CRISC Practice Exam 53 — 20 Questions

Question 1

Which TWO of the following are examples of external risk identification sources? (Choose two.)

Accepted Answer

Regulatory bulletins from government agencies. Regulatory bulletins from government agencies (Option B) are external risk identification sources because they originate outside the organization and provide authoritative information on compliance requirements, legal changes, and mandated controls. Threat intelligence feeds from industry sources (Option D) are also external, as they aggregate data on emerging threats, vulnerabilities, and attack patterns from third-party vendors or open-source communities, helping organizations proactively adjust defenses. The other options (A, C, E) are internal sources or are not primarily used for risk identification from an external perspective.

Answer

Incident response reports from the security operations center

Answer

Internal vulnerability scan reports

Answer

Industry benchmarking reports

Question 2

A company is designing its risk and control monitoring program. Which TWO of the following are key attributes of effective monitoring?

Accepted Answer

Monitoring results should be communicated to stakeholders.. Effective monitoring requires that results are communicated to stakeholders to ensure informed decision-making and timely remediation. Without communication, monitoring loses its value as stakeholders cannot act on identified risks or control deficiencies.

Answer

All controls should be monitored at the same frequency.

Answer

Monitoring should only be performed by external auditors.

Answer

Monitoring should be independent of the control owner.

Question 3

A risk manager is assessing the potential impact of quantum computing on the organization's cryptographic infrastructure. What is the MOST immediate action the organization should take?

Accepted Answer

Conduct a cryptographic inventory to identify vulnerable systems. The first step is to inventory all cryptographic systems to understand where quantum-vulnerable algorithms are used, enabling a migration plan.

Answer

Purchase quantum-resistant hardware security modules

Answer

Immediately replace all encryption with post-quantum algorithms

Answer

Discontinue use of public key cryptography

Question 4

A company is evaluating its control monitoring program. Which TWO of the following are key elements of an effective control monitoring framework? (Choose two.)

Accepted Answer

Periodic review of KRI thresholds.. Periodic review of KRI thresholds is a key element because KRIs must remain aligned with the evolving risk landscape; thresholds that are not reviewed can become obsolete, leading to false positives or missed risk indicators. Clearly defined roles and responsibilities ensure accountability for control execution, monitoring, and escalation, which is foundational to any effective control monitoring framework.

Answer

Integration with performance management.

Answer

Use of statistical sampling for all tests.

Answer

Automated alerts for all control failures.

Question 5

Based on the exhibit, which key risk indicator (KRI) would this log data be MOST useful for calculating?

Accepted Answer

Number of failed authentication attempts per hour.. The log data shows repeated failed login attempts from multiple IP addresses targeting user accounts, which directly measures authentication failures over time. This makes it the most suitable source for calculating the number of failed authentication attempts per hour, a key risk indicator for brute-force or credential-stuffing attacks.

Answer

Percentage of successful user logins.

Answer

Percentage of system uptime.

Answer

Number of unauthorized changes to system configurations.

Question 6

Which of the following is the BEST indicator that a control is effective in mitigating a risk?

Accepted Answer

Regular testing shows the control consistently reduces the risk to the desired level. The effectiveness of a control is ultimately measured by its ability to consistently reduce residual risk to the organization's defined risk appetite. Regular testing provides empirical evidence that the control is operating as intended and achieving the desired risk mitigation outcome, which is the primary goal of risk treatment.

Answer

The control is automated and runs daily

Answer

The control is documented in a policy

Answer

The cost of the control is lower than the potential loss

Question 7

You are the risk manager at a financial institution that processes online transactions. The organization relies on a legacy system for transaction authorization, which is monitored via manual log reviews performed weekly by a junior analyst. Recently, the internal audit team identified that several unauthorized transactions were not detected for over two weeks. The logs showed that the authorization control failed intermittently due to a known software bug, but the bug had been documented in the risk register with a low residual risk rating. The CRO asks you to recommend the most effective improvement to the control monitoring process. Which of the following would be the BEST course of action?

Accepted Answer

Implement an automated real-time monitoring tool that alerts on authorization failures.. Implementing an automated real-time monitoring tool that alerts on authorization failures directly addresses the root cause: the detection delay caused by manual weekly log reviews. Unlike manual reviews, automated monitoring provides immediate notification of control failures, enabling rapid response to intermittent software bugs and reducing the window of exposure for unauthorized transactions.

Answer

Increase the frequency of log reviews to daily.

Answer

Update the risk register to increase the residual risk rating for the bug.

Answer

Retrain the junior analyst on log analysis techniques.

Question 8

Which of the following best describes the purpose of tactical risk reporting?

Accepted Answer

To enable the CISO to make informed decisions about risk mitigation priorities. Tactical risk reporting is designed to provide mid-level management, such as the CISO, with actionable insights to prioritize risk mitigation activities. It focuses on operational risk decisions, not strategic oversight or daily metrics, enabling informed choices about resource allocation and remediation timelines.

Answer

To satisfy regulatory compliance requirements

Answer

To inform the board of directors about strategic risk exposure

Answer

To provide daily operational metrics to system administrators

Question 9

When developing IT risk scenarios, connecting them to business impact is critical. Which of the following BEST describes how a risk practitioner should link a technical scenario to business impact?

Accepted Answer

Quantify the impact in terms of financial loss, regulatory penalty, and operational disruption. Quantifying impact in terms of financial loss, regulatory penalty, and operational disruption best links a technical risk scenario to business impact because it translates technical events into measurable business consequences. This allows risk to be expressed in terms that executives and business owners can understand and prioritize. It also supports cost-benefit analysis of risk treatment options.

Answer

Assign a likelihood rating and an inherent risk score

Answer

Describe the technical steps of the attack in detail

Answer

Reference industry benchmarks for similar scenarios

Question 10

An organization is implementing a new control to address a high-risk finding. The project manager has scheduled a user training session and updated the relevant policies. Which implementation phase is being addressed?

Accepted Answer

Control implementation. These activities (training and documentation updates) are part of the control implementation phase, specifically after the control is designed and before going live.

Answer

Control monitoring

Answer

Risk assessment

Answer

Control design

Question 11

Which risk reporting level is typically provided to the board of directors and focuses on strategic risk posture?

Accepted Answer

Strategic risk reporting. Strategic risk reporting is the correct level for the board of directors because it focuses on high-level, long-term risks that could affect the organization's strategic objectives and overall business posture. Unlike tactical or operational reports, strategic reports aggregate risk data into a format that supports governance, risk appetite decisions, and capital allocation at the executive level.

Answer

Tactical risk reporting

Answer

Compliance risk reporting

Answer

Operational risk reporting

Question 12

An IT risk manager is facilitating a brainstorming session to identify threats. Which technique is BEST suited for identifying a wide range of potential threats?

Accepted Answer

Conduct a facilitated workshop with cross-functional stakeholders. A facilitated workshop with cross-functional stakeholders is best suited for brainstorming because it leverages diverse perspectives from IT, business, legal, and operations teams to identify a wide range of threats, including emerging and non-obvious ones. This collaborative approach aligns with the CRISC emphasis on qualitative risk assessment techniques that surface unknown unknowns, which static checklists or historical data cannot capture.

Answer

Use a standard threat checklist

Answer

Review historical incident logs

Answer

Interview the heads of each department individually

Question 13

An organization uses automated SIEM rules to continuously monitor for unauthorized access attempts. This is an example of which type of monitoring?

Accepted Answer

Continuous monitoring. Continuous monitoring involves the use of automated tools, such as Security Information and Event Management (SIEM) systems, to provide real-time or near-real-time oversight of security events. In this scenario, the SIEM rules are configured to detect unauthorized access attempts as they occur, which aligns directly with the definition of continuous monitoring rather than periodic or point-in-time assessments.

Answer

Periodic control testing

Answer

Vulnerability scanning

Answer

Access review

Question 14

Which risk identification technique relies on analyzing past incidents to predict future risks?

Accepted Answer

Loss event data analysis. Loss event data analysis (B) is the correct risk identification technique because it systematically examines historical incident records, such as security logs, breach reports, and audit findings, to identify patterns and trends that can predict future risks. This empirical approach leverages past loss events to quantify likelihood and impact, making it distinct from generative or qualitative methods.

Answer

Brainstorming

Answer

SWOT analysis

Answer

Delphi technique

Question 15

A software development company uses a DevOps pipeline with automated code deployment. Recently, a developer accidentally pushed a configuration file containing database credentials to a public repository. The credentials were changed within an hour, but the file remained public for a few hours. The risk team is now identifying risks in the CI/CD process. The security team has proposed adding static code analysis to detect secrets in code. The development team objects, citing false positives. The risk manager must identify the most significant risk that could lead to a data breach. Which risk should be prioritized?

Accepted Answer

Lack of pre-commit hooks or automated scanning to prevent secrets from being committed.. The root cause of the incident was the absence of automated, pre-commit scanning to detect secrets before they are pushed to a repository. Pre-commit hooks (e.g., using tools like git-secrets or Talisman) or server-side scanning (e.g., GitHub secret scanning) can block credentials from being committed in the first place, directly preventing exposure. Without this control, the CI/CD pipeline lacks a critical preventive layer, making data breaches more likely despite post-commit remediation.

Answer

Insufficient training on secure coding practices for developers.

Answer

Over-reliance on manual code reviews which are error-prone.

Answer

Inadequate incident response procedures for exposed credentials.

Question 16

A security team is considering implementing a control to prevent unauthorized access to a critical database. Which type of control is most appropriate for this objective?

Accepted Answer

Preventive control. A preventive control is designed to stop an incident before it occurs — access controls, authentication, encryption, and firewalls are classic examples. Preventing unauthorized database access is definitionally a preventive objective, so a preventive control (e.g., RBAC, MFA, network segmentation) is the correct category.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 17

In a risk report presented to the board of directors, which of the following elements is most appropriate to include?

Accepted Answer

Risk heat map with top risks and status. A risk report to the board of directors should be strategic and concise, focusing on top risks and their status. A risk heat map with top risks and status provides an executive-level view that supports governance and decision-making without overwhelming the board with operational detail. This is the most appropriate element for a board audience.

Answer

Vendor security assessment scores for all vendors

Answer

Detailed weekly firewall log analysis

Answer

List of all IT incidents from the past month

Question 18

A business continuity manager wants to identify risks that could disrupt critical business processes. Which source of information would be MOST valuable for identifying such risks?

Accepted Answer

Business impact analysis (BIA) documentation. The Business Impact Analysis (BIA) documentation is the most valuable source because it systematically identifies critical business processes, their dependencies (e.g., specific servers, databases, network links), and the maximum tolerable downtime (MTD) for each. This directly pinpoints which risks would cause unacceptable disruption, making it the foundational input for risk identification in continuity planning.

Answer

Organizational charts

Answer

Industry benchmarks on downtime

Answer

Historical incident reports

Question 19

A risk manager is developing risk scenarios to present to the board. Which TWO elements are essential for connecting a risk scenario to business impact?

Accepted Answer

Consequence (e.g., financial loss). Option D, consequence such as financial loss, is essential because it translates a technical or threat event into measurable business outcomes (e.g., revenue loss, regulatory fines, recovery cost), which is exactly what connects the scenario to business impact. Option E, a business impact statement, is essential because it formally articulates how the scenario affects business objectives, operations, or stakeholders, providing the board with a clear linkage between risk and organizational impact. Together, consequence and the business impact statement bridge the gap between risk scenarios and business-level decision-making. Option A, threat actor motivation, is useful for threat modeling but does not by itself quantify or express business impact. Option B, vulnerability score, is a technical severity metric (e.g., CVSS) that does not directly map to business consequences. Option C, detection time, is an operational metric that influences exposure but is not an essential element for connecting a scenario to business impact.

Answer

Threat actor motivation

Answer

Vulnerability score

Answer

Detection time

Question 20

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Accepted Answer

Continuous monitoring. This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Answer

Periodic control testing

Answer

Access review

Answer

Vulnerability scanning