CRISC Practice Exam 54 — 20 Questions

Question 1

A project manager is identifying risks for a new software development project using Agile methodology. Which THREE threat modeling techniques are BEST suited for Agile/DevSecOps environments?

Accepted Answer

VAST. STRIDE is lightweight and can be used in Agile. PASTA is more comprehensive but can be adapted. VAST is specifically designed for Agile and DevSecOps. TRIKE is more requirements-heavy and less suited for Agile.

Answer

TRIKE

Answer

Attack trees

Question 2

A risk assessor is evaluating a third-party cloud service provider. Which of the following is the MOST important factor to consider when assessing the risk of data exfiltration?

Accepted Answer

The provider's encryption standards for data at rest and in transit. Data exfiltration risk is primarily mitigated by strong encryption standards for data at rest and in transit. Even if a provider has robust access controls, weak encryption (e.g., using TLS 1.0 or AES-128-CBC with predictable IVs) can allow an attacker to intercept or decrypt data during transfer or storage. Encryption directly prevents unauthorized extraction of readable data, making it the most critical factor.

Answer

The provider's data portability and exit process

Answer

The provider's service level agreement (SLA) for uptime

Answer

The number of security certifications held by the provider

Question 3

Which type of control is designed to operate before an event to prevent an undesirable outcome?

Accepted Answer

Preventive control. A preventive control is designed to operate before an event to stop an undesirable outcome from occurring. In risk management, this includes measures such as firewalls blocking unauthorized traffic before it reaches the internal network, or access control lists (ACLs) preventing unauthorized users from reading sensitive files. These controls proactively enforce security policies to reduce the likelihood of a risk event.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 4

An organization has recently suffered a ransomware attack that encrypted critical files. During the post-incident review, the risk team is identifying key risk indicators (KRIs) to improve early detection. Which of the following KRIs would be MOST effective in detecting similar attacks in the future?

Accepted Answer

Number of unauthorized remote access attempts.. The most effective KRI for early detection of ransomware because unauthorized remote access attempts are a direct indicator of an ongoing attack or reconnaissance. This metric can signal a breach before encryption occurs. In contrast, Option A (antivirus signature updates) measures a control rather than a risk indicator; Option C (awareness training) is a preventive measure; Option D (patch time) is corrective and not timely for detection.

Answer

Frequency of antivirus signature updates.

Answer

Percentage of employees who completed security awareness training.

Answer

Time to patch critical vulnerabilities.

Question 5

An organization is evaluating whether to accept a risk. Which TWO conditions must be met for risk acceptance to be appropriate?

Accepted Answer

The risk owner formally documents and accepts the risk. Acceptance requires that the risk is within the organization's risk appetite and that the risk owner formally documents and signs off the acceptance. It is not appropriate if controls are available or if the risk exceeds appetite.

Answer

The risk can be transferred to an insurer

Answer

The risk is high but unavoidable

Answer

A cost-effective control is available

Question 6

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Accepted Answer

Expanded attack surface due to numerous connected devices. IoT devices significantly expand the attack surface due to their sheer number and network connectivity (option A). They often lack mechanisms for firmware updates, leaving them vulnerable to unpatched exploits (option C). Additionally, many IoT devices use legacy components with known vulnerabilities that cannot be easily remediated (option E). Options B and D are not considered primary security risks: vendor lock-in is a business risk, and data sovereignty is less critical for non-sensitive environmental data.

Answer

Vendor lock-in due to proprietary protocols

Answer

Data sovereignty issues for sensor data

Question 7

A security analyst notices that the number of failed login attempts has significantly increased over the past week. The SIEM alerts are not being triggered because the threshold was set too high. What is the MOST effective immediate action to improve monitoring?

Accepted Answer

Lower the threshold for failed login alerts in the SIEM.. B is correct because the immediate issue is that the SIEM alert threshold is set too high, causing failed login attempts to go undetected. Lowering the threshold directly addresses the monitoring gap by ensuring that the SIEM generates alerts for anomalous failed login activity, enabling timely incident response without requiring a system overhaul.

Answer

Implement a new authentication system with biometrics.

Answer

Enable all SIEM rules to capture every event.

Answer

Review logs manually each day to identify anomalies.

Question 8

Based on the exhibit, what is the PRIMARY risk associated with this cloud storage bucket policy?

Accepted Answer

The policy permits unauthenticated access to sensitive data [CORRECT]. The cloud storage bucket policy grants public read access to the bucket. This permits any unauthenticated user on the internet to read objects in the bucket, exposing sensitive data without requiring credentials.

Answer

The policy allows access to all storage buckets in the account [wrong]

Answer

The policy denies access to legitimate users from outside the subnet [wrong]

Answer

The policy uses an incorrect IP range that blocks all traffic [wrong]

Question 9

Which TWO of the following are characteristics of an effective key risk indicator (KRI)?

Accepted Answer

Leading indicators that provide early warning.. Effective KRIs are leading indicators that provide early warning signals of increasing risk exposure, enabling proactive risk mitigation before an adverse event occurs. This aligns with the CRISC focus on forward-looking metrics that trigger preemptive actions, rather than merely reporting on past outcomes.

Answer

Large number of indicators to cover all risks.

Answer

Lagging indicators that confirm past events.

Answer

Qualitative assessments based on expert opinion.

Question 10

Which of the following is an example of a leading Key Risk Indicator (KRI) for IT risk?

Accepted Answer

Percentage of systems with missing critical patches. A leading Key Risk Indicator (KRI) predicts future risk events by measuring conditions that precede incidents. Missing critical patches on systems directly indicate a higher likelihood of exploitation, making it a leading indicator. In contrast, lagging KRIs like incident counts or costs measure outcomes after the fact.

Answer

Number of audit findings resolved

Answer

Number of security incidents this quarter

Answer

Total cost of security incidents

Question 11

An organization wants to promote a risk-aware culture. Which initiative is most effective in encouraging employees to report security incidents without fear?

Accepted Answer

Implementing a no-blame incident reporting policy. A 'no-blame' culture encourages reporting by removing fear of punishment for unintentional errors, leading to better risk identification and learning.

Answer

Conducting annual security awareness training

Answer

Increasing penalties for policy violations

Answer

Publishing names of employees who caused incidents

Question 12

Which TWO of the following are characteristics of an EFFECTIVE key risk indicator (KRI)?

Accepted Answer

Provides an early warning signal of increasing risk exposure.. An effective KRI must provide an early warning signal of increasing risk exposure, enabling proactive risk management before losses materialize. This aligns with the CRISC domain of Risk and Control Monitoring and Reporting, where KRIs are forward-looking metrics that track changes in risk levels, such as a sudden spike in failed login attempts indicating a potential cybersecurity threat.

Answer

Is derived from the organization's risk appetite statement.

Answer

Uses smoothed data to avoid alert fatigue.

Answer

Measures historical loss events.

Question 13

A risk assessment identifies a vulnerability in a critical application. The threat actor is a script kiddie with low capability. Using the FAIR framework, which factor would most directly increase the Loss Event Frequency (LEF)?

Accepted Answer

Increasing the vulnerability severity. Loss Event Frequency (LEF) in FAIR is directly influenced by the probability that a threat agent will act against a vulnerability. Increasing the vulnerability severity makes the application more susceptible to exploitation, thereby raising the likelihood of a loss event occurring, even if the threat actor has low capability.

Answer

Reducing the vulnerability severity

Answer

Decreasing the threat event frequency

Answer

Increasing the threat actor's motivation

Question 14

Which TWO of the following are valid techniques for identifying risk in IT risk assessment?

Accepted Answer

SWOT analysis. SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) is a structured technique used to identify both internal and external risk factors during IT risk assessment. It helps uncover threats that could exploit weaknesses, as well as opportunities that might mitigate risks, making it a valid identification method.

Answer

Residual risk assessment

Answer

Risk aggregation

Answer

Monte Carlo simulation

Question 15

Which THREE of the following are key components of a risk assessment report?

Accepted Answer

Risk register with identified risks. A risk register is a core component of a risk assessment report because it formally documents each identified risk, its owner, status, and tracking information. This register serves as the authoritative record that links risk identification to subsequent analysis and response activities, ensuring traceability throughout the risk management lifecycle.

Answer

Copies of vendor contracts

Answer

Network topology diagram

Question 16

A risk practitioner is conducting a threat modeling exercise for a new cloud-based application using the STRIDE methodology. Which of the following is the PRIMARY benefit of using STRIDE over a simple checklist?

Accepted Answer

It identifies threats by category, reducing the chance of missing key threat types. The STRIDE methodology categorizes threats into six specific types (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). This structured approach ensures that the threat modeling exercise systematically covers each category, reducing the likelihood of overlooking entire classes of threats that a simple checklist might miss. For a cloud-based application, this is critical because threats like elevation of privilege or information disclosure can manifest in unique ways across shared infrastructure, and STRIDE forces the practitioner to consider each category explicitly.

Answer

It requires less expertise to perform

Answer

It automatically quantifies risk levels

Answer

It ensures consistent application of controls

Question 17

Which TWO of the following are key components of an effective risk and control monitoring program? (Select exactly two.)

Accepted Answer

Control testing schedules. Control testing schedules (A) are a key component because they define the frequency and scope of evaluating whether controls are operating effectively. Without a structured schedule, control failures may go undetected for extended periods, increasing risk exposure. Defined key risk indicators (KRIs) (C) are also essential because they provide leading metrics that signal potential risk events before they materialize, enabling proactive monitoring and timely corrective actions.

Answer

Risk appetite statements

Answer

Quarterly board reporting

Answer

Annual risk assessment updates

Question 18

A company faces a risk of data loss due to untrained staff. They implement mandatory training and quarterly phishing simulations. This is:

Accepted Answer

Risk Mitigation. Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Answer

Risk Avoidance

Answer

Risk Acceptance

Answer

Risk Transfer

Question 19

A control owner reports that a preventive control is operating as designed, but the risk owner is concerned that residual risk remains high. What should the risk practitioner do NEXT?

Accepted Answer

Perform a control effectiveness test to validate the control.. The risk practitioner must first validate the control's effectiveness before taking any further action. Even though the control owner reports the preventive control is operating as designed, the risk owner's concern about high residual risk suggests the control may not be adequately mitigating the risk. Performing a control effectiveness test (D) provides objective evidence to determine whether the control is actually reducing risk to an acceptable level, which is the necessary next step before updating the risk register, recommending compensating controls, or escalating.

Answer

Update the risk register to reflect the high residual risk.

Answer

Recommend additional compensating controls.

Answer

Escalate the issue to the risk committee.

Question 20

During a risk assessment, a financial institution identifies that its online banking application uses an outdated encryption protocol. The likelihood of exploitation is high, and the impact is moderate. What should the risk owner do FIRST?

Accepted Answer

Validate the risk rating with additional data. The risk owner's first responsibility is to ensure the risk assessment is accurate before deciding on a response. Validating the risk rating with additional data (option B) confirms that the high likelihood and moderate impact are correctly assessed, which is a prerequisite for selecting an appropriate treatment. Jumping to implement controls, transfer, or accept the risk without validation could lead to misallocation of resources or inadequate mitigation.

Answer

Implement a compensating control to mitigate the risk

Answer

Transfer the risk via cyber insurance

Answer

Accept the risk as low priority