CRISC Practice Exam 53 — 20 Questions

Question 1

An organization is evaluating cyber insurance to cover potential losses from ransomware attacks. The insurer requires that the organization have multi-factor authentication (MFA) on all remote access systems. This requirement is an example of which factor influencing insurance premiums?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Premium factors. Insurers assess the organization's security controls to determine risk level; MFA is a control that reduces risk, thus affecting premiums positively.

Answer

Coverage scope

Answer

Incident prerequisites

Answer

Exclusions

Question 2

According to COBIT 2019, which governance objective is primarily concerned with evaluating, directing, and monitoring the management of IT risk?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the governance objective that focuses on evaluating, directing, and monitoring risk management to ensure the enterprise's risk appetite and risk tolerance are understood and articulated.

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 3

Which THREE of the following are key considerations when evaluating cyber insurance coverage? (Select three.)

Accepted Answer

Exclusions for acts of war or state-sponsored attacks. Cyber insurance policies have specific coverage scopes, exclusions (e.g., war, negligence), and prerequisites (e.g., multi-factor authentication). Premium factors like security controls also affect cost.

Answer

Company's stock price volatility

Answer

Office location and building security

Question 4

Which of the following is a key component of an IT risk management programme design?

Accepted Answer

Risk assessment methodology. A risk assessment methodology defines the process for identifying, analyzing, and evaluating risks, which is a core component of any risk management programme.

Answer

Incident response playbooks

Answer

Vendor security assessment reports

Answer

Network topology diagrams

Question 5

A vendor risk tier is assigned based on data access and service criticality. A vendor that processes sensitive customer data and is critical to operations should be classified as which tier?

Accepted Answer

Critical tier. A vendor that processes sensitive customer data and is critical to operations poses the highest level of risk to the organization. Under the CRISC framework, such a vendor is classified as Critical tier because the combination of high data sensitivity and operational criticality requires the most stringent risk management controls, including enhanced due diligence, continuous monitoring, and contractual safeguards. This tier ensures that the highest priority vendors receive the most rigorous oversight to mitigate potential impacts on confidentiality, integrity, and availability.

Answer

High tier

Answer

Low tier

Answer

Medium tier

Question 6

In assessing control effectiveness, an IS auditor evaluates both design adequacy and operating effectiveness. Which of the following indicates that a control is operating effectively?

Accepted Answer

The control has been tested and works as designed. Operating effectiveness means the control has been tested and consistently produces the intended result in practice. Even if a control is well-designed, it may fail during actual operation due to misconfiguration, human error, or environmental changes. Testing confirms that the control functions as designed under real conditions, which is the definitive indicator of operating effectiveness.

Answer

The control is approved by management

Answer

The control is inexpensive to implement

Answer

The control is documented in policy

Question 7

Which THREE of the following are key components of an effective risk reporting framework?

Accepted Answer

Consistent risk metrics across the organization.. Consistent risk metrics across the organization (Option B) are a key component of an effective risk reporting framework because they ensure that risk data is comparable and aggregated meaningfully across different business units and systems. Without standardized metrics, reports would be inconsistent, making it impossible to assess overall risk posture or identify trends reliably.

Answer

Automated collection of risk data from all sources.

Answer

Statistical models for predicting future risks.

Question 8

A company is prioritizing risk treatment actions. Which THREE factors should be considered when prioritizing risks?

Accepted Answer

Cost-benefit analysis of controls. Cost-benefit analysis ensures that the resources invested in controls are justified by the reduction in risk, which is a core principle of risk management. Without this analysis, an organization might over-invest in low-impact risks or under-invest in high-impact ones, leading to inefficient allocation of budget and effort.

Answer

Industry best practices

Answer

Number of vulnerabilities

Question 9

Refer to the exhibit. A risk analyst is reviewing an AWS S3 bucket policy. What is the MOST significant control monitoring gap in this policy?

Accepted Answer

The policy lacks auditing or logging of access attempts.. The policy only restricts to internal IP range and requires HTTPS, but it does not log access attempts. Without logging, unauthorized attempts cannot be monitored. Option A is wrong because HTTPS is required. Option B is wrong because internal IP range is allowed. Option C is wrong because Deny for non-HTTPS is present, but logging is missing.

Answer

The policy does not restrict access to specific internal IPs.

Answer

The policy allows HTTPS access from any internal IP.

Answer

The policy denies non-HTTPS access but does not enforce encryption for allowed access.

Question 10

When implementing a new access control system, which activity is essential during the change management process?

Accepted Answer

Updating the system documentation and user manuals. Updating relevant documentation ensures that the change is properly recorded and that operational procedures remain accurate.

Answer

Removing all legacy controls

Answer

Assigning control ownership to external vendors

Answer

Disabling audit logs to save storage

Question 11

An architecture review board (ARB) is evaluating a new solution architecture that processes sensitive data. Which of the following should the ARB review to ensure security risks are addressed before implementation?

Accepted Answer

Threat model and security controls. The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Answer

User acceptance test plan

Answer

Business case and ROI analysis

Answer

Project timeline and budget

Question 12

A critical infrastructure organization is enhancing its threat identification capabilities. The risk team wants to leverage threat intelligence sources to identify emerging threats. Which THREE sources are most relevant for obtaining actionable threat intelligence?

Accepted Answer

OSINT (Open Source Intelligence). OSINT provides open-source threat data, ISACs offer sector-specific intelligence, and government advisories (e.g., CISA KEV) provide authoritative information on exploited vulnerabilities. Commercial feeds are useful but not always actionable or free.

Answer

Commercial threat feeds

Answer

Social media monitoring

Question 13

Which THREE of the following are valid risk response options according to the ISACA risk management framework? (Select 3)

Accepted Answer

Mitigate the risk through controls. Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk to an acceptable level. In the ISACA framework, this is a primary risk response option, often achieved through technical controls like firewalls, encryption, or access management systems.

Answer

Enhance the risk to gain strategic advantage

Answer

Monitor the risk without taking action

Question 14

A new privacy regulation requires that all personal data be encrypted at rest. The current systems lack encryption. The cost to implement encryption is moderate, and the risk of non-compliance is high. Which risk response is most appropriate?

Accepted Answer

Mitigate by implementing encryption. (Mitigate by implementing encryption) is the most appropriate risk response because it directly addresses the risk of non-compliance with the privacy regulation by applying a moderate-cost control. The high risk of non-compliance makes acceptance (B) unsuitable; avoidance (C) by discontinuing processing is overly drastic and not cost-effective; and transfer (D) via insurance does not fulfill the regulatory requirement to encrypt at rest.

Answer

Accept the risk

Answer

Avoid by discontinuing data processing

Answer

Transfer via cyber insurance

Question 15

A large e-commerce company is assessing the risk of a distributed denial-of-service (DDoS) attack on its web applications. The company has experienced three DDoS attacks in the past year, each causing significant downtime and revenue loss. The current mitigation strategy relies on an on-premise appliance that can handle up to 10 Gbps of attack traffic. Recent industry reports indicate that DDoS attacks are growing in volume and sophistication, with some exceeding 100 Gbps. The company's risk appetite for availability is moderate. The security team has proposed migrating to a cloud-based DDoS protection service that scales to 200 Gbps, but it will increase annual operational costs by 40%. The business is concerned about the cost increase. Which of the following is the BEST risk treatment decision?

Accepted Answer

Reduce the risk by implementing the cloud-based DDoS protection service, accepting the cost increase.. The current on-premise appliance (10 Gbps capacity) is insufficient against modern DDoS attacks that can exceed 100 Gbps, as noted in industry reports. Migrating to a cloud-based DDoS protection service that scales to 200 Gbps directly reduces the risk to a level aligned with the company's moderate risk appetite for availability, despite the 40% cost increase. The business concern about cost is secondary to the necessity of mitigating a risk that could cause catastrophic revenue loss, and the cloud service provides elastic scalability that an on-premise upgrade cannot match.

Answer

Transfer the risk by purchasing business interruption insurance that covers revenue loss during outages.

Answer

Accept the risk because the company has survived previous attacks and the cost of mitigation is high.

Answer

Reduce the risk by upgrading the on-premise appliance to handle up to 50 Gbps, which is within budget.

Question 16

Refer to the exhibit. If the control objective is to prevent unauthorized access via MFA, what does this test result indicate?

Accepted Answer

The control is effective for the sample but may not be for the population.. The test result is based on a sample of 30 logins, so it indicates effectiveness for that sample but cannot guarantee effectiveness for the entire population. Option A is wrong because the sample size alone does not determine ineffectiveness; it is about the sample's representativeness. Option B is wrong because a single sample cannot prove full effectiveness. Option C is wrong because the test does not assess whether MFA is required for all users; it tests operational effectiveness for the sampled logins.

Answer

The control is ineffective because only 30 logins were sampled.

Answer

The control is fully effective.

Answer

The control is effective only if MFA is required for all users.

Question 17

Which of the following is the PRIMARY benefit of using a risk register for monitoring?

Accepted Answer

Centralized repository of all risks.. The primary benefit of a risk register for monitoring is that it serves as a centralized repository for all identified risks, enabling consistent tracking, prioritization, and reporting. Option B is correct. Option A is incorrect because risk registers are typically static documents that do not provide real-time alerts; real-time monitoring is achieved through other tools like dashboards or automated alerts. Option C is incorrect because risk registers and Key Risk Indicators (KRIs) are complementary; KRIs provide leading indicators, while the register documents risks and controls. Option D is incorrect because a risk register does not automate control testing; it records control information but testing is a separate process.

Answer

Provides real-time alerts.

Answer

Eliminates the need for KRIs.

Answer

Automates control testing.

Question 18

Which TWO of the following are examples of detective controls?

Accepted Answer

Review of access logs for unauthorized access.. A is correct because reviewing access logs for unauthorized access is a detective control. It involves examining historical records of system access events to identify security incidents or policy violations after they have occurred. This is a classic example of monitoring and analysis, not prevention or correction.

Answer

Backup and recovery procedures.

Answer

Firewall rules blocking unauthorized traffic.

Answer

Separation of duties in financial systems.

Question 19

A company has identified a risk of data breach due to weak encryption. The current controls include encryption at rest but not in transit. The risk assessment team calculates inherent risk as high and residual risk as high. What should the team recommend FIRST?

Accepted Answer

Implement encryption in transit to reduce likelihood. The risk assessment team should first recommend implementing encryption in transit because the current controls only address data at rest, leaving data vulnerable during transmission. Since both inherent and residual risks are high, the most direct and effective control to reduce likelihood is to apply a technical safeguard like TLS 1.3 for data in transit, which directly addresses the identified gap.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing data transmission

Answer

Accept the risk because it is already high

Question 20

Which TWO of the following are key attributes of effective risk reporting?

Accepted Answer

Provides actionable information for decision-makers. Effective risk reporting must provide actionable information that enables decision-makers to prioritize and respond to risks. Option C is correct because reports should highlight key risk indicators (KRIs), trends, and control effectiveness, not just raw data, so that management can make informed decisions about risk treatment and resource allocation.

Answer

Includes full risk register details

Answer

Only issued when a risk incident occurs

Answer

Sent to all employees by email