CRISC Practice Exam 55 — 20 Questions

Question 1

An organization has implemented a new key risk indicator (KRI) for vendor management that measures the percentage of vendors without a signed contract. The current value is 15%, exceeding the risk appetite threshold of 10%. The risk owner wants to know the most appropriate action to take based on this KRI. What should the risk practitioner recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the root cause of the high percentage and develop a remediation plan.. When a KRI exceeds the risk appetite threshold, the immediate priority is to understand why the breach occurred and to implement corrective actions. Analyzing the root cause and developing a remediation plan directly addresses the underlying issue—vendors without signed contracts—rather than merely monitoring or adjusting thresholds. This aligns with the CRISC principle that KRIs are leading indicators that should trigger risk response, not just reporting changes.

Answer

Increase the frequency of KRI reporting from monthly to weekly to monitor the trend.

Answer

Update the risk appetite threshold to 15% to align with the current value.

Answer

Immediately communicate the KRI breach to the board of directors.

Question 2

Refer to the exhibit. What action should the risk practitioner recommend FIRST?

Accepted Answer

Initiate a patch management process to apply critical patches.. The exhibit shows that critical vulnerabilities have been identified with a high risk score, and the current patch management process is not addressing them in a timely manner. The risk practitioner should first initiate a patch management process to apply critical patches, as this directly reduces the exposure to known exploits and aligns with the principle of treating the highest risks immediately. Delaying action or adjusting thresholds without remediation would leave the organization vulnerable.

Answer

Escalate to the board of directors.

Answer

Adjust the threshold to 10%.

Answer

Schedule a root cause analysis for next month.

Question 3

A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:

Accepted Answer

Risk Mitigation. Implementing manual overrides and additional monitoring reduces the probability or impact of the legacy system failure without eliminating the risk entirely. This is the definition of risk mitigation, as it applies controls to lower the residual risk to an acceptable level while the system remains in operation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 4

An organization is evaluating cyber insurance options. Which of the following factors is MOST likely to influence the insurance premium?

Accepted Answer

The organization's cybersecurity maturity and incident history. Insurance premiums are heavily influenced by the organization's risk profile, including its security posture. A strong security posture reduces perceived risk and thus premiums.

Answer

The organization's annual revenue

Answer

The number of employees in the IT department

Answer

The organization's credit rating

Question 5

Refer to the exhibit. Based on the exhibit, what is the most appropriate action regarding the control OWF?

Accepted Answer

The control should be reviewed because the alert frequency is approaching the threshold.. The exhibit shows that the OWF (Outbound Web Filtering) control has logged 95 alerts against a threshold of 100. Since the alert frequency is approaching but has not yet reached the threshold, the most appropriate action is to review the control to determine if the threshold is still appropriate or if the control needs tuning. Option C correctly identifies this proactive monitoring step, which aligns with the CRISC domain of Risk and Control Monitoring and Reporting.

Answer

The control is effective because the traffic was blocked.

Answer

The control is ineffective because alerts indicate potential malware.

Answer

No action is needed because the threshold has not been reached.

Question 6

A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?

Accepted Answer

Include security requirements in the contract and perform regular vendor audits. Including security requirements in the contract and conducting regular vendor audits ensures the vendor meets the company's security standards, effectively mitigating the risk. Option A is incorrect because denying the existence of the risk is not a valid risk response. Option B is incorrect because purchasing cyber insurance transfers the financial impact but does not reduce the actual risk. Option C is incorrect because avoiding the CRM system may be too drastic and could hinder business operations.

Answer

Deny the existence of the risk

Answer

Purchase cyber insurance to cover potential losses

Answer

Avoid using the cloud CRM system

Question 7

A financial institution is migrating its core banking system from an on-premises data center to a public cloud infrastructure. The migration is planned in phases over 18 months. The IT risk manager is tasked with identifying risks during the transition. During the first phase, the team moves non-critical applications to the cloud. A vulnerability assessment of the cloud environment reveals that several virtual machines have default administrative credentials enabled. Additionally, the cloud security group configuration for the application tier allows inbound SSH from the entire internet (0.0.0.0/0). The risk manager also learns that the cloud provider's shared responsibility model is not fully understood by the operations team, who believe the provider is responsible for all security controls. The institution's risk appetite statement allows for moderate risk tolerance but prohibits any exposure that could lead to unauthorized access to customer financial data. Which of the following risk scenarios should the risk manager identify as the MOST critical to address immediately?

Accepted Answer

Default credentials on virtual machines combined with unrestricted inbound SSH from the internet. The combination of default credentials on VMs and unrestricted inbound SSH from the internet (0.0.0.0/0) creates an immediate, exploitable vulnerability that could allow attackers to gain unauthorized access to the application tier. This directly violates the institution's risk appetite, which prohibits any exposure that could lead to unauthorized access to customer financial data. Option A, while a concern, is a management issue that does not present an immediate technical exploit. Option B is incorrect because the cloud provider's security controls are part of the shared responsibility model, but the provider is not responsible for the customer's misconfigurations. Option C is a longer-term risk that may arise during migration but is not as urgent as the active vulnerability in D.

Answer

The operations team's misunderstanding of the shared responsibility model

Answer

The cloud provider may not have adequate security controls for the institution's data

Answer

The phased migration introduces complexity that may cause configuration drift

Question 8

A multinational corporation operates in 15 countries with decentralized control monitoring systems. Each regional office uses different tools and processes for monitoring operational risks. The corporate risk team has consolidated quarterly reports, but the board recently raised concerns about inconsistencies and late identification of emerging risks. A root cause analysis revealed that regional monitoring teams define key risk indicators (KRIs) differently and report on different timeframes. Additionally, there is no centralized platform to aggregate data. The risk manager must recommend a solution that balances local autonomy with global visibility. Which option is the most effective?

Accepted Answer

Implement a centralized risk and control monitoring platform that aggregates data and enforces common reporting standards.. A centralized risk and control monitoring platform standardizes data and reporting while allowing local customization via configurable thresholds. Policy alone (A) doesn't enforce consistency; global standardization (C) might ignore local nuances; increasing meeting frequency (D) does not address data inconsistency.

Answer

Create a policy requiring regional risk teams to follow the same KRI definitions and reporting schedule.

Answer

Standardize monitoring tools across all regions globally.

Answer

Increase the frequency of board risk committee meetings to twice per month.

Question 9

A risk manager is evaluating the impact assessment for a potential data breach. Which THREE categories of impact should be considered in a comprehensive business impact analysis?

Accepted Answer

Operational impact (system downtime, productivity loss). Comprehensive business impact analysis considers various impact categories. For this data breach scenario, the three categories selected are operational (system downtime and productivity loss), regulatory (fines and mandatory remediation), and financial (direct and indirect costs). These three are commonly included in BIA. Reputational impact is also important but is not among the chosen options.

Answer

Technological impact (obsolescence of hardware)

Answer

Environmental impact (pollution, waste)

Question 10

A risk manager is developing a risk scenario for a potential data breach involving a third-party cloud provider. According to the ISACA risk scenario template, which THREE elements must be included? (Select three.)

Accepted Answer

Asset/resource. The ISACA risk scenario template mandates the inclusion of threat actor, asset/resource, and consequence as core elements. These three components define who/what causes the risk, what is affected, and the impact.

Answer

Control effectiveness

Answer

Risk owner

Question 11

A risk manager is evaluating the risks associated with using a public cloud provider. Which TWO of the following are key considerations for multi-tenancy isolation? (Select TWO.)

Accepted Answer

Risk of misconfigured cloud storage exposing another tenant's data. Multi-tenancy isolation in a public cloud involves risks that could allow one tenant to access another tenant's data. The correct choices are C (Risk of misconfigured cloud storage exposing another tenant's data) and E (Risk of hypervisor escape attacks). Option C is correct because misconfigured storage buckets or databases can inadvertently expose data to other tenants if access controls are not properly set. Option E is correct because vulnerabilities in the hypervisor could allow a malicious tenant to break out of their virtual machine and access the host or other VMs, compromising isolation. Option A (shared responsibility) is about understanding security roles, not isolation. Option B (vendor lock-in) relates to dependency on a single provider, not isolation. Option D (data sovereignty) concerns legal and geographic compliance, not isolation.

Answer

Risk of unclear shared responsibility

Answer

Risk of vendor lock-in

Answer

Risk of data sovereignty violations

Question 12

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Accepted Answer

Helps align cybersecurity activities with business objectives. The NIST CSF provides a common language for communicating cybersecurity risk (option D) and helps align cybersecurity activities with business objectives (option B). It does not guarantee prevention of all cyber attacks (option A), nor does it replace the need for a separate risk appetite statement (option E), and it is not a prescriptive set of controls but a flexible framework (option C).

Answer

Ensures all cyber attacks are prevented

Answer

Provides a prescriptive set of controls for all organizations

Answer

Replaces the need for a separate risk appetite statement

Question 13

In the context of threat modeling for a web application, which technique is specifically designed to be integrated into Agile and DevSecOps processes, emphasizing collaboration and visualization?

Accepted Answer

VAST. VAST (Visual, Agile, and Simple Threat modeling) is tailored for Agile and DevSecOps environments.

Answer

STRIDE

Answer

TRIKE

Answer

PASTA

Question 14

A risk practitioner is reviewing the monitoring reports for a critical business process. The report shows that a key control has a 95% effectiveness rate, but the risk appetite for the associated risk is 98%. What should the practitioner do?

Accepted Answer

Recommend enhancements to the control to improve effectiveness.. The control effectiveness (95%) is below the risk appetite threshold (98%), meaning the residual risk exceeds the acceptable level. The practitioner should recommend enhancements to close this gap, as accepting the current state would violate risk appetite. This aligns with the principle that controls must be improved when monitoring shows performance below the defined tolerance.

Answer

Accept the current effectiveness as it is close to the target.

Answer

Immediately escalate to senior management.

Answer

Reduce the risk appetite to 95%.

Question 15

An organization is evaluating risk treatment options for a critical vulnerability. Which TWO options would be considered risk mitigation?

Accepted Answer

Deploy an intrusion prevention system. Deploying an intrusion prevention system (IPS) is a risk mitigation measure because it actively monitors and blocks malicious traffic targeting the vulnerability, reducing the likelihood of exploitation. Implementing a security patch directly removes the vulnerability, thereby reducing both the likelihood and impact of a potential attack. Both actions modify the risk by applying technical controls to lower the residual risk level.

Answer

Purchase cyber insurance

Answer

Accept the risk with formal sign-off

Answer

Discontinue the vulnerable service

Question 16

A risk manager is assessing the risks of an IT/OT convergence project in a chemical plant. Which TWO of the following are the most significant security risks? (Select two.)

Accepted Answer

Increased attack surface from IT network to OT systems. A is correct because IT/OT convergence directly connects corporate IT networks to operational technology (OT) systems, expanding the attack surface. Attackers can pivot from IT to OT via protocols like Modbus/TCP or OPC UA, potentially disrupting critical industrial processes. This is the most significant risk as it introduces new vectors for ransomware or sabotage that were previously isolated by air gaps.

Answer

Increased need for IT support staff

Answer

Higher bandwidth consumption on OT networks

Answer

Loss of real-time visibility for operators

Question 17

During a risk assessment, the risk practitioner develops a scenario involving a disgruntled employee exfiltrating sensitive customer data through a USB drive. The organization has a strict policy against removable media but lacks technical controls to prevent USB usage. Which element of the risk scenario is the vulnerability?

Accepted Answer

Lack of technical controls to prevent USB usage. The vulnerability is the lack of technical controls to prevent USB usage, which is a weakness that can be exploited by the threat actor (disgruntled employee) to cause the threat event (data exfiltration).

Answer

Data exfiltration

Answer

Disgruntled employee

Answer

Sensitive customer data

Question 18

Which of the following is a key characteristic of a well-maintained risk register?

Accepted Answer

It is updated regularly to reflect changes. A risk register must be dynamic and updated as new risks emerge or existing risks change. Regular review and updates are essential for its effectiveness.

Answer

It is maintained solely by the IT department

Answer

It is static and reviewed annually

Answer

It includes only high-impact risks

Question 19

An organization assesses a risk of intellectual property theft through email exfiltration. They decide to enforce DLP controls, purchase a cyber liability policy, and officially accept the residual risk after controls. Which THREE risk response options are demonstrated?

Accepted Answer

Mitigate. Enforcing DLP controls directly reduces the likelihood of intellectual property theft by monitoring and blocking unauthorized email exfiltration, which is a classic risk mitigation (reduce) action. Purchasing a cyber liability policy transfers the financial impact of a breach to an insurer, demonstrating risk transfer. Formally accepting the residual risk after controls acknowledges that some risk remains, which is risk acceptance.

Answer

Avoid

Answer

Reduce

Question 20

During a risk assessment, a risk practitioner identifies that a legacy application uses a deprecated encryption protocol. The application is critical for business operations and cannot be patched. Which of the following is the BEST approach to assess the risk?

Accepted Answer

Analyze the threat landscape and existing compensating controls to determine residual risk. The best approach to assess risk for a legacy application using a deprecated encryption protocol (e.g., SSL 3.0 or TLS 1.0) is to analyze the threat landscape and existing compensating controls. This allows the risk practitioner to determine the residual risk by considering factors such as whether the application is only accessible on an isolated network segment, whether network-level encryption (e.g., IPsec or a VPN tunnel) is in place, and whether the protocol is vulnerable to specific attacks like POODLE or BEAST. Simply assigning a high inherent risk score without further analysis (Option C) ignores compensating controls, while immediate escalation (Option D) or replacement (Option A) are risk treatment decisions, not risk assessment activities.

Answer

Replace the application with a modern alternative

Answer

Assign a high inherent risk score without further analysis

Answer

Immediately escalate to senior management for an exception