CRISC Practice Exam 58 — 20 Questions

Question 1

A multinational manufacturer is assessing the risk of a ransomware attack on its operational technology (OT) network. The risk team has identified that the OT network is segmented from the corporate IT network, but a shared jump server allows administrators to move between them. The team must determine the MOST significant factor that could increase the likelihood of ransomware spreading from IT to OT. Which factor should they prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The presence of the shared jump server. The shared jump server acts as a bridge between the segmented IT and OT networks. If ransomware compromises the IT environment, the jump server provides a direct path to the OT network, effectively negating the segmentation. This makes it the most significant factor increasing the likelihood of cross-network spread. Other factors like legacy systems and missing antivirus affect impact or vulnerability but do not create the initial pathway.

Answer

The lack of antivirus software on OT endpoints

Answer

The frequency of security awareness training for IT staff

Answer

The OT network's use of legacy operating systems

Question 2

A hospital's IT risk register lists a risk that its medical imaging archive could become unavailable. The risk owner has documented the risk, set a review date, and decided to take no action because the potential impact is within the hospital's risk appetite. Which risk treatment option has the risk owner selected?

Accepted Answer

Risk acceptance. Formal risk acceptance occurs when an organization decides to retain a risk because it falls within the defined risk appetite, while documenting the decision, assigning an owner, and scheduling periodic review. The hospital's actions match this pattern precisely. Mitigation would add controls, avoidance would remove the activity, and transfer would shift the impact to a third party; none of those occurred, so acceptance is the correct characterization.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 3

A global investment firm maintains a central risk register. The CISO wants to reduce the number of entries by consolidating risks that share the same root cause. Which action BEST supports this goal while preserving the risk register's integrity?

Accepted Answer

Create a parent risk for each shared root cause and link the related risk entries as sub-risks, retaining their individual details.. Consolidating by shared root cause is best achieved with a parent-child hierarchy that preserves the details of each underlying risk. This keeps likelihood, impact, ownership, and treatment traceable while reducing clutter at the top level. Deleting, relocating, or asset-merging entries sacrifices granularity, auditability, or aggregation insight, none of which preserves the register's integrity.

Answer

Group risks by the asset they affect and merge them into a single risk statement per asset.

Answer

Move all low-rated risks to a separate spreadsheet outside the central register.

Answer

Delete duplicate entries and rely on the risk owner's memory to recall the original context.

Question 4

A regional insurance company has just completed an IT risk assessment and documented the identified risks in a central repository. The risk practitioner now wants to ensure that each risk has an assigned owner, a defined response, and a status that can be tracked over time. Which of the following should the practitioner use to meet these needs?

Accepted Answer

A risk register. The central repository for documented risks, with fields for ownership, response, and status, is the risk register. It is the mechanism that turns assessment output into managed, trackable items and provides the basis for reporting on treatment progress. The other artifacts listed serve different purposes: impact analysis, control assessment, and continuity planning all feed or complement risk management but do not replace the register.

Answer

A control self-assessment (CSA) questionnaire

Answer

An IT service continuity plan

Answer

A business impact analysis (BIA)

Question 5

A hospital's risk team is assessing a new telehealth platform. The vendor reports that its encryption module was certified two years ago. The team wants to determine whether the residual risk of relying on that module is acceptable. Which action should the team take FIRST?

Accepted Answer

Request the vendor's current vulnerability scan results and patch history for the module.. Residual risk must be judged from current evidence about control effectiveness. An older certification says little about whether the encryption module still blocks today's exploits. Obtaining up-to-date scan results and patch records gives the team the factual basis to determine whether the remaining exposure is tolerable, which is the necessary first step before any treatment decision.

Answer

Immediately terminate the vendor contract because the certification is expired.

Answer

Accept the vendor's certification as sufficient evidence and close the risk.

Answer

Re-rate the inherent risk to zero because encryption is in place.

Question 6

A risk practitioner is assessing a cloud-hosted payroll application. The vendor's SOC 2 report shows effective controls, but the report covers only the period ending eight months ago, and the vendor has since migrated to a new hosting region. The practitioner needs to determine whether the control environment can still be relied upon. Which of the following is the MOST appropriate next step?

Accepted Answer

Request the vendor's bridge letter and updated SOC 2 report covering the new region, and review the gap period.. Third-party attestation evidence must be current and must cover the environment actually in use. A bridge letter closes the gap between the report period and today, while an updated SOC 2 report covering the new hosting region addresses the changed infrastructure. Together they allow the practitioner to judge whether reliance remains justified, which is the essential next step before deciding on any treatment action.

Answer

Perform a full penetration test of the payroll application to validate the vendor's controls.

Answer

Accept the SOC 2 report as sufficient evidence because the controls were independently audited.

Answer

Terminate the vendor relationship and migrate payroll to an internally managed platform.

Question 7

A risk practitioner is assessing a customer-facing API that processes payment tokens. The team has documented the threat community, the vulnerability, and the potential loss magnitude, but the assessment stalls because no one can agree on how often the threat would realistically attempt exploitation. Which factor is the practitioner attempting to establish to complete this scenario-based risk analysis?

Accepted Answer

Threat event frequency, describing how often the threat community is expected to act against the asset.. Scenario-based analysis needs a frequency dimension to convert an identified vulnerability and loss magnitude into a risk estimate. The team has the threat community, the vulnerability, and the loss exposure; the unresolved question of how often exploitation would be attempted is the threat event frequency. Without it, no defensible risk calculation or prioritization can be completed.

Answer

Control effectiveness rating for the compensating controls already deployed around the API.

Answer

Asset criticality tier assigned by the business owner based on revenue dependency.

Answer

Residual risk level remaining after the current control set is applied to the API.

Question 8

A healthcare provider is conducting a risk assessment for its electronic health record (EHR) system. The risk team has identified that a recent upgrade introduced a new vulnerability that could allow unauthorized access to patient data. The vulnerability has a known exploit but no patch is available yet. The team must decide on the BEST immediate risk response. What should they do FIRST?

Accepted Answer

Implement a compensating control such as enhanced monitoring and network isolation. When a vulnerability has a known exploit and no patch is available, the best immediate response is to implement compensating controls that reduce exposure. Enhanced monitoring can detect exploitation attempts, and network isolation can limit access. This approach allows the organization to continue operating while mitigating risk. Acceptance, transfer, or avoidance are either inappropriate or impractical in this context.

Answer

Accept the risk because the EHR system is critical to patient care

Answer

Avoid the risk by shutting down the EHR system

Answer

Transfer the risk by purchasing cyber insurance

Question 9

A healthcare organization is assessing the risk of a ransomware attack on its electronic health record (EHR) system. The risk assessment team has identified that the likelihood of an attack is high due to recent industry trends, and the impact would be severe, including patient safety risks and regulatory fines. The organization has a limited budget and wants to implement controls that provide the greatest risk reduction. Which of the following risk response strategies is MOST appropriate in this scenario?

Accepted Answer

Risk mitigation by implementing layered controls such as regular backups, employee training, and endpoint detection and response.. Risk mitigation is the most appropriate strategy because it reduces both the likelihood and impact of a ransomware attack through layered controls. Given the criticality of the EHR system and the severe consequences, simply transferring or accepting the risk would leave the organization vulnerable. Avoidance is impractical. Mitigation aligns with the need to protect patient safety and comply with regulations while operating within budget constraints.

Answer

Risk acceptance by documenting the risk and taking no action due to budget constraints.

Answer

Risk transfer by purchasing cyber insurance to cover all potential losses.

Answer

Risk avoidance by discontinuing the use of the EHR system.

Question 10

A risk analyst is evaluating the effectiveness of the organization's existing control environment for a newly identified risk involving unauthorized access to a human resources database. Which TWO of the following activities would BEST help the analyst determine whether the current controls reduce the risk to an acceptable level? (Choose two.)

Accepted Answer

Analyzing security incident logs and access monitoring reports for the HR database over the past year.. Determining whether existing controls reduce risk to an acceptable level requires evidence of both design and operating effectiveness. Audit and penetration test results demonstrate whether safeguards withstand realistic threats, while incident logs and access monitoring reveal how detective and responsive controls perform against actual events over time. Perceptions, financial calculations, and register mapping do not test control performance, so they cannot support a defensible residual risk conclusion.

Answer

Interviewing the HR database administrator about the perceived strength of the database password policy.

Answer

Mapping the HR database to the organization's risk register and confirming the assigned risk owner.

Answer

Calculating the annualized loss expectancy of a hypothetical breach of the HR database.

Question 11

An enterprise risk analyst is aggregating risk data from three business units that each used a different likelihood scale: Unit A used a 1-3 scale, Unit B used a 1-5 scale, and Unit C used a 1-10 scale. Before consolidating results into the enterprise risk register, which action BEST ensures the aggregated risk ratings remain meaningful for management reporting?

Accepted Answer

Recalculate each unit's ratings into a single common likelihood scale and document the normalization criteria used.. Aggregating risk across business units requires a common measurement basis; otherwise, comparisons and totals are artifacts of differing scales. Mapping each unit's likelihood onto one defined enterprise scale, with documented conversion criteria, produces ratings that are comparable, auditable, and defensible to management and auditors. Averaging or weighting raw incompatible scores does not fix the underlying scale mismatch.

Answer

Multiply each unit's likelihood score by its asset count to weight the ratings before consolidation.

Answer

Discard the two units using narrower scales and report only the unit using the 1-10 scale.

Answer

Average the raw numeric scores from all three units and report the mean as the enterprise likelihood value.

Question 12

A multinational retailer operates point-of-sale terminals in 30 countries. During an IT risk assessment, the risk analyst notes that a single compromised terminal could expose payment card data across multiple jurisdictions, each with different breach notification laws. The CISO asks the analyst to determine the MOST appropriate risk metric to communicate this exposure to the board. Which of the following should the analyst use?

Accepted Answer

The annualized loss expectancy for a payment card data breach scenario. Board-level risk communication requires a metric that integrates likelihood and business impact. Annualized loss expectancy does this by multiplying event frequency by expected loss per event, capturing regulatory penalties, notification costs, and remediation expenses that vary across 30 jurisdictions. Technical indicators such as CVSS scores, patch counts, and unsupported-OS percentages describe control state or vulnerability severity but omit consequence and frequency, making them unsuitable for expressing enterprise exposure.

Answer

The CVSS base score of the vulnerability present on the point-of-sale terminals

Answer

The percentage of terminals running an unsupported operating system

Answer

The number of unpatched vulnerabilities on point-of-sale terminals

Question 13

A multinational corporation is conducting a risk assessment for its third-party vendors. The risk team has assigned a high inherent risk rating to a vendor that provides critical payroll processing. The vendor has recently provided a SOC 2 Type II report with no exceptions, and the contract includes a right-to-audit clause. The risk practitioner must determine the residual risk rating. Which factor is MOST important in making this determination?

Accepted Answer

The scope of the SOC 2 Type II report relative to the payroll processing services.. The scope of the SOC 2 Type II report is the most important factor because it determines whether the independent assurance covers the systems, processes, and trust services criteria relevant to payroll processing. If the report's scope excludes critical controls or infrastructure, the high inherent risk remains largely unaddressed. The right-to-audit clause and vendor characteristics are secondary to understanding whether the controls that matter are actually tested and effective.

Answer

The presence of a right-to-audit clause in the contract.

Answer

The vendor's financial stability and length of time in business.

Answer

The number of other clients the vendor serves in the same industry.

Question 14

A risk manager is documenting the results of an IT risk assessment. She has identified the risk, analyzed its likelihood and impact, and evaluated existing controls. Which of the following should she do NEXT?

Accepted Answer

Determine the residual risk and compare it to the risk appetite.. The risk assessment process moves from identification to analysis to evaluation. After evaluating controls, the risk manager must calculate residual risk and compare it to risk appetite. This comparison determines whether the risk is acceptable or requires further treatment. It is the basis for risk response decisions and communication to governance bodies.

Answer

Report the inherent risk to the board of directors for acceptance.

Answer

Conduct a new threat modeling exercise to identify additional threats.

Answer

Implement additional controls to reduce the risk to zero.

Question 15

A risk practitioner is assessing the risk of a legacy application that supports a critical business process. The application vendor no longer provides security patches. The business cannot replace the application within the next 12 months due to budget constraints. Which of the following is the MOST appropriate risk treatment?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring, and document the risk with a time-bound acceptance. When a legacy application cannot be replaced immediately, the best treatment is to apply compensating controls to reduce risk while formally accepting the residual risk with a defined review period. This approach addresses the risk pragmatically and maintains alignment with business constraints and risk appetite.

Answer

Transfer the risk by purchasing cyber insurance and take no other action

Answer

Accept the risk without any additional controls because the business cannot afford to replace the application

Answer

Avoid the risk by immediately shutting down the legacy application

Question 16

A risk analyst is prioritizing remediation efforts across four identified risks. The analyst has likelihood and impact ratings but must also account for the speed at which each risk could materialize and the organization's ability to respond. Which concept is the analyst applying to adjust the prioritization?

Accepted Answer

Risk velocity. Risk velocity captures how fast a risk can produce impact, and it changes prioritization because a fast-moving risk leaves little time for detection and response. Two risks with identical likelihood and impact scores can require very different urgency when one unfolds over months and the other over minutes. Folding velocity and response capability into prioritization directs attention to the exposures where delay is most costly.

Answer

Risk appetite

Answer

Control maturity

Answer

Inherent risk

Question 17

A retail company is prioritizing risks for the coming year. Management wants to focus resources where the potential financial loss is greatest, but the risk team has only ordinal likelihood and impact ratings. Which approach BEST supports this prioritization?

Accepted Answer

Estimate a monetary loss range and annual frequency for each risk, then calculate expected annual loss.. To prioritize by greatest potential financial loss, the team needs a monetary measure. Estimating loss ranges and annual frequencies yields expected annual loss, which can be compared across risks and aggregated. Ordinal multiplication, alphabetical ordering, and subjective voting do not produce a reliable financial ranking, so they cannot guide resource allocation as effectively.

Answer

Ask each department head to vote on which risks feel most urgent.

Answer

Convert the ordinal ratings into a single composite score by multiplying likelihood rank by impact rank.

Answer

Rank risks alphabetically by asset name to ensure consistent ordering.

Question 18

A small logistics company has no formal risk assessment process. The new IT manager wants to introduce a simple, repeatable method to identify and evaluate IT risks. Which action should the manager take FIRST?

Accepted Answer

Define risk criteria and a common likelihood and impact scale for the organization.. A repeatable risk process depends on agreed criteria and consistent rating scales. Defining these first allows the company to identify, analyze, and evaluate risks in a uniform way, and it makes later tooling or testing meaningful. Purchasing tools, testing systems, or outsourcing decisions before establishing criteria puts technology and activity ahead of methodology.

Answer

Commission a full penetration test of all external systems.

Answer

Outsource all risk decisions to an external consulting firm.

Answer

Purchase an automated governance, risk, and compliance tool.

Question 19

A financial services firm is evaluating the risk of insider threat in its trading department. The risk team has identified that a small number of traders have elevated privileges that allow them to execute trades and access sensitive market data. The team must determine the MOST effective control to reduce the likelihood of unauthorized trading activity. Which control should they prioritize?

Accepted Answer

Enforcing separation of duties between trade execution and trade confirmation. Unauthorized trading often involves a single individual exploiting their privileges to execute and conceal trades. Separation of duties between trade execution and confirmation ensures that at least two people are involved in the process, making it much harder for one person to conduct unauthorized activity without detection. This preventive control directly reduces the likelihood of the risk. Other controls may help but are less direct or timely.

Answer

Increasing the number of security cameras in the trading floor

Answer

Conducting regular background checks on all traders

Answer

Implementing mandatory vacation and job rotation policies

Question 20

An energy utility is assessing risk to its industrial control system (ICS) network. The risk analyst discovers that the same risk scenario is rated as high risk by the operations team using a qualitative heat map and as low risk by the enterprise risk team using a quantitative model. Both teams used the same underlying data. Which of the following is the MOST likely explanation for the discrepancy?

Accepted Answer

The two methods apply different assumptions about impact magnitude, time horizon, and risk tolerance thresholds.. Qualitative and quantitative methods process the same data through different lenses. Heat maps use ordinal scales where expert judgment can let a severe impact dominate a low likelihood, producing a high rating. Quantitative models compute expected values over a defined period, which mathematically compresses rare catastrophic events. Differences in assumed impact magnitude, time horizon, and tolerance thresholds therefore explain the divergence without implying error by either team or a data omission.

Answer

The operations team used an incorrect likelihood scale when rating the scenario.

Answer

The operations team lacks the technical expertise to assess ICS risk accurately.

Answer

The enterprise risk team failed to include the control environment in its quantitative model.