CRISC Practice Exam 57 — 20 Questions

Question 1

An organization is using the OCTAVE method for risk identification. Which activity is typically performed FIRST?

Accepted Answer

Establish risk measurement criteria. In the OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) method, the first phase is 'Build Asset-Based Threat Profiles,' which begins with establishing risk measurement criteria (e.g., impact scales, likelihood definitions) to guide subsequent asset prioritization and threat identification. This ensures that all later activities are aligned with the organization's risk appetite and tolerance levels.

Answer

Identify threats

Answer

Identify critical assets

Answer

Identify vulnerabilities

Question 2

A risk manager is facilitating a risk identification workshop for a new cloud migration initiative. Which TWO techniques are most effective for identifying potential IT risks at this stage?

Accepted Answer

Interviewing business unit managers and IT architects. Interviewing business unit managers and IT architects (Option B) is effective because it leverages domain expertise to surface operational and technical risks specific to the cloud migration, such as data residency constraints, API dependencies, or shared responsibility model gaps. This qualitative technique captures tacit knowledge that quantitative methods or automated scans cannot, making it ideal for the early identification stage.

Answer

Calculating the annualized loss expectancy (ALE) for each identified risk

Answer

Conducting a cost-benefit analysis of security controls

Answer

Performing a vulnerability scan on the existing infrastructure

Question 3

An organization has a risk appetite that is risk-averse. Which risk treatment option would be most aligned with this appetite?

Accepted Answer

Avoid the risk by discontinuing the activity. A risk-averse organization prioritizes avoiding exposure to threats. Discontinuing the activity that introduces the risk (option A) eliminates the threat source entirely, ensuring no residual risk remains. This aligns directly with a risk-averse appetite, where even low-probability, high-impact events are unacceptable.

Answer

Mitigate the risk with controls

Answer

Accept the risk

Answer

Transfer the risk through insurance

Question 4

A risk practitioner is using a 5×5 heat map with likelihood and impact ratings. Which of the following is a key advantage of this qualitative risk analysis approach?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using a 5×5 heat map is designed to be quick to perform and easy to communicate visually to non-technical stakeholders. The color-coded matrix (e.g., red for high risk, green for low risk) allows immediate understanding of risk priorities without requiring complex calculations, making it ideal for initial risk assessments and board-level reporting.

Answer

It provides objective, financially meaningful results.

Answer

It eliminates the need for expert judgment in risk assessment.

Answer

It allows direct comparison of risk levels across different organizations.

Question 5

During an IT risk assessment, the risk owner identifies a high inherent risk for a legacy system. After implementing a firewall and intrusion detection system, the residual risk is calculated. Which of the following best describes residual risk?

Accepted Answer

The risk level after considering control effectiveness. Residual risk is the level of risk that remains after controls have been implemented and their effectiveness has been factored in. In this scenario, the firewall and intrusion detection system are controls that reduce the inherent risk, but some risk (e.g., from zero-day exploits or misconfigurations) will persist, which is the residual risk.

Answer

The risk level before any controls are implemented

Answer

The risk that is transferred to a third party

Answer

The risk that is accepted without action

Question 6

Which of the following is the primary purpose of a risk heat map in a risk report?

Accepted Answer

To prioritize risks based on likelihood and impact. A risk heat map visually plots risks on a grid based on their likelihood (probability) and impact (consequence), enabling stakeholders to quickly identify which risks require immediate attention. This prioritization is the primary purpose because it directly supports risk response decisions by highlighting high-priority risks that exceed the organization's risk appetite.

Answer

To track compliance with regulations

Answer

To detail remediation plans

Answer

To show control performance over time

Question 7

Which type of control is primarily designed to prevent an unwanted event from occurring?

Accepted Answer

Preventive control. Preventive controls are implemented to deter or avoid potential risks before they materialize.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 8

In a qualitative risk assessment using a 5x5 heat map, an IT risk is rated with likelihood 4 and impact 5. According to typical heat map conventions (5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational), what is the overall risk rating?

Accepted Answer

Critical. In a typical 5x5 risk heat map, the overall risk rating is determined by the intersection of likelihood and impact values. With likelihood 4 and impact 5, the cell falls in the 'Critical' zone (commonly defined as likelihood 4-5 and impact 4-5). This aligns with the convention where 5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational, making D the correct answer.

Answer

Low

Answer

Medium

Answer

High

Question 9

An organization is implementing continuous monitoring for its critical systems. Which THREE of the following activities are examples of continuous monitoring? (Select three.)

Accepted Answer

Weekly vulnerability scanning of all servers. Weekly vulnerability scanning of all servers is a continuous monitoring activity because it occurs at a regular, frequent interval, enabling the organization to identify and remediate vulnerabilities in a timely manner. This aligns with the principle of ongoing risk response and reporting, as it provides recurring visibility into the security posture of critical systems.

Answer

Annual internal audit of access controls

Answer

Quarterly review of user access rights by managers

Question 10

A manufacturing company uses IoT sensors on the factory floor to monitor equipment performance. The sensors transmit data to a central server via Wi-Fi. During a risk identification workshop, the operations manager reveals that some sensors are operating on outdated firmware with known vulnerabilities. The IT director proposes replacing all sensors at a high cost. The risk team notes that a breach could cause production downtime but the sensors only collect non-sensitive operational data. The company has a low tolerance for downtime. What should the risk team identify as the most critical risk?

Accepted Answer

Operational disruption from a potential cyber attack exploiting sensor vulnerabilities.. The most critical risk is operational disruption from a cyber attack exploiting the known vulnerabilities in the outdated IoT sensor firmware. Since the company has a low tolerance for downtime, any breach that causes production stoppage directly impacts business continuity, outweighing the non-sensitive nature of the data collected. The sensors' Wi-Fi connectivity provides an attack surface for lateral movement or denial-of-service, making exploitation a high-probability, high-impact event.

Answer

Legal liability from non-compliance with safety standards.

Answer

Reputational damage from a data leak.

Answer

Financial loss from replacing sensors.

Question 11

An organization defines its risk appetite as 'no more than one major security incident per year.' During the year, a major incident occurs. The monitoring team reports this to the risk committee. What should be the NEXT step?

Accepted Answer

Review the incident to determine if risk appetite needs adjustment.. After a major incident occurs, the risk committee should analyze the incident to determine if the current risk appetite remains appropriate or if adjustments are needed. Option A is incorrect because immediately changing the risk appetite without analysis is reactive and may not align with organizational objectives. Option C is incorrect because reporting to the board of directors is typically done after analysis and determination of impact, not as the immediate next step. Option D is incorrect because accepting the incident without review fails to address potential gaps in controls or risk appetite.

Answer

Immediately change the risk appetite to tolerate two incidents per year.

Answer

Report the breach to the board of directors.

Answer

Accept the incident and continue with current controls.

Question 12

A mid-sized retail company operates 50 stores across three regions. Each store uses a point-of-sale (POS) system that transmits credit card transactions to a centralized payment processor. The company recently deployed a new SaaS-based inventory management application that connects to the POS system via API. The IT department has no formal process for tracking third-party connections. The risk manager suspects that unknown or unauthorized connections may exist. During a risk identification review, the risk manager discovers that the POS vendor's API documentation was shared with the inventory SaaS provider without a non-disclosure agreement (NDA). Additionally, the API keys for the POS system are stored in plain text configuration files on the inventory SaaS application server. The company's security policy requires encryption of all sensitive data in transit and at rest. Which of the following should the risk manager prioritize as the HIGHEST risk scenario to document in the risk register?

Accepted Answer

Exposure of POS system API keys stored in plain text on the inventory SaaS server. The plain-text storage of API keys on the inventory SaaS server represents an active, exploitable vulnerability that directly violates the company's encryption-at-rest policy. Unlike the other options, this is a confirmed technical control failure that could allow an attacker to impersonate the POS system, intercept or manipulate credit card transactions, and compromise the entire payment processing pipeline. The risk is immediate and high-impact because the keys are already exposed, not merely a procedural gap or missing legal agreement.

Answer

The POS system may not be PCI DSS compliant due to API sharing without NDA

Answer

No formal process for tracking third-party connections

Answer

The lack of an NDA with the inventory SaaS provider

Question 13

An organization purchases cyber insurance to cover potential losses from data breaches. This is an example of:

Accepted Answer

Risk Transfer. Purchasing cyber insurance transfers the financial risk of a data breach to the insurer, making it a classic example of risk transfer. In risk management, transfer shifts the impact of a loss to a third party (e.g., an insurance carrier) without eliminating the underlying threat or vulnerability. This aligns with the CRISC domain of Risk Response and Mitigation, where transfer is a distinct response strategy.

Answer

Risk Avoidance

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 14

After a significant cybersecurity incident, the board requests a report on the effectiveness of the security controls that were in place. Which reporting approach would BEST demonstrate the controls' performance?

Accepted Answer

Compare control test results against defined KRIs and risk appetite. Comparing control test results against defined Key Risk Indicators (KRIs) and risk appetite directly demonstrates whether the controls are operating within acceptable risk thresholds. This approach provides the board with a clear, quantitative assessment of control effectiveness relative to the organization's risk tolerance, which is the core objective of risk and control monitoring and reporting.

Answer

List all controls and their test results

Answer

Show the number of vulnerabilities patched

Answer

Provide a summary of the incident timeline

Question 15

A third-party vendor has been tiered as 'high risk' due to access to sensitive customer data. The vendor's SOC 2 Type II report has a qualified opinion on security controls. The vendor risk appetite requires unqualified SOC 2 Type II for critical vendors. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to remediate the issues and provide an updated report within a defined timeframe. If a vendor does not meet the minimum security requirements for its tier, and the organization cannot accept the risk, the appropriate response is to remediate by requiring the vendor to address the qualification or find an alternative vendor that meets the requirements.

Answer

Accept the qualified report and continue monitoring

Answer

Implement additional compensating controls on the organization's side

Answer

Downgrade the vendor to medium risk tier

Question 16

A retail company is planning to launch a mobile payment app. The risk team is identifying potential risks related to payment card industry (PCI) compliance. The app will process credit card numbers. The development team has implemented tokenization to replace card numbers with tokens, but the token vault is located on-premises. The network architect proposes exposing the token vault to the internet for mobile app access. The compliance officer is concerned about PCI DSS requirements. The risk manager needs to identify the highest risk related to this setup. What is the primary risk?

Accepted Answer

Exposure of the token vault to the internet may violate PCI DSS requirements and lead to a data breach.. The primary risk is that exposing the token vault to the internet directly violates PCI DSS Requirement 3.4, which mandates that stored cardholder data must be rendered unreadable. While tokenization replaces PANs with tokens, the vault itself contains the sensitive PAN-to-token mapping. Internet exposure of this vault creates an attack surface for unauthorized access, potentially leading to a massive data breach and non-compliance penalties.

Answer

Potential loss of tokens due to hardware failure.

Answer

Increased latency due to tokenization.

Answer

High cost of tokenization infrastructure.

Question 17

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Accepted Answer

Firewall. A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Answer

Outsourcing IT helpdesk

Answer

Cyber insurance

Question 18

Refer to the exhibit. A risk manager reviews the vulnerability scan output. According to the policy, what is the required risk response?

Accepted Answer

Mitigate by patching or compensating controls. The vulnerability scan output indicates a critical remote code execution vulnerability in the Apache Struts2 framework (CVE-2017-5638). According to policy, the required risk response is to mitigate by patching or implementing compensating controls because the vulnerability has a known exploit and high severity, making acceptance or transfer inappropriate without remediation.

Answer

Accept the risk

Answer

Transfer the risk

Answer

Avoid by disabling the service

Question 19

Which THREE of the following are components of an effective IT risk reporting structure for a large enterprise? (Select THREE)

Accepted Answer

Strategic risk reporting to the board on a semi-annual basis. Strategic risk reporting to the board on a semi-annual basis is correct because the board requires high-level, aggregated risk information that aligns with enterprise strategy and risk appetite. Semi-annual reporting provides sufficient frequency for oversight without overwhelming the board with operational details, as mandated by governance frameworks like COBIT and ISO 31000.

Answer

Annual risk reporting to IT operational staff

Answer

Daily risk reporting to the board

Question 20

A financial institution is implementing a new risk monitoring tool that aggregates data from multiple sources. The tool is expected to provide real-time dashboards for risk committees. However, during user acceptance testing, the dashboards show inconsistent data due to time zone differences across sources. What is the best approach to resolve this?

Accepted Answer

Standardize all timestamps to Coordinated Universal Time (UTC) during data ingestion.. Standardizing all timestamps to Coordinated Universal Time (UTC) during data ingestion ensures a single, unambiguous reference point for all aggregated data. This eliminates the root cause of inconsistency—differing local time zones—at the point of data entry, allowing the real-time dashboards to display consistent, comparable metrics regardless of the source's geographic location. This approach aligns with the principle of normalizing data at the earliest stage of the data pipeline, which is a fundamental practice in risk monitoring and reporting.

Answer

Modify the dashboard to display each source's local time separately.

Answer

Ask each source to adjust their time zone to the corporate headquarters time zone.

Answer

Use the time zone of the majority of sources and convert others.