CRISC Practice Exam 56 — 20 Questions

Question 1

After implementing controls for a high-risk IT process, the residual risk is calculated as medium. The risk owner argues that the controls are not adequate because the inherent risk was critical. Which of the following should be the primary basis for determining control adequacy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The reduction from inherent risk to residual risk based on control effectiveness. Control adequacy is determined by assessing both design adequacy and operating effectiveness, which together reduce inherent risk to the desired residual risk level.

Answer

The number of controls implemented

Answer

The cost of controls relative to the asset value

Answer

The industry standards for similar processes

Question 2

A retail company monitors its key risk indicator (KRI) for credit card transaction fraud. The KRI has exceeded the established threshold for three consecutive days, but the weekly control performance report shows all fraud detection controls operating effectively. What should the risk practitioner do FIRST?

Accepted Answer

Investigate the data source of the KRI to ensure accuracy and timeliness.. The KRI breach may be caused by data inaccuracies or delays in the data feed, not by an actual increase in fraud. Investigating the data source ensures the KRI is reliable before taking any further action, aligning with the principle of validating monitoring data before making control decisions.

Answer

Immediately enhance the fraud detection controls.

Answer

Report the KRI breach to the board and recommend risk acceptance.

Answer

Adjust the KRI threshold to align with current control performance.

Question 3

You are the IT risk manager at a multinational corporation that recently migrated its customer database to a cloud-based platform. The database contains personally identifiable information (PII) subject to GDPR. During a routine vulnerability scan, you discover that the database is accessible from the internet without encryption (port 1433 open). The cloud provider's shared responsibility model indicates that securing the database configuration is the customer's responsibility. You have identified the risk as high likelihood and high impact. The business owner argues that the database is only accessible to a limited IP range and that encryption would degrade performance. Which course of action should you recommend to treat the risk?

Accepted Answer

Close the port or implement a VPN, and enforce encryption. This option directly addresses the risk by eliminating the unprotected internet exposure (closing the port or using VPN) and encrypting data in transit, which is required for GDPR compliance. Option A is wrong because purchasing cyber insurance transfers financial risk but does not reduce the actual exposure or ensure compliance with GDPR. Option C is wrong because accepting the risk based on IP restriction is insufficient; GDPR mandates appropriate technical controls to protect PII, and IP restrictions alone do not guarantee security or compliance. Option D is wrong because a WAF monitors traffic but does not enforce encryption or prevent direct access to the database; it is not a substitute for closing the port and encrypting data.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk because the IP restriction reduces likelihood

Answer

Implement a web application firewall (WAF) to monitor traffic

Question 4

A university is implementing a new online learning management system (LMS) that will store student records, grades, and personal information. During the risk assessment, the IT team identifies that the LMS vendor's default configuration allows students to see each other's email addresses in the class roster. This could lead to privacy violations under FERPA regulations. The vendor states that this feature can be disabled in the settings but doing so will require manual configuration for each course. The university has a moderate risk appetite and wants to launch the system within two weeks. Which of the following is the MOST appropriate risk response?

Accepted Answer

Reduce the risk by disabling the feature globally through a script or administrative override before launch.. The most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.

Answer

Transfer the risk by requiring students to sign a consent form allowing email disclosure.

Answer

Avoid the risk by selecting a different LMS vendor that does not have this issue.

Answer

Accept the risk because the exposure is limited to email addresses and not grades.

Question 5

An organization is implementing controls to mitigate the risk of data exfiltration. Which TWO control types would be considered preventive? (Select TWO)

Accepted Answer

Access controls to restrict data access. Preventive controls aim to stop a risk event from occurring. Access controls prevent unauthorized access, and encryption prevents data from being read if exfiltrated. Log monitoring is detective, and backup restoration is corrective.

Answer

Incident response plan

Answer

Backup restoration procedures

Answer

Log monitoring and analysis

Question 6

An organization is performing a business impact analysis (BIA) for its critical applications. Which TWO of the following are primary objectives of a BIA?

Accepted Answer

Prioritize recovery of business processes based on criticality.. A primary objective of a BIA is to prioritize the recovery of business processes based on their criticality to the organization. This prioritization directly informs the recovery time objectives (RTOs) and resource allocation for each process, ensuring that the most critical functions are restored first during a disruption.

Answer

Determine the likelihood of each threat event.

Answer

Calculate the annualized loss expectancy (ALE).

Answer

Select appropriate risk response strategies.

Question 7

A vendor risk manager is tiering vendors based on the criticality of services and data access. A vendor that processes sensitive customer data for a core business application should be classified as which tier?

Accepted Answer

Critical. A vendor processing sensitive customer data for a core business application poses the highest potential impact on confidentiality, integrity, and availability. This aligns with the definition of a Critical tier, where failure or breach would cause severe business disruption, regulatory penalties, and reputational damage. The classification is driven by the combination of sensitive data access and the application's essential role in business operations.

Answer

Low

Answer

Medium

Answer

High

Question 8

A risk manager is evaluating a control that addresses a high-risk finding from an internal audit. Which of the following is the MOST important factor in determining whether the control is effective?

Accepted Answer

Key control indicators (KCIs) such as control deficiency rate and test results. B is correct because the effectiveness of a control is determined by its ability to reduce risk to an acceptable level, which is directly measured by key control indicators (KCIs) such as the control deficiency rate and test results. These metrics provide empirical evidence of whether the control is operating as intended and mitigating the identified high-risk finding. Without such performance data, any assessment of effectiveness is speculative.

Answer

The vendor's reputation for providing reliable security solutions

Answer

The cost of the control relative to the asset value

Answer

The control's alignment with industry best practices

Question 9

A company has implemented a new control to detect unauthorized access attempts. What is the PRIMARY purpose of monitoring this control?

Accepted Answer

To confirm the control is working effectively.. The primary purpose of monitoring a detective control, such as one that detects unauthorized access attempts, is to confirm that the control is operating effectively as designed. Monitoring provides ongoing assurance that the control is correctly identifying and logging unauthorized access events, which is essential for maintaining the security posture and for timely incident response.

Answer

To provide evidence for regulatory audits.

Answer

To reduce the number of unauthorized access attempts.

Answer

To calculate the residual risk level.

Question 10

An organization is implementing a new access control system. Which of the following is the MOST important consideration during the implementation phase?

Accepted Answer

Change management. During the implementation phase of a new access control system, change management is the most critical consideration because it ensures that all changes to the authentication and authorization infrastructure are controlled, tested, and approved before deployment. Without a formal change management process, misconfigurations in protocols like LDAP, RADIUS, or SAML can lead to security gaps or service outages, making it the foundational control for a successful rollout.

Answer

Control ownership assignment

Answer

User training

Answer

Documentation update

Question 11

During a third-party risk management review, the organization is tiering its vendors based on risk. Which TWO of the following criteria are most relevant for determining vendor risk tier?

Accepted Answer

Criticality of service provided. The criticality of the service provided (A) directly determines the potential business impact if the vendor fails, making it a primary factor in risk tiering. Similarly, the level of data access (C) dictates the confidentiality and privacy risks, as vendors handling sensitive or regulated data (e.g., PII, PHI) pose higher inherent risk. Both criteria align with the ISACA risk management framework, which prioritizes impact and data sensitivity over financial or operational metrics.

Answer

Number of vendor employees

Answer

Annual contract value

Answer

Vendor geographic location

Question 12

During a risk assessment for a cloud migration project, the risk team identifies that the new SaaS application has not been tested for interoperability with existing identity management systems. The project manager argues that the integration will be straightforward and asks to remove this from the risk register. Which of the following is the BEST response from the risk practitioner?

Accepted Answer

Keep the risk in the register with a note that further assessment is needed.. The risk should be retained in the register with a note that further assessment is needed until interoperability testing can be conducted. Removing it prematurely (A) ignores potential issues. Accepting the risk (C) is premature without full evaluation. Escalating (D) may be necessary later but is not the best immediate response.

Answer

Remove the risk as it is low priority.

Answer

Accept the risk but document the decision.

Answer

Escalate to the project steering committee.

Question 13

A financial institution is assessing the risk of a new real-time payment system. The risk manager calculates that the annualized loss expectancy (ALE) for a potential fraud scenario is $500,000. The cost to implement a fraud detection solution is $200,000 initially with $50,000 annual maintenance. The solution is expected to reduce the ALE by 80%. What is the net benefit of implementing the solution over three years?

Accepted Answer

$850,000. The net benefit over three years is calculated as the reduction in ALE minus the total cost of the solution. The original ALE is $500,000 per year, and an 80% reduction saves $400,000 annually. Over three years, total savings are $1,200,000. The total cost includes the initial $200,000 plus three years of maintenance at $50,000 each ($150,000), totaling $350,000. Net benefit = $1,200,000 - $350,000 = $850,000.

Answer

$1,000,000

Answer

$950,000

Answer

$800,000

Question 14

In the FAIR framework, Loss Event Frequency (LEF) is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. FAIR defines LEF = Threat Event Frequency (TEF) multiplied by Vulnerability (Vuln).

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Answer

Threat Event Frequency × Loss Magnitude

Answer

Vulnerability × Loss Magnitude

Question 15

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Accepted Answer

Require manual approval for all orders above a threshold. Requiring manual approval for orders above a threshold directly reduces the impact of a successful exploit by preventing large-scale financial loss, even if the underlying code vulnerability remains unpatched. This compensating control shifts the risk acceptance decision to a human operator, effectively adding a business logic layer that can catch anomalous or malicious order matching attempts. Option E is correct because rate limiting on order submissions mitigates the risk of an attacker exploiting the vulnerability to submit a high volume of malicious orders, thereby limiting the blast radius and preventing denial-of-service or market manipulation scenarios.

Answer

Rewrite the order matching engine in a memory-safe language

Answer

Deploy a Web Application Firewall (WAF) to block malicious payloads

Answer

Enable detailed logging for all order matching transactions

Question 16

Refer to the exhibit. During a risk identification exercise for the internal network, the risk manager reviews this firewall log entry. Which of the following risks is MOST directly suggested by this log entry?

Accepted Answer

An attacker could use SMB to move laterally from a compromised workstation to the server.. The firewall log shows an inbound SMB connection (port 445) from a workstation (10.0.0.5) to a server (10.0.0.10). SMB is commonly used for file sharing and remote administration, and if the workstation is compromised, an attacker can leverage SMB to move laterally to the server, potentially gaining access to sensitive data or escalating privileges. This aligns with the risk of lateral movement, which is a primary concern in internal network segmentation.

Answer

Sensitive data is being exfiltrated via SMB.

Answer

The workstation may be accessing the internet via the server.

Answer

The organization is vulnerable to a distributed denial-of-service (DDoS) attack.

Question 17

A company's control monitoring dashboard shows that a key control has been operating effectively for six months. However, a recent audit revealed a material weakness. Which of the following is the MOST likely reason?

Accepted Answer

The KRI thresholds were set incorrectly.. The dashboard shows the control operating effectively for six months, yet a material weakness was found. This discrepancy most likely arises because the Key Risk Indicator (KRI) thresholds were set incorrectly, meaning the monitoring system was calibrated to report acceptable risk levels even when the control was actually failing. Incorrect thresholds cause false positives in the dashboard, masking the true control deficiency.

Answer

The control was not tested during the period.

Answer

The monitoring frequency was too low.

Answer

The control owner was not trained.

Question 18

During a quarterly control review, the risk team discovers that a key manual approval control was bypassed in 15% of transactions due to a recent process change. What is the FIRST action the risk practitioner should take?

Accepted Answer

Conduct a root cause analysis to determine why the bypass occurred.. The first action is to conduct a root cause analysis (B) to understand why the control was bypassed, as required by the CRISC process of identifying the underlying cause before taking corrective or compensating actions. This aligns with the risk monitoring and reporting domain, where a control deficiency must be analyzed to determine if it is a systemic process failure, a training gap, or a deliberate override. Without this analysis, any subsequent action—such as restoring the original control or updating the risk register—may be premature or misdirected.

Answer

Restore the original control process immediately.

Answer

Update the risk register to reflect the increased residual risk.

Answer

Escalate to senior management with a recommendation for disciplinary action.

Question 19

An organization notices a spike in failed authentication attempts over the past week. This metric is best classified as which type of risk indicator?

Accepted Answer

Key Risk Indicator (KRI). A spike in failed authentication attempts is a direct measure of a risk condition (e.g., brute-force attacks or credential stuffing) that can lead to unauthorized access. This metric is best classified as a Key Risk Indicator (KRI) because it tracks changes in risk exposure over time, enabling proactive risk response. Unlike a KCI, which measures control effectiveness, or a lagging indicator, which reports past incidents, this metric signals an evolving threat in near real-time.

Answer

Key Control Indicator (KCI)

Answer

Lagging indicator

Answer

Compliance metric

Question 20

Which TWO of the following are primary sources of risk identification for IT projects? (Select exactly 2.)

Accepted Answer

Project documentation. Project documentation (Option B) is a primary source of risk identification because it contains the project scope, schedule, requirements, and assumptions that directly reveal potential risks such as resource constraints or scope creep. Lessons learned from previous projects (Option E) provide empirical data on actual risks encountered, mitigation effectiveness, and failure patterns, making them a critical input for identifying risks in new IT projects. Both sources are explicitly cited in the CRISC Review Manual as foundational inputs for the risk identification process.

Answer

Security baseline

Answer

Risk treatment plan

Answer

Firewall logs