CRISC Practice Exam 59 — 20 Questions

Question 1

A financial services firm is identifying risks for a new mobile banking feature that will rely on a third-party identity verification provider. The vendor has provided a SOC 2 Type II report, but the firm has not yet reviewed it. Which of the following BEST describes how the firm should treat the vendor-related risk during identification?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Record the vendor dependency as a risk and assess it after reviewing the report's scope, period, and exceptions.. Third-party dependencies must be identified and recorded regardless of the assurance a vendor provides. The firm should log the dependency and then assess it using the SOC 2 Type II report's scope, coverage period, complementary user entity controls, and exceptions, so that residual risk is judged realistically. Assurance evidence informs the assessment; it does not remove the dependency from the register or transfer the firm's accountability.

Answer

Exclude vendor risk from the register because the SOC 2 Type II report demonstrates adequate controls.

Answer

Transfer the risk entirely to the vendor by referencing the SOC 2 report in the contract.

Answer

Defer identification until the vendor completes a penetration test of the identity verification platform.

Question 2

A risk analyst is building a scenario for a ransomware event affecting a hospital's electronic health record environment. The analyst wants to capture loss magnitude dimensions that are frequently overlooked when only direct recovery costs are counted. Which TWO loss factors should be included to make the magnitude estimate more complete? (Choose two.)

Accepted Answer

Regulatory penalties and notification obligations triggered by the breach of patient records.. Complete loss magnitude estimates for a ransomware scenario must extend past recovery costs to include consequential and secondary effects. Regulatory penalties and notification duties tied to compromised patient records, along with business interruption from unavailable clinical systems, are two such dimensions. Planned expenses such as license fees and prior training spend are not incident-driven losses and would distort the estimate.

Answer

The market price of the cryptocurrency demanded by the attacker at the time of the incident.

Answer

The salary of the security awareness trainer who delivered last year's phishing education sessions.

Answer

The annual license renewal cost the hospital already pays for its endpoint protection platform.

Question 3

A risk practitioner is designing a key risk indicator (KRI) program for a cloud-hosted customer portal. The CISO wants indicators that provide early warning of deteriorating risk conditions rather than reporting losses that have already occurred. Which TWO of the following are the MOST appropriate KRIs for this objective? (Choose two.)

Accepted Answer

Percentage of critical portal servers with missing high-severity patches older than 30 days. Leading indicators measure conditions that precede loss, such as unpatched high-severity vulnerabilities and privileged accounts without multifactor authentication. Both can be tracked continuously and remediated before an attacker exploits them. Breach counts, insurance premiums, and incident closure times all describe outcomes or costs that appear only after risk has already materialized.

Answer

Number of confirmed data breaches reported to regulators in the last quarter

Answer

Total annual cost of cyber insurance premiums for the customer portal

Answer

Average time to close security incidents after they have been detected

Question 4

A retail company is conducting a risk assessment for its new e-commerce platform. The assessment team is identifying inherent risks and wants to ensure they consider both internal and external factors that could increase the likelihood of a risk event. Which TWO of the following are examples of external factors that can increase inherent risk? (Choose two.)

Accepted Answer

New data privacy regulations imposed by the government.. External factors that increase inherent risk are those outside the organization's control, such as the evolving threat landscape and new regulations. The sophistication of cybercriminals and government-imposed data privacy regulations are both external. Internal factors like lack of training, outdated encryption, and high turnover are within the organization's control and are considered internal vulnerabilities or weaknesses.

Answer

The company's decision to use outdated encryption algorithms.

Answer

The company's high employee turnover rate in the IT department.

Answer

The lack of security awareness training for the company's employees.

Question 5

A credit union's risk committee has approved a risk response for its core banking platform: purchase an insurance policy against ransomware losses and keep the current backup process unchanged. Six months later, a ransomware event encrypts production data and the backup restoration takes four days, breaching regulatory reporting deadlines. Which risk response did the risk committee most likely select, and why did it fail to address the operational impact?

Accepted Answer

Risk transfer, because insurance shifted the financial loss but did not reduce the likelihood or duration of the service outage.. The committee chose a risk transfer response by buying insurance, which addresses only the financial consequence of a ransomware loss. Because backups and recovery capabilities were left unchanged, the operational and regulatory impacts remained fully exposed, and the four-day restoration breached reporting deadlines. Effective risk response selection must consider whether the chosen treatment addresses the specific impact categories the organization cares about, not just the monetary loss.

Answer

Risk mitigation, because the insurance policy reduced the likelihood of a ransomware attack.

Answer

Risk avoidance, because the committee decided not to invest in additional backup controls.

Answer

Risk acceptance, because the committee acknowledged the residual risk without purchasing insurance.

Question 6

A risk practitioner is preparing an IT risk report for the board risk committee. The committee has limited technical background and meets quarterly. Which of the following is the MOST appropriate way to present the aggregated IT risk exposure?

Accepted Answer

A heat map showing inherent and residual risk ratings mapped to the enterprise risk taxonomy. Board-level risk reporting must translate technical detail into business-relevant exposure that can be compared, aggregated, and tracked over time. Mapping inherent and residual ratings to the enterprise risk taxonomy lets the committee see IT risk alongside other risk categories and judge whether responses are proportionate. Raw findings, individual control tests, and single operational metrics all require interpretation the committee should not have to perform.

Answer

A raw export of the vulnerability scanner console showing every open finding with its CVSS score

Answer

The mean time to remediate critical incidents compared with the prior four quarters

Answer

A list of every control test performed during the quarter with pass or fail results

Question 7

A financial services firm is defining the scope of its annual IT risk assessment. The board has asked the risk team to ensure the assessment covers both internal and external factors that could affect the confidentiality of customer data. Which TWO activities should the team include to meet this expectation? (Choose two.)

Accepted Answer

Inventory and classify all internal systems and data repositories that store or process customer information.. A complete assessment scope requires knowing what must be protected and what could threaten it. Inventorying and classifying internal data repositories establishes the internal view, while mapping external threat sources and third-party attack surface establishes the external view. Prior findings, internal-only limits, and opinion surveys do not deliver this coverage, so they cannot fulfill the board's request.

Answer

Review last year's audit findings and assume the same scope remains valid.

Answer

Limit the assessment to systems managed by the internal IT department.

Answer

Survey employees about their personal opinions on data privacy regulations.

Question 8

A software company has a risk appetite statement allowing no more than two hours of downtime per quarter for its customer-facing API. During a quarterly review, the risk practitioner discovers that a single unplanned database failover event caused 90 minutes of downtime, and a separate configuration error caused 45 minutes. Both events were resolved, but no root cause analysis was completed for either. Which of the following should the risk practitioner recommend FIRST?

Accepted Answer

Initiate a root cause analysis for both incidents to determine whether the downtime events share an underlying control weakness.. The downtime exceeded the stated appetite, and the lack of root cause analysis leaves the reason for the breach unknown. The practitioner's first step should be to investigate both incidents and determine whether a shared control weakness exists. Only with that understanding can a proportionate response be selected, reported accurately, or escalated to governance with meaningful options rather than an unexplained breach.

Answer

Report to the board that the downtime appetite has been breached and await direction on a response.

Answer

Revise the risk appetite statement to allow three hours of quarterly downtime, reflecting actual operational reality.

Answer

Recommend immediate investment in a redundant database cluster to prevent future failover downtime.

Question 9

A risk team is assessing a legacy inventory system that supports a product line scheduled for retirement in nine months. The system has an unpatched vulnerability that cannot be remediated without breaking vendor support, and the business has confirmed it will not extend the product line. Which risk response is MOST appropriate for the remaining exposure?

Accepted Answer

Accept the risk with documented justification, because the exposure is bounded by the scheduled decommissioning date.. When exposure is bounded by a firm decommissioning date and remediation would cause greater harm than the residual risk itself, documented acceptance with monitoring is the proportionate response. It preserves business continuity through the retirement window, keeps the decision auditable, and avoids introducing new operational risk through disruptive patching or premature shutdown.

Answer

Transfer the risk by purchasing a standalone cyber insurance policy covering legacy system vulnerabilities.

Answer

Mitigate the vulnerability by applying the vendor patch immediately and accepting any resulting support disruption.

Answer

Avoid the risk by shutting down the inventory system immediately and ceasing the product line ahead of schedule.

Question 10

A software development company is assessing the risk of a data breach in its cloud-based source code repository. The risk assessment team has identified that the repository contains proprietary algorithms and customer data. The team is considering implementing a control that would encrypt the data at rest. Which of the following BEST describes the impact of this control on the risk?

Accepted Answer

It reduces the impact of a data breach by rendering the data unreadable to unauthorized parties.. Encryption at rest is a control that reduces the impact of a data breach by making the data unreadable without the decryption key. It does not reduce the likelihood of an attacker gaining access, nor does it transfer or eliminate the risk. It is an impact-mitigating control that protects confidentiality even if other defenses fail. This aligns with the principle of defense in depth.

Answer

It eliminates the risk of a data breach entirely.

Answer

It transfers the risk to the cloud provider.

Answer

It reduces the likelihood of a data breach by making it harder for attackers to access the data.

Question 11

A financial services firm's risk register shows that a legacy payment gateway has a high inherent risk of SQL injection. The security team proposes deploying a web application firewall (WAF) in front of the gateway. The risk owner must document how this action will be classified in the risk response plan. Which risk response strategy does deploying the WAF represent?

Accepted Answer

Risk mitigation. Applying a web application firewall reduces the likelihood and impact of SQL injection against the legacy payment gateway, which is the definition of risk mitigation. The organization continues to operate the asset and retains the residual risk, so avoidance, transfer, and acceptance do not describe the action. Correct classification matters because the risk register and reporting must reflect the true response strategy and its effect on residual risk.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 12

A financial services firm maintains a risk register that lists inherent risk ratings for its core banking platform. During an internal audit, the CIO notes that the register has not been updated to reflect the controls implemented over the past 18 months. Which of the following should the risk practitioner do FIRST to address this gap?

Accepted Answer

Reassess the residual risk for each entry by evaluating the effectiveness of the implemented controls.. The register captured inherent risk but never reflected the controls deployed over 18 months, so the residual risk position is stale. The practitioner must evaluate control effectiveness and recalculate residual risk for each affected entry. Escalation, deletion, or relabeling do not correct the data and would leave decision-makers with a misleading view of the firm's actual risk exposure.

Answer

Remove the affected entries from the register until a complete enterprise risk assessment can be scheduled.

Answer

Reclassify all entries from inherent to residual risk so the register aligns with the audit terminology.

Answer

Escalate the finding to the board risk committee and request additional budget for a full risk assessment.

Question 13

A financial services firm has completed a risk assessment and determined that the residual risk for its online banking platform exceeds the board-approved risk appetite. The CISO must recommend risk response options to the risk committee. Which TWO of the following are appropriate risk response actions? (Choose two.)

Accepted Answer

Implement additional compensating controls to reduce the residual risk to within appetite. When residual risk exceeds appetite, the risk owner must choose from the recognized response set: mitigate, transfer, avoid, or accept with proper authority. Applying compensating controls reduces the exposure, and transferring part of the financial consequence through insurance addresses what remains. Accepting without authority, recalculating assumptions to change the rating, and deleting the risk from the register are not legitimate responses because they alter the record rather than the risk.

Answer

Remove the platform from the risk register so it no longer appears as an exception in committee reporting

Answer

Recalculate the annualized loss expectancy using a lower single loss expectancy to bring the rating within tolerance

Answer

Accept the residual risk without further action because the platform generates significant revenue

Question 14

A multinational retailer operates in 14 countries and must report IT risk to its board quarterly. The CISO wants the reporting to drive decisions rather than merely satisfy auditors. Which of the following is the MOST important characteristic of the quarterly IT risk report?

Accepted Answer

It links IT risk exposure to business objectives and states the residual risk against the board-approved risk appetite.. Effective board reporting translates IT risk into business terms and states residual risk relative to the board-approved risk appetite, enabling directors to make informed decisions about resource allocation and tolerance. Technical inventories, compliance activity metrics, and peer benchmarks may supplement the report but do not by themselves show whether the organization is operating within acceptable risk limits, which is the primary purpose of quarterly risk reporting to the board.

Answer

It reports the percentage of controls tested and the number of audit findings closed during the quarter.

Answer

It includes a complete inventory of every vulnerability detected during the quarter, ranked by CVSS score.

Answer

It compares the organization's risk scores with those of industry peers using a published benchmark.

Question 15

A healthcare provider has determined that a new telehealth platform introduces risks that exceed its defined risk tolerance. Senior management decides to purchase cyber insurance to cover potential breach costs rather than modify the platform. Which risk response is management applying?

Accepted Answer

Risk transfer. Insurance shifts the financial burden of a potential breach to the insurer, which is the defining characteristic of risk transfer. The telehealth platform continues to operate, so the risk is not avoided, and no technical control was added, so it is not mitigated. Because management acted rather than simply tolerating the exposure, acceptance does not apply.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 16

A healthcare insurer's risk committee is reviewing key risk indicators (KRIs) for its claims processing platform. The committee wants to ensure the KRIs are actionable and tied to risk appetite. Which TWO of the following characteristics are MOST important for these KRIs to meet that objective? (Choose two.)

Accepted Answer

Each KRI is directly linked to one or more identified risks and the corresponding risk appetite statement.. Actionable KRIs tied to risk appetite must connect to specific risks and appetite statements and must have thresholds that trigger defined responses. These two characteristics ensure the committee can interpret the indicator and act before the claims platform exposure exceeds tolerance. Measurement frequency and format are secondary considerations, and assurance review is not a substitute for management ownership of the indicators.

Answer

Each KRI is reviewed annually by internal audit to confirm it remains relevant to the business.

Answer

Each KRI is measured using data that is manually collected once per quarter to ensure accuracy.

Answer

Each KRI is expressed as a monetary value so it can be aggregated with financial risk metrics.

Question 17

A software company has completed a risk assessment showing that a critical SaaS platform has a residual risk above appetite due to weak vendor access controls. Budget is limited and the remediation will take six months. The CISO must decide how to proceed while the risk remains elevated. Which action BEST aligns with CRISC risk response principles?

Accepted Answer

Document an interim compensating control, set a remediation timeline, and obtain formal risk acceptance from the accountable business owner until closure.. With residual risk above appetite and remediation requiring six months, the sound approach is to implement interim compensating controls, establish a remediation timeline, and obtain formal acceptance from the accountable business owner. This keeps exposure transparent and owned while respecting business continuity. Suspending service, manipulating ratings, or merely notifying the vendor do not appropriately manage the risk or satisfy governance and reporting expectations.

Answer

Transfer the risk to the SaaS vendor by sending a notification letter describing the control weaknesses.

Answer

Lower the inherent risk rating in the register so that residual risk falls within the approved appetite.

Answer

Suspend all access to the SaaS platform until the vendor access controls are fully remediated.

Question 18

A risk practitioner at a regional bank is building risk scenarios for the new mobile check deposit feature. The team has identified the event 'attackers exploit a vulnerability in the image processing library to inject malicious code.' Which of the following BEST describes the element that is missing from this risk scenario?

Accepted Answer

The asset or business process affected and the resulting business impact.. ISACA describes a risk scenario as a threat event acting on an asset or process and producing a business impact. The stem supplies the threat and vulnerability but omits the affected asset and consequence, so the practitioner cannot assess likelihood or impact meaningfully. Adding the asset and impact makes the scenario actionable for risk analysis and prioritization.

Answer

The threat community profile, including capability and intent.

Answer

The control environment currently in place to mitigate the event.

Answer

The regulatory requirement that mandates protection of customer data.

Question 19

A retail company is migrating its customer loyalty application to a cloud provider. During a risk assessment, the risk practitioner notes that the provider's infrastructure is shared across many tenants. Which of the following is the MOST significant risk that this multi-tenancy introduces?

Accepted Answer

A vulnerability in the provider's isolation controls could allow one tenant to access another tenant's data.. Multi-tenancy introduces the risk that logical isolation controls may fail, allowing one tenant to access another tenant's data or workloads. This directly threatens confidentiality and integrity and is unique to shared cloud environments. Other risks such as provider failure, loss of scanning, or price changes are important but are not caused by the shared infrastructure model itself.

Answer

The cost of cloud services may increase unexpectedly due to provider pricing changes.

Answer

The organization loses the ability to perform its own vulnerability scanning on the underlying infrastructure.

Answer

The cloud provider may go out of business, causing an abrupt loss of service.

Question 20

An organization's risk register shows that a critical database containing customer records has a high inherent risk rating. Management installs database activity monitoring, enforces encryption at rest, and implements quarterly access reviews. After these actions, the risk is re-rated as medium. Which risk concept does the re-rated medium value BEST represent?

Accepted Answer

Residual risk. Residual risk is the exposure that remains after controls are applied, and it is the figure decision makers should compare against tolerance. The database started with a high inherent rating; monitoring, encryption, and periodic access reviews lowered the likelihood and impact, producing a medium residual rating. Reporting residual risk keeps the risk register meaningful and prevents the organization from funding controls for exposure that has already been mitigated.

Answer

Risk appetite

Answer

Control risk

Answer

Inherent risk