates alerts for suspicious activities. Which TWO of the following are essential considerations when defining the alert thresholds?

Accepted Answer

Historical transaction patterns and baseline deviations. Historical transaction patterns and baseline deviations (B) are essential because alert thresholds must be calibrated to normal behavior to minimize false positives and false negatives. Without understanding typical transaction volumes, values, and frequencies, the monitoring solution cannot distinguish legitimate activity from suspicious anomalies, rendering alerts meaningless.

Answer

Cost of the monitoring solution

Answer

Vendor reputation for support

Answer

Number of employees in the monitoring team

Question 9

Which THREE of the following are key components of an effective risk treatment plan?

Accepted Answer

Assigned responsibilities. Assigned responsibilities are a key component of an effective risk treatment plan because they ensure accountability for implementing specific risk mitigation actions. Without clear ownership, tasks may be delayed or overlooked, undermining the plan's execution. This aligns with the CRISC framework's emphasis on defining roles to operationalize risk response.

Answer

The risk owner's signature

Answer

A detailed budget

Question 10

A risk assessment identifies a high likelihood of a data breach due to insecure APIs. The risk team proposes disabling the APIs until they are secured, implementing a WAF, and purchasing breach insurance. Which THREE risk response options are being considered?

Accepted Answer

Transfer. (Transfer) is correct because purchasing breach insurance transfers the financial risk of a data breach to an insurance provider. Option C (Avoid) is correct because disabling the APIs until they are secured eliminates the risk entirely by removing the vulnerable component. Option D (Mitigate) is correct because implementing a Web Application Firewall (WAF) reduces the likelihood or impact of an API-based attack without removing the API.

Answer

Remediate

Answer

Accept

Question 11

A company is evaluating controls for a high-risk process. Which control type is designed to stop a risk event from occurring?

Accepted Answer

Preventive. A preventive control is designed to stop a risk event from occurring by implementing barriers or safeguards before the event can happen. For a high-risk process, this might include access control lists (ACLs) on a firewall that block unauthorized traffic, or input validation routines in an application that reject malformed data before it can trigger a buffer overflow. By proactively eliminating the threat vector, preventive controls reduce the likelihood of the risk event to zero for the protected path.

Answer

Detective

Answer

Corrective

Answer

Compensating

Question 12

An organization is using the FAIR framework to perform a quantitative risk analysis for a data breach scenario. Which TWO of the following are components of the Annualized Loss Expectancy (ALE) calculation in FAIR?

Accepted Answer

Loss Event Frequency (LEF). In FAIR, ALE is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM), so option B (Loss Event Frequency) and option D (Loss Magnitude) are the two correct components. LEF represents how often a loss event is expected to occur per year, while LM represents the probable magnitude of loss from a single event, and their product yields the annualized loss expectancy. Option A (ARO) and option C (SLE) belong to the classic SLE × ARO = ALE formula, not to FAIR's terminology, even though they are conceptually related. Option E (Exposure Factor) is an input used to derive SLE in the traditional formula (SLE = AV × EF) and is not a direct component of FAIR's ALE calculation.

Answer

Annualized Rate of Occurrence (ARO)

Answer

Single Loss Expectancy (SLE)

Answer

Exposure Factor (EF)

Question 13

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Accepted Answer

High. Risk score = 3 × 4 = 12, which falls in the high range (12-25).

Answer

Critical

Answer

Medium

Answer

Low

Question 14

A company has identified that its legacy financial system has a high inherent risk due to outdated architecture. The system cannot be replaced for three years. What is the best risk treatment strategy?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring.. When a legacy system cannot be replaced for three years, the most effective risk treatment is to reduce the likelihood and impact of exploitation through compensating controls. Network segmentation limits lateral movement from the legacy system, and enhanced monitoring (e.g., SIEM with custom rules for anomalous traffic) provides early detection of compromise. This aligns with the ISACA risk treatment principle of risk reduction when avoidance or transfer is not feasible.

Answer

Accept the risk and allocate contingency funds for potential incidents.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Avoid the risk by discontinuing the system immediately.

Question 15

A manufacturing company is integrating its operational technology (OT) network with the corporate IT network to enable real-time data analytics. Which of the following risks should be prioritized during the risk assessment?

Accepted Answer

Attack path expansion from IT to OT networks. Integrating OT and IT networks creates a new attack path from the IT network to the OT network. Since OT systems often lack modern security controls and run legacy protocols (e.g., Modbus, DNP3), an attacker who compromises the IT network can pivot into the OT environment, potentially disrupting physical processes. This risk is prioritized because it introduces a direct, high-impact threat to safety and availability that did not exist before the integration.

Answer

Incompatibility of IT and OT software versions

Answer

Increased latency in OT communications

Answer

Loss of data integrity in analytics dashboards

Question 16

In the FAIR framework, what does Loss Event Frequency (LEF) represent?

Accepted Answer

The expected number of loss events per year. LEF is the product of Threat Event Frequency (TEF) and Vulnerability (V), representing how often a loss event is expected to occur.

Answer

The number of threat events per year

Answer

The probability that a threat event will result in a loss

Answer

The total financial loss per event

Question 17

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

Accepted Answer

Risk Mitigation. The firewall rule denies inbound traffic on TCP port 443 (HTTPS) from any source to any destination. This directly reduces the attack surface by blocking a specific protocol, which is a classic risk mitigation action. By implementing a technical control to reduce the likelihood or impact of a threat, the organization is applying risk mitigation, not transferring, accepting, or avoiding the risk entirely.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 18

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

Provide early warning of changing risk levels. The primary purpose of a Key Risk Indicator (KRI) is to provide an early warning of changing risk levels, enabling proactive risk management before an adverse event occurs. KRIs track specific metrics that signal shifts in risk exposure, such as the number of unpatched critical vulnerabilities or failed login attempts, allowing organizations to adjust controls or resources in advance. This forward-looking function distinguishes KRIs from lagging indicators like control effectiveness metrics or incident logs.

Answer

Measure the effectiveness of controls

Answer

Document historical incidents

Answer

Comply with regulatory requirements

Question 19

An organization uses a quantitative risk analysis method. The annualized loss expectancy (ALE) for a specific risk is calculated as $500,000. The cost of implementing a control is $150,000 per year, and it is expected to reduce the ALE by 80%. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The current ALE is $500,000. An 80% reduction means the ALE decreases by $400,000, resulting in a new ALE of $100,000. The annual control cost is $150,000. The net benefit is the reduction in ALE ($400,000) minus the control cost ($150,000), which equals $250,000. Option C is correct because it correctly calculates the net benefit as the risk reduction minus the control cost.

Answer

$50,000

Answer

$400,000

Answer

$350,000

Question 20

Which THREE of the following are key considerations when selecting a risk response option?

Accepted Answer

Cost-benefit analysis of controls. A cost-benefit analysis of controls (Option A) is a key consideration because it ensures that the cost of implementing a risk response (e.g., a technical control like an intrusion prevention system or encryption) does not exceed the value of the asset being protected or the expected reduction in risk. This aligns with the principle of cost-effective risk mitigation, where the residual risk must be acceptable relative to the investment.

Answer

Impact of the risk without controls

Answer

Current control effectiveness