CRISC Practice Exam 56 — 20 Questions

Question 1

A risk practitioner at an insurance company is identifying risks for a newly deployed customer portal that integrates with a third-party identity provider. She wants to document external factors that could increase the likelihood of a data breach. Which TWO of the following are external risk factors she should capture? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The identity provider's recent history of service outages and security incidents disclosed in its public trust reports. External risk factors are conditions outside the organization's direct control that affect the likelihood or impact of a risk event. A third-party identity provider's incident history and changing regulatory penalty regimes both originate outside the insurer and vary independently of its own actions. Internal policies, privileged account counts, and change management processes are internal conditions or controls that the organization itself shapes.

Answer

The insurer's internal policy requiring multi-factor authentication for all administrative access to the portal

Answer

The insurer's internal change management process for deploying portal updates

Answer

The number of privileged accounts the insurer's own IT staff hold on the portal's backend systems

Question 2

A risk practitioner is performing risk identification for a manufacturing firm that relies on industrial control systems (ICS) to operate assembly lines. The practitioner is cataloging vulnerabilities that could be exploited to disrupt production. Which TWO of the following represent vulnerabilities rather than threats? (Choose two.)

Accepted Answer

Flat network architecture that allows engineering workstations to reach production PLCs without segmentation.. Vulnerabilities are internal weaknesses or conditions that a threat can exploit, such as unpatched PLCs with known flaws and flat network architecture exposing production systems. Threat actors and natural events exist independently and are classified as threats. Correctly separating the two is essential because treatment differs: vulnerabilities are remediated through patching, segmentation, and configuration, while threats are addressed by reducing exposure and improving detection and response.

Answer

A severe storm causing extended power loss to the manufacturing plant.

Answer

A nation-state group conducting reconnaissance against critical manufacturing infrastructure.

Answer

Ransomware operators targeting industrial organizations for extortion payments.

Question 3

A risk practitioner is cataloging external factors that could create IT risk for a logistics firm expanding into a new country. Which TWO of the following are external factors that should be included in the risk identification effort? (Choose two.)

Accepted Answer

New data residency and privacy regulations in the target country.. External factors are conditions outside the organization's control that shape its risk landscape. New data residency and privacy regulations and the maturity of local telecom and power infrastructure both originate in the target country's legal and physical environment, so they must be identified during expansion planning. Internal items such as staff skills, training rates, and encryption choices are capability and control decisions the firm governs itself.

Answer

The organization's chosen encryption standard for data at rest.

Answer

The firm's internal security awareness training completion rate.

Answer

The technical skill level of the firm's current IT staff.

Question 4

A hospital's risk team is assessing a clinical imaging archive. The team determines that a ransomware event would encrypt the archive and disrupt diagnostic services, with an estimated single-loss magnitude of $2,000,000. Existing controls reduce the likelihood of a successful attack to an estimated 0.4 occurrences per year. What is the annualized loss expectancy (ALE) for this risk?

Accepted Answer

$800,000. Annualized loss expectancy is the product of the loss from a single event and the estimated number of such events per year. Multiplying the $2,000,000 single-loss magnitude by the 0.4 annualized rate of occurrence yields an expected average annual loss of $800,000, which the hospital can use to compare against the cost of additional ransomware controls.

Answer

$2,000,000

Answer

$2,400,000

Answer

$5,000,000

Question 5

A hospital's risk practitioner is building a risk register entry for the loss of a critical electronic health record (EHR) system. The practitioner wants to express the risk in a way that combines the probability of the event with the magnitude of its business impact so that leadership can compare it against other enterprise risks. Which of the following BEST represents this expression?

Accepted Answer

Risk score derived from a likelihood and impact matrix. Risk must be expressed so that dissimilar risks can be compared and prioritized. Combining likelihood with impact in a matrix yields a risk score that reflects both dimensions, works for financial and nonfinancial consequences, and aligns with how IT risk registers are typically populated. Monetary measures such as annualized loss expectancy address only expected financial loss, while control self-assessment results and indicator breach counts are inputs to assessment rather than the risk expression itself.

Answer

Key risk indicator (KRI) threshold breach count

Answer

Annualized loss expectancy (ALE)

Answer

Control self-assessment (CSA) result

Question 6

A risk practitioner at a regional hospital is building a risk register entry for the loss of availability of the electronic health record (EHR) system. The CIO asks which element of the risk scenario establishes the frequency with which the loss event is expected to occur so that the register can be prioritized against other entries. Which component of the risk scenario should the practitioner document?

Accepted Answer

Threat event frequency. Threat event frequency is the factor-based component that states how often the threat community is expected to act against the asset, so it is the element that establishes occurrence rate for the risk register entry. Loss magnitude components describe impact, while vulnerabilities describe exploitable weaknesses. Only threat event frequency directly supports the annualized loss expectancy comparison the CIO wants for prioritizing the EHR availability risk.

Answer

Secondary risk

Answer

Primary loss magnitude

Answer

Vulnerability

Question 7

A retail bank is documenting its risk appetite for IT risk. The board states that the bank will accept only minimal risk of unauthorized disclosure of customer payment data, but is willing to accept moderate availability risk in internal reporting systems. A risk practitioner is asked to translate this statement into operational terms. Which action BEST reflects establishing risk tolerance in this context?

Accepted Answer

Defining measurable thresholds, such as a maximum acceptable number of payment data records exposed per year, for each risk category. Risk appetite is the amount of risk an organization is willing to accept in pursuit of value, while risk tolerance translates that appetite into measurable, monitorable limits. Expressing the board's statement as maximum acceptable exposure counts for payment data and separate downtime limits for internal reporting systems makes the appetite operational. The other choices are response or assessment activities that do not establish the quantitative boundaries the board's differentiated statement requires.

Answer

Documenting the inherent risk rating of the payment data system in the risk register

Answer

Purchasing cyber insurance to transfer the financial impact of a payment data breach

Answer

Conducting a penetration test of the payment card processing environment

Question 8

A risk manager is assessing the risk of a distributed denial-of-service (DDoS) attack on a critical online service. The service has a service-level agreement (SLA) that requires 99.9% uptime. The manager has identified that the likelihood of a DDoS attack is high, but the impact is considered low because the service can fail over to a backup data center. Which of the following should the risk manager do NEXT?

Accepted Answer

Validate the effectiveness of the failover mechanism under a DDoS attack.. The risk manager's impact assessment relies on the failover mechanism working during a DDoS attack. Before proceeding, the manager must validate that the failover can handle a DDoS scenario. If it cannot, the impact may be higher than assumed. Validating the control ensures the risk assessment is accurate and informs subsequent risk response decisions.

Answer

Transfer the risk by purchasing cyber insurance for DDoS attacks.

Answer

Mitigate the risk by implementing a DDoS protection service.

Answer

Accept the risk because the impact is low and the SLA can be met.

Question 9

A risk practitioner is using the MITRE ATT&CK framework to identify threats relevant to a financial services firm's cloud-hosted trading platform. The practitioner wants to focus on techniques adversaries use after obtaining initial access to cloud infrastructure. Which of the following BEST describes how ATT&CK should be applied in this risk identification effort?

Accepted Answer

Map relevant ATT&CK techniques to the platform's assets and controls to identify gaps in detection and mitigation coverage.. ATT&CK is most valuable in risk identification when its techniques are mapped to the organization's assets and existing controls, exposing coverage gaps in detection and mitigation. It describes adversary behavior but does not supply likelihood scores, replace a risk taxonomy, or determine budget priorities by itself. The practitioner should use the mapping to build credible scenarios and then combine that insight with likelihood, impact, and risk appetite to drive treatment decisions.

Answer

Replace the organization's risk taxonomy with ATT&CK tactic categories to simplify risk register reporting.

Answer

Use ATT&CK technique identifiers as the sole basis for prioritizing risk treatment budgets across the firm.

Answer

Use ATT&CK techniques to assign a numerical likelihood score to each identified risk in the register.

Question 10

A risk practitioner is selecting a risk analysis technique for a new mobile banking feature. The team has limited historical loss data, the feature involves several interconnected components, and stakeholders disagree about how failures propagate between them. Management wants a technique that structures expert judgment about causal pathways and produces a visual model of how component failures combine to cause the top-level loss event. Which technique BEST meets these requirements?

Accepted Answer

Fault tree analysis. Fault tree analysis is a deductive technique that begins with a top-level undesired event and uses logic gates to represent combinations of contributing failures, making it ideal when historical data is scarce and causal relationships are disputed. It structures expert judgment and produces a diagram of failure propagation. Annualized loss expectancy quantifies monetary risk but needs data the team lacks, Delphi aggregates opinions without a causal model, and business impact analysis focuses on disruption consequences to business functions.

Answer

Delphi technique

Answer

Business impact analysis

Answer

Annualized loss expectancy calculation

Question 11

A financial services firm is conducting an IT risk assessment for its customer-facing mobile banking application. The risk team has identified that the application's authentication mechanism relies on a third-party single sign-on (SSO) provider. During a workshop, the risk owner states that the likelihood of a breach is low because the SSO provider has a strong security reputation. However, the risk team notes that no service-level agreement (SLA) exists with the provider. Which risk factor is MOST directly affected by the absence of an SLA, and how should the risk practitioner proceed?

Accepted Answer

The third-party dependency risk is elevated, and the risk practitioner should recommend negotiating an SLA with the SSO provider.. The absence of an SLA with a critical SSO provider introduces third-party dependency risk because there are no contractual guarantees for security, availability, or incident response. The risk practitioner should recognize this as an elevated risk and recommend negotiating an SLA to establish obligations and controls. This is a key part of IT risk assessment, where third-party relationships must be evaluated and managed. The correct answer focuses on the specific risk factor and the appropriate next step.

Answer

The residual risk of the mobile application is unchanged, so the risk practitioner should focus on internal controls only.

Answer

The inherent risk of the SSO provider is reduced, so the risk practitioner should document the risk as acceptable.

Answer

The risk appetite for the mobile application is exceeded, so the risk practitioner should immediately terminate the SSO contract.

Question 12

A risk practitioner is identifying risks for a pharmaceutical company that shares clinical trial data with external research partners. The practitioner learns that partners access the data through a shared portal with role-based access, and that one partner recently terminated its agreement but retained portal credentials. Which of the following is the MOST significant risk identification finding?

Accepted Answer

Terminated partners retain valid portal credentials after their agreements end.. The strongest finding is the confirmed existence of valid credentials held by a partner whose agreement has ended. That is a concrete threat-to-asset path affecting sensitive clinical trial data, and it must be documented and assessed. General concerns about role design, data sharing, or unstated authentication gaps are either design questions or unsupported assumptions compared with this active exposure.

Answer

Clinical trial data is shared with external research partners at all.

Answer

The portal's role-based access model may not align with the principle of least privilege.

Answer

The portal does not enforce multi-factor authentication for partner logins.

Question 13

A healthcare organization is assessing the risk of a ransomware attack on its electronic health record (EHR) system. The risk team has identified that the organization performs daily incremental backups and weekly full backups, but the backups are stored on the same network share as the EHR data. The risk owner argues that the backup strategy reduces the impact of a ransomware attack. Which statement BEST describes the residual risk after considering this control?

Accepted Answer

The residual risk is high because the backups are not isolated and could be encrypted along with the primary data.. The backup strategy is ineffective against ransomware because the backups reside on the same network share as the primary EHR data. Ransomware can encrypt both, so the organization may lose both primary and backup data. Therefore, the residual risk remains high. The risk practitioner should recognize this control weakness and recommend isolating backups, such as using offline or immutable storage. This is a critical aspect of IT risk assessment: evaluating control effectiveness, not just existence.

Answer

The residual risk is unchanged from the inherent risk because backups are a preventive control.

Answer

The residual risk is medium because the weekly full backup provides a fallback if incremental backups fail.

Answer

The residual risk is low because daily backups ensure data can be restored with minimal loss.

Question 14

A risk practitioner is using the Delphi technique to estimate the likelihood of a sophisticated ransomware attack against a hospital network. The first round of expert opinions produced widely divergent estimates. Which of the following is the MOST appropriate next step in the Delphi process?

Accepted Answer

Provide a statistical summary of the first-round estimates to the experts and ask them to revise their estimates in a second anonymous round.. The Delphi technique is an iterative, anonymous expert elicitation method. After the first round, the facilitator provides a statistical summary of the responses, such as the median and range, to the experts. The experts then revise their estimates in a second anonymous round. This process repeats until consensus or stability is achieved. Providing feedback and allowing revision is the defining characteristic of Delphi, making the second anonymous round the correct next step.

Answer

Replace the expert panel with a quantitative Monte Carlo simulation to model the ransomware likelihood.

Answer

Discard the highest and lowest estimates and average the remaining responses to produce a single likelihood value.

Answer

Convene a face-to-face meeting where experts debate their estimates until a unanimous consensus is reached.

Question 15

A hospital's risk practitioner is identifying risks to its electronic health record platform. The practitioner documents that a single system administrator holds the only account with rights to restore the production database, and no documented procedure exists for that task. Which risk factor does this finding PRIMARILY represent?

Accepted Answer

A vulnerability. The finding describes a condition, not an event or a desired state: one person uniquely holds restore rights and no procedure exists. That condition is a vulnerability because it can be exploited by ordinary events such as illness, turnover, or human error, and it amplifies the impact of any incident affecting the database. Recognizing it as a vulnerability directs remediation toward cross-training, documented runbooks, and separation of duties.

Answer

A risk appetite statement

Answer

A control objective

Answer

A threat event

Question 16

A manufacturer is identifying IT risk associated with a legacy inventory management system that no longer receives vendor security patches. The risk practitioner documents the unsupported platform as a vulnerability. Which additional asset-based factor should the practitioner evaluate to determine how this vulnerability contributes to overall risk?

Accepted Answer

The value and criticality of the asset to business operations. Vulnerabilities gain risk significance through the assets they affect, so determining the value and criticality of the legacy inventory system establishes the potential business consequence of exploitation. Without this asset context, an unpatched platform is merely a technical finding. Vendor counts, audit cadence, and open finding totals are organizational metrics that do not describe how much loss the manufacturer would suffer from this specific vulnerability.

Answer

The frequency of the organization's internal audit cycle

Answer

The total count of open findings in the risk register

Answer

The number of vendors in the organization's third-party inventory

Question 17

An insurance company is assessing the risk of a distributed denial-of-service (DDoS) attack against its customer portal. The risk team estimates that a threat actor group has both the capability and the intent to launch such an attack, and that the portal has an unpatched vulnerability that could be exploited to amplify the attack. Which factor does the unpatched vulnerability PRIMARILY represent in this risk scenario?

Accepted Answer

Vulnerability. In risk assessment, vulnerability is the internal weakness or gap that a threat can exploit. The threat actor group provides capability and intent, while impact describes the resulting harm. The unpatched portal flaw is the vulnerability that enables the DDoS amplification, so it is the factor the risk team should prioritize for remediation.

Answer

Impact

Answer

Threat

Answer

Risk appetite

Question 18

A financial services firm is performing an IT risk assessment on a legacy trading platform. The risk team has identified several weaknesses in the platform's patch management process. Which TWO of the following are examples of vulnerabilities that should be recorded in the risk register? (Choose two.)

Accepted Answer

Patch deployment requires manual approval by a single administrator.. Vulnerabilities are internal weaknesses in people, processes, or technology that a threat can exploit. An unsupported operating system and a manual single-administrator patch approval process both qualify because they exist inside the environment and degrade the firm's ability to prevent exploitation. The hacker announcement is a threat source, the revenue figure is business criticality, and the insurance exclusion is a risk financing condition, so none belong in the vulnerability field of the register.

Answer

The firm's cyber insurance policy excludes losses from unpatched systems.

Answer

The trading platform processes approximately 40 percent of the firm's revenue.

Answer

A hacker collective has publicly announced targeting of trading firms.

Question 19

A financial services firm is conducting a risk assessment for a new mobile banking application. The risk practitioner needs to evaluate the likelihood of a threat exploiting a vulnerability. Which of the following factors is MOST relevant when assessing the likelihood of a threat event?

Accepted Answer

The technical skill and motivation of threat actors targeting the mobile banking application.. When assessing likelihood, the risk practitioner focuses on factors that influence the probability of a threat event, such as threat capability, motivation, and the attractiveness of the target. In this scenario, the technical skill and motivation of threat actors targeting the mobile banking application directly affect how likely an attack is. Asset value, control effectiveness, and regulatory penalties are more related to impact or residual risk, not the inherent likelihood of the threat event.

Answer

The regulatory penalties that could result from a data breach involving the mobile application.

Answer

The monetary value of the assets that could be impacted by the threat event.

Answer

The effectiveness of the controls currently in place to prevent or detect the threat event.

Question 20

A risk practitioner at a regional hospital is building a risk register and needs to classify each identified risk by its source. During interviews, staff describe a recurring situation: a radiology scheduling application has no automated account deprovisioning, so terminated employees retain access for weeks until a supervisor manually reports them. Which risk identification category BEST describes this finding?

Accepted Answer

A vulnerability, because the absence of automated deprovisioning is a weakness that an actor could exploit.. The missing automated deprovisioning capability is a weakness in an IT process that a threat source could exploit, which by definition is a vulnerability. Identifying it as such allows the risk practitioner to link it to relevant threat sources, assess likelihood and impact, and drive remediation such as automated identity lifecycle management. Threat events describe occurrences, appetite statements describe tolerance, and control objectives describe desired outcomes, none of which match the observed condition.

Answer

A threat event, because terminated employees could intentionally misuse their retained access.

Answer

A control objective, because the hospital should define a target for account removal timing.

Answer

A risk appetite statement, because the hospital has implicitly accepted delayed deprovisioning.