CRISC Practice Exam 58 — 20 Questions

Question 1

Which TWO of the following are primary techniques for identifying IT risks in an organization? (Choose two.)

Accepted Answer

Brainstorming workshops with process owners. The correct answers are C and E. Brainstorming workshops with process owners (C) directly identify risks by leveraging expert knowledge. Reviewing internal and external audit findings (E) identifies risks that have been observed or reported. Vulnerability scanning (A) identifies technical vulnerabilities, not risks per se. BIA (B) focuses on impact assessment. Control self-assessments (D) evaluate control effectiveness, not identify risks.

Answer

Vulnerability scanning

Answer

Business impact analysis (BIA)

Answer

Control self-assessments

Question 2

A risk practitioner is identifying risks related to a new API gateway implementation. Which TWO of the following are MOST likely to be significant risks?

Accepted Answer

Insufficient logging of API requests.. Insufficient logging of API requests (A) is a significant risk because it impairs the ability to detect, investigate, and respond to security incidents such as unauthorized access, injection attacks, or data exfiltration. Without comprehensive logs, the organization cannot perform effective forensic analysis or meet compliance requirements (e.g., PCI DSS, SOX). In the context of an API gateway, which acts as the central entry point for all API traffic, missing logs create a blind spot for threat detection and incident response. Insecure direct object references (C) allow an attacker to access unauthorized data by manipulating object identifiers (e.g., user IDs, file paths) in API requests. This is a common API vulnerability that can lead to data breaches, especially if the gateway does not enforce proper authorization checks. Together, these two represent critical security risks that could compromise confidentiality and integrity.

Answer

Lack of scalability for peak loads.

Answer

Use of outdated programming language.

Answer

High licensing cost.

Question 3

Based on the exhibit, which control is most critical to address first to reduce the risk of unauthorized access?

Accepted Answer

Segregation of duties conflict resolution timeliness.. Segregation of duties (SoD) conflict resolution timeliness directly addresses the risk that unresolved conflicts could allow a single user to execute unauthorized actions across multiple systems. If SoD conflicts are not resolved promptly, a user might retain incompatible roles (e.g., both creating and approving purchase orders), enabling fraud or unauthorized access without detection. This control is foundational because it prevents the accumulation of excessive privileges that bypass other access controls.

Answer

Privileged access review frequency.

Answer

User access recertification completion rate.

Answer

Terminated employee account disabling timeliness.

Question 4

Which of the following BEST describes inherent risk?

Accepted Answer

The risk level before any controls are applied. Inherent risk is defined as the level of risk that exists in the absence of any controls or mitigations. It represents the raw, untreated risk exposure that an organization faces from a specific threat-vulnerability pair, such as the risk of data exfiltration from an unpatched web server before any firewall rules, intrusion detection systems, or encryption are applied.

Answer

The level of risk after implementing controls

Answer

The amount of risk the organization is willing to accept

Answer

The risk level that remains after considering existing controls

Question 5

You are a risk practitioner at a financial institution that is migrating its core banking system to a cloud provider. The migration plan includes a phased approach, with the first phase moving non-critical applications. However, during the second phase (moving customer-facing applications), the cloud provider experiences a major outage that lasts 6 hours. The outage was caused by a misconfiguration in the provider's network. The institution had conducted a risk assessment and identified cloud provider downtime as a risk, but the treatment plan only included a service level agreement (SLA) with financial penalties. The SLA does not cover the reputational damage and loss of customer trust. The risk register shows that the residual risk level was marked as 'low' before the incident. After the incident, senior management is demanding a review. Which of the following is the MOST appropriate action for the risk practitioner to take?

Accepted Answer

Reassess the risk and recommend implementing a multi-cloud architecture for critical applications. The incident revealed that the existing risk treatment (SLA financial penalties) was insufficient to address the actual impact (reputational damage and loss of customer trust). The risk practitioner must reassess the risk with the new information and recommend a more robust mitigation strategy, such as multi-cloud architecture, to reduce the likelihood or impact of a single provider's outage affecting critical customer-facing applications.

Answer

Negotiate a higher penalty in the SLA

Answer

Initiate a legal claim against the provider

Answer

Update the risk register to reflect the incident and accept the residual risk

Question 6

An internal audit found that a control designed to prevent duplicate payments was bypassed in 5% of transactions. The control owner argues that the control is still effective because the bypass rate is low. What is the BEST response from a risk perspective?

Accepted Answer

Investigate why bypasses occur and implement compensating controls.. The best response because a 5% bypass rate indicates a control weakness that could lead to financial loss or fraud. From a risk perspective, the root cause of the bypasses must be investigated to understand why the control is being overridden, and compensating controls should be implemented to mitigate the residual risk. Simply accepting or documenting the rate without action ignores the potential for systemic issues or targeted exploitation.

Answer

Accept the bypass rate as within acceptable tolerance.

Answer

Document that the control is 95% effective and close the finding.

Answer

Re-classify the control as a detective control instead of preventive.

Question 7

A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?

Accepted Answer

Scenario analysis with a focus on likelihood and impact. Scenario analysis is most appropriate because the risk of data exfiltration by a malicious insider at the cloud provider is a complex, low-frequency, high-impact threat that is difficult to quantify with historical data. This approach allows the risk manager to systematically evaluate specific attack paths (e.g., an insider with database access copying customer records) by focusing on likelihood and impact, which aligns with the qualitative nature of insider threat assessment in a cloud environment.

Answer

Quantitative risk assessment using ALE and SLE

Answer

Application of the COSO ERM framework

Answer

Control self-assessment (CSA) against ISO 27001

Question 8

Based on the exhibit, what is the primary risk to the organization?

Accepted Answer

Unauthorized disclosure of sensitive customer data. The exhibit shows a database server with customer data accessible via a web application that uses unencrypted HTTP (port 80) and has direct internet exposure. This configuration allows an attacker to intercept traffic or exploit the lack of encryption to read sensitive customer data in transit, making unauthorized disclosure the primary risk. The core reasoning is that unencrypted HTTP exposes data to eavesdropping and man-in-the-middle attacks, directly violating confidentiality requirements for sensitive customer information.

Answer

Unauthorized modification of customer data

Answer

Data loss due to accidental deletion

Answer

Denial of service due to excessive read requests

Question 9

A risk assessment reveals that a legacy system has a high vulnerability score but low business criticality. The cost to remediate is high. What is the MOST appropriate risk response?

Accepted Answer

Accept the risk and monitor it. Acceptance is appropriate when the cost of mitigation exceeds the potential loss, and the system has low business criticality. Option A is wrong because avoidance (decommissioning) is an extreme measure for a system with low criticality; acceptance with monitoring is more proportionate. Option C is wrong because mitigation (patching) is costly and not justified given the low criticality. Option D is wrong because risk transfer (e.g., via managed security services) may not be feasible or cost-effective for a legacy system.

Answer

Avoid the risk by decommissioning the system

Answer

Mitigate the vulnerability with a patch

Answer

Transfer the risk via a managed security service

Question 10

An organization is conducting a business impact analysis (BIA) for its core banking system. Which of the following is the PRIMARY metric used to determine the urgency of recovery?

Accepted Answer

Maximum Tolerable Downtime (MTD). The Maximum Tolerable Downtime (MTD) is the primary metric for determining the urgency of recovery because it defines the total duration a business process can be unavailable before causing irreparable harm. For a core banking system, MTD directly reflects the maximum acceptable outage period from the business perspective, driving all recovery planning priorities.

Answer

Service Level Agreement (SLA)

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Question 11

During an IT risk assessment, a risk analyst discovers that a server contains sensitive customer data but is not included in the organization's vulnerability scanning program. What should the analyst do first?

Accepted Answer

Notify the vulnerability scan administrator to include the server in the next scan.. The analyst should report the missing server to the scan administrator to ensure it is included (Option B), as the immediate need is to close the scanning gap.

Answer

Add the server to the high-risk register immediately.

Answer

Perform a manual vulnerability assessment on the server.

Answer

Request an exception from management for the server to be exempt from scanning.

Question 12

Your organization is undergoing a merger and acquisition. The IT risk assessment team is tasked with evaluating the target company's IT environment. During the assessment, you discover that the target company uses a legacy ERP system that is no longer supported by the vendor. They have no disaster recovery plan for this system, and it contains financial data critical to the merged entity. The integration timeline is aggressive, and replacing the system would delay the merger by 18 months. The executive team is reluctant to delay. What is the BEST risk treatment option?

Accepted Answer

Mitigate by developing a disaster recovery plan and implementing compensating controls such as regular backups and manual procedures.. The legacy ERP system contains critical financial data and cannot be replaced without an 18-month delay, making risk mitigation the most practical approach. Developing a disaster recovery plan and implementing compensating controls (e.g., regular backups, manual procedures) reduces the likelihood and impact of a system failure while allowing the merger to proceed on schedule. This aligns with the CRISC principle of treating risk by reducing residual risk to an acceptable level without blocking business objectives.

Answer

Avoid the risk by excluding the legacy system from the merger and migrating data to a new system.

Answer

Accept the risk because the system has been running for years without issue.

Answer

Transfer the risk to the target company's previous owners.

Question 13

An organization is implementing a new identity and access management (IAM) system. The risk manager is tasked with identifying risks associated with the migration from legacy authentication to single sign-on (SSO). Which of the following is the GREATEST risk during this migration?

Accepted Answer

Legacy authentication accounts may remain active, creating orphan accounts.. Legacy accounts that are not disabled after migration become unmanaged orphan accounts, which can be exploited by attackers, posing a significant security risk. Option A is less severe because password reuse, while a risk, is not unique to this migration and is generally mitigated by SSO policies. Option B is incorrect because increased convenience does not inherently reduce security awareness; in fact, SSO can improve security by reducing password fatigue. Option D is incorrect because while help desk call volumes may initially rise, this is an operational issue, not a security risk, and is typically temporary.

Answer

Users may reuse strong passwords across multiple systems.

Answer

Users may experience increased convenience, leading to reduced security awareness.

Answer

Help desk call volumes may increase due to SSO authentication failures.

Question 14

During a quantitative risk analysis, the risk practitioner determines that the single loss expectancy (SLE) for a ransomware attack is $500,000 and the annualized rate of occurrence (ARO) is 0.4. The organization has a risk appetite that accepts annual losses up to $150,000. What is the recommended action?

Accepted Answer

Implement controls to reduce the likelihood or impact until ALE is below $150,000. The ALE is $500,000 * 0.4 = $200,000, which exceeds the organization's risk appetite of $150,000 per year. Therefore, the risk is not acceptable, and controls must be implemented to reduce either the SLE (impact) or ARO (likelihood) until the ALE falls below the risk appetite threshold. Option A is incorrect because purchasing insurance may transfer risk but does not address the need to bring ALE within appetite; the organization must first attempt to reduce risk cost-effectively. Option B is incorrect because the ALE exceeds the risk appetite, so acceptance is not justified. Option C is unnecessary; quantitative analysis already provides actionable data. Option D is the appropriate action as it aims to lower the risk to an acceptable level.

Answer

Purchase insurance to cover the potential loss

Answer

Accept the risk because it is within the organization's risk appetite

Answer

Reassess using qualitative analysis because the ARO is not precise

Question 15

A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?

Accepted Answer

Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.. Performing a root cause analysis on the firewall misconfigurations will help identify the underlying process weaknesses, such as deficiencies in change management or configuration review procedures, that allowed the misconfigurations to occur. This directly addresses the root cause of the risk. Option B is incorrect because although logging is valuable, it only captures changes and does not analyze the reasons behind the misconfigurations. Option C is incorrect because penetration testing identifies vulnerabilities but does not determine why the firewall rules were misconfigured in the first place. Option D is incorrect because updating the risk register is a subsequent step after identifying the root cause, not a method to discover it.

Answer

Implement additional logging on all firewall devices to capture configuration changes.

Answer

Conduct a penetration test targeting all regional office networks to identify vulnerabilities.

Answer

Update the risk register to include the incidents and assign risk owners.

Question 16

Refer to the exhibit. Based on the control test results, which of the following is the most immediate risk?

Accepted Answer

Fraud due to lack of segregation of duties. The control test results show that the same individual can both create purchase orders and approve invoices, which violates segregation of duties. This lack of segregation creates an immediate risk of fraud because the employee could create fictitious orders and approve payments to themselves or accomplices without detection.

Answer

Material misstatement in financial statements

Answer

Non-compliance with credit policy

Answer

Inefficient order processing

Question 17

A large bank has implemented a sophisticated risk and control monitoring system with multiple dashboards and automated reporting for key risk indicators (KRIs). However, the board of directors has been receiving conflicting KRI reports from different business units (e.g., retail banking, corporate lending, and wealth management). For example, the fraud KRI shows a high risk in retail but low risk in wealth management, yet both units use the same underlying data source. The chief risk officer (CRO) is concerned that the board is losing confidence in the risk reporting. An investigation reveals that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. What is the most likely root cause and the best remediation?

Accepted Answer

The KRI definitions and calculation methods are not standardized across business units.. The root cause is that KRI definitions and calculation methods are not standardized across business units, leading to inconsistent reporting that confuses the board. Standardizing these definitions and methods ensures comparability. Option A (reporting frequency) is not the core issue; the problem is inconsistency, not frequency. Option B (data sources) is incorrect because the investigation found the same underlying data source is used. Option C (board misinterpretation) is a symptom, not the root cause. Option D correctly identifies the lack of standardization as the primary issue.

Answer

The reporting frequency is inadequate; monthly reports should be weekly.

Answer

The data sources for KRIs are inconsistent across business units.

Answer

The board members are misinterpreting the KRI reports due to lack of training.

Question 18

A company relies on a third-party cloud provider for critical data processing. As part of its vendor risk management program, the company wants to implement continuous monitoring of the provider's controls. Which of the following is the BEST approach?

Accepted Answer

Obtain and review the provider's SOC 2 Type II report on an ongoing basis. A SOC 2 Type II report provides independent assurance over a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. Obtaining and reviewing this report on an ongoing basis (e.g., annually or upon issuance) is the most effective continuous monitoring approach because it offers a comprehensive, third-party assessment of control effectiveness over a period of time, directly addressing the need for ongoing vendor risk monitoring.

Answer

Monitor the provider's service level agreements (SLAs) for uptime

Answer

Conduct monthly manual attestation surveys with the provider

Answer

Require the provider to perform quarterly penetration tests

Question 19

A company's key risk indicator (KRI) for 'failed login attempts' has exceeded its threshold by 20%. The control owner reports that a recent firewall change caused false positives. What should the risk practitioner do FIRST?

Accepted Answer

Validate the KRI data and investigate the root cause. The first step when a KRI threshold is breached is to validate the data and investigate the root cause to determine if the breach is real or due to a false positive. The control owner's report of a firewall change causing false positives requires verification before any corrective action. Option B is premature because implementing additional controls without confirmation may address symptoms not the true cause. Option C is too drastic without understanding the impact of reverting the change. Option D would undermine the KRI's effectiveness and should only be considered after thorough analysis.

Answer

Implement additional controls to reduce failed logins

Answer

Revert the firewall change immediately

Answer

Increase the KRI threshold to eliminate false positives

Question 20

Refer to the exhibit. What is the most appropriate immediate action for the control failure?

Accepted Answer

Investigate the root cause of the failure because it occurred before the pass.. The control failure requires investigation even though it later passed. The root cause of the failure must be understood to prevent recurrence. Option D is correct because investigating the root cause is the most appropriate immediate action. Option A ignores the failure without analysis, which is unacceptable. Option C accepts the risk without understanding why the failure occurred. Option B escalates to the board prematurely before investigation.

Answer

Ignore as it was followed by a pass.

Answer

Escalate to the board.

Answer

Accept the control failure due to subsequent pass.