CRISC Practice Exam 59 — 20 Questions

Question 1

A mid-sized retail company processes over 1 million credit card transactions daily. It uses an automated monitoring system with static thresholds to flag potential fraud. Recently, the fraud detection team has been overwhelmed by a 40% increase in false positive alerts, causing legitimate transactions to be delayed and customer service complaints to rise. The risk manager is tasked with improving the situation. After reviewing the alert logs, it is clear that the thresholds have not been updated in 18 months, and transaction patterns have shifted due to seasonal promotions and new payment methods. The team has limited resources and cannot handle the current alert volume. What should the risk manager recommend as the most effective course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a root cause analysis on the false positives to refine the detection rules and thresholds.. Performing a root cause analysis to refine detection rules and thresholds (Option A) directly addresses the outdated thresholds that caused the increase in false positives. This approach is systematic and can be tailored to the current transaction patterns without requiring additional resources or tools. Option B (deploying a machine learning tool) introduces new complexity and costs without fixing the underlying threshold issue, and the team's limited resources may hinder implementation. Option C (hiring an external consultant) is costly and slow, and may not be sustainable. Option D (increasing thresholds immediately) could reduce alert volume but risks missing true positives, making it a temporary fix rather than a long-term solution.

Answer

Deploy an additional monitoring tool with machine learning capabilities.

Answer

Engage an external fraud detection consultant to review the system.

Answer

Immediately increase the alert thresholds to reduce the volume of alerts.

Question 2

Which TWO of the following are characteristics of an effective key risk indicator (KRI)?

Accepted Answer

Predictive in nature.. An effective KRI must be predictive in nature because it provides early warning signs of increasing risk exposure before a loss event occurs. Predictive KRIs allow risk owners to take proactive mitigating actions, whereas lagging indicators only confirm past failures. This forward-looking characteristic is essential for risk monitoring and timely decision-making.

Answer

Based on historical data only.

Answer

Static.

Answer

Subjective.

Question 3

A retail company is identifying risks in its supply chain. Which approach is most effective for identifying previously unknown risks?

Accepted Answer

Scenario analysis with supply chain partners. Scenario analysis with supply chain partners is most effective for identifying previously unknown risks because it leverages collaborative brainstorming and 'what-if' thinking to uncover emergent threats that are not captured by historical data or static checklists. This approach is particularly valuable in supply chain contexts where interdependencies, third-party vulnerabilities, and novel disruptions (e.g., a new cyberattack vector targeting a logistics provider) can surface only through joint exploration of hypothetical events. It aligns with the CRISC emphasis on proactive risk identification beyond known patterns.

Answer

Employee surveys

Answer

Financial audit reports

Answer

Review of standard risk checklists

Question 4

A regional bank uses a centralized GRC platform to monitor key risk indicators (KRIs) for operational risk. The chief risk officer (CRO) reviews the monthly risk report and notices that the KRI 'number of system outages exceeding 4 hours' has been consistently reported as 0 for the past six months. However, the IT incident log shows three such outages in the same period. The CRO suspects the KRI is not being accurately reported. What should the risk manager do next?

Accepted Answer

Investigate the KRI calculation and data feed to identify why outages are not being captured. The risk manager must first investigate the KRI calculation and data feed to determine why the IT incident log shows three outages but the KRI reports zero. Without understanding the root cause of the reporting discrepancy—whether it is a data integration error, a threshold misconfiguration, or a failure in the GRC platform's automated data collection—any subsequent action would be premature and could mask the underlying control monitoring failure.

Answer

Add additional controls to reduce the likelihood of system outages

Answer

Update the risk register to reflect the recent outage incidents

Answer

Increase the KRI threshold to 2 outages to align with historical data

Question 5

Based on the exhibit, what risk does this database error MOST directly indicate?

Accepted Answer

Risk of data inconsistency due to concurrency issues. The database error indicates a concurrency control failure, such as a deadlock or serialization anomaly, which directly leads to data inconsistency when multiple transactions execute simultaneously without proper isolation. This is a classic risk in multi-user database environments where ACID properties are violated, resulting in lost updates or dirty reads.

Answer

SQL injection vulnerability

Answer

Unauthorized access to employee records

Answer

Insufficient disk space for transactions

Question 6

During a risk identification workshop, the business process owner states that a key system has no documented dependencies. What is the BEST next step for the risk practitioner?

Accepted Answer

Document the missing dependency information as a risk in the risk register. Undocumented dependencies represent an unknown risk that must be captured in the risk register to ensure visibility and subsequent analysis. By documenting the missing dependency information as a risk, the risk practitioner formally acknowledges the gap, enabling further investigation into potential single points of failure, cascading failures, or unmonitored interconnections that could impact system availability or integrity.

Answer

Ask the system administrator to provide a list after the workshop

Answer

Postpone the workshop until dependencies are mapped

Answer

Assume the system has no dependencies

Question 7

An organization is implementing a new access control system to prevent unauthorized access to sensitive data. Which type of control is being implemented?

Accepted Answer

Preventive control. An access control system that prevents unauthorized access to sensitive data is a preventive control because it enforces security policies before access is granted. Technologies like mandatory access control (MAC) or role-based access control (RBAC) with Access Control Lists (ACLs) block unauthorized users at the point of entry, reducing the risk of data exposure.

Answer

Detective control

Answer

Compensating control

Answer

Corrective control

Question 8

A risk practitioner is evaluating the effectiveness of a security awareness program. Which TWO indicators would BEST measure whether the program is positively influencing risk culture? (Select TWO)

Accepted Answer

Increase in reported phishing attempts by employees. An increase in reported phishing attempts indicates that employees are more vigilant and willing to report suspicious activity, which is a direct behavioral measure of a positive risk culture. A decrease in incidents caused by human error shows that the training has effectively changed behavior and reduced risk exposure. Both indicators reflect actual risk-aware actions rather than mere completion metrics.

Answer

Time spent on training per employee

Answer

Number of security policies updated

Answer

Number of employees who completed training

Question 9

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Accepted Answer

Accept the risk and continue monitoring. R-0042 is a low-likelihood, low-impact risk involving PII stored with AES-256 encryption and strict access controls. The residual risk is within the organization's risk appetite, making acceptance with continued monitoring the most appropriate response. Mitigation, transfer, or avoidance would introduce unnecessary cost or operational disruption for a risk already well-controlled.

Answer

Mitigate the risk by implementing additional encryption controls

Answer

Transfer the risk to a third-party insurer

Answer

Avoid the risk by discontinuing storage of PII

Question 10

A multinational corporation is developing its IT risk reporting structure. The risk manager must align reports with different audiences. Which THREE of the following reporting frequencies and audiences are correctly matched?

Accepted Answer

Strategic risk reporting: semi-annual to the board. Strategic risk reporting, which addresses high-level enterprise risks and long-term objectives, is appropriately directed to the board of directors on a semi-annual basis. This frequency aligns with the board's oversight role and the need for periodic, aggregated risk insights without overwhelming them with operational details.

Answer

Tactical risk reporting: monthly to the board

Answer

Strategic risk reporting: weekly to the board

Question 11

An organization is designing a risk dashboard for senior management. Which of the following is the MOST important characteristic of the key risk indicators (KRIs) displayed?

Accepted Answer

They are directly linked to the risk appetite thresholds.. For a risk dashboard designed for senior management, the most important characteristic of KRIs is that they are directly linked to risk appetite thresholds. This linkage ensures that the dashboard provides actionable insights by immediately signaling when risk levels exceed or approach the organization's defined tolerance limits, enabling timely decision-making. Without this direct connection, even real-time or accurate data would fail to convey whether the organization is operating within acceptable risk boundaries.

Answer

They are updated in real-time.

Answer

They are based on accurate historical data.

Answer

They are cost-effective to collect and maintain.

Question 12

A small e-commerce company has identified a high-risk vulnerability in its payment processing system that could expose customer credit card data. The IT team recommends immediately patching the system, but the patch requires a 4-hour downtime during peak sales hours. The risk manager proposes accepting the risk until the next scheduled maintenance window in two weeks. The CEO is concerned about potential fines from PCI DSS non-compliance. What is the BEST course of action?

Accepted Answer

Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.. The best course of action because implementing a compensating control (such as a web application firewall) immediately reduces the risk of data exposure while the patch is scheduled during off-peak hours within 48 hours, addressing PCI DSS compliance concerns without incurring significant revenue loss. Option A is wrong because accepting the risk without immediate mitigation violates PCI DSS requirements and exposes the company to fines. Option B is wrong because simply accepting the risk until the next maintenance window does not address the high-risk vulnerability and compliance obligations. Option C is wrong because applying the patch during peak hours causes excessive revenue loss and customer impact, whereas the compensating control approach provides a balanced risk response.

Answer

Delay the patch until the next maintenance window but document the risk acceptance with CEO sign-off.

Answer

Accept the risk and schedule the patch during the next maintenance window as originally planned.

Answer

Apply the patch immediately during peak hours, accepting the revenue loss from downtime.

Question 13

A risk practitioner is reviewing system logs and notices multiple failed login attempts from a foreign IP address. This observation is an example of which type of risk identification activity?

Accepted Answer

Incident and event monitoring. The observation of multiple failed login attempts from a foreign IP address is a direct result of reviewing system logs, which is a core component of incident and event monitoring. This activity involves the continuous surveillance of security events to detect anomalies, such as brute-force attacks, and is a reactive risk identification technique that identifies risks based on actual occurrences.

Answer

Control self-assessment

Answer

Threat intelligence gathering

Answer

Vulnerability scanning

Question 14

An IT risk manager is reviewing the results of a recent risk assessment. The organization has a risk appetite that allows for low residual risk. One identified risk has an inherent risk score of 15 (on a scale of 1-25) and currently has no controls. Which of the following is the BEST recommendation for this risk?

Accepted Answer

Implement controls to reduce the residual risk to an acceptable level.. The inherent risk score of 15 (out of 25) is moderate, but the organization's risk appetite allows only low residual risk. Since there are currently no controls, the residual risk equals the inherent risk of 15, which exceeds the acceptable threshold. Therefore, implementing controls is the best recommendation to reduce the residual risk to a level that aligns with the risk appetite.

Answer

Accept the risk because the score is moderate.

Answer

Transfer the risk via cyber insurance.

Answer

Avoid the risk by discontinuing the business process.

Question 15

A government agency is migrating its critical applications to a public cloud infrastructure. The risk assessment reveals that the cloud provider uses shared tenancy, and the agency's sensitive data will be stored alongside other customers' data. The agency has a very low risk appetite for data leakage and must comply with strict data sovereignty laws. The cloud provider offers data encryption at rest and in transit, as well as dedicated hardware security modules (HSMs) for key management. However, the provider's physical datacenters are located in another country with different legal frameworks. As the risk practitioner, which of the following should be the PRIMARY risk response?

Accepted Answer

Avoid the risk by keeping sensitive data on-premises and using the cloud only for non-sensitive workloads.. The agency's very low risk appetite for data leakage and strict data sovereignty laws cannot be adequately mitigated by encryption or contractual measures when the physical datacenters are in a foreign jurisdiction with different legal frameworks. Shared tenancy in a public cloud inherently increases the attack surface for side-channel attacks and misconfiguration risks, and even with encryption at rest (e.g., AES-256) and in transit (e.g., TLS 1.3), the cloud provider's staff or foreign legal authorities could potentially access decryption keys or compel key disclosure. Avoiding the risk by keeping sensitive data on-premises eliminates the exposure to foreign legal frameworks and shared tenancy, directly aligning with the agency's risk appetite.

Answer

Reduce the risk by negotiating a contract that includes specific data handling clauses and audit rights.

Answer

Transfer the risk by requiring the provider to maintain a large cyber insurance policy.

Answer

Accept the risk after verifying the provider's compliance certifications.

Question 16

Based on the exhibit, what is the MOST appropriate immediate risk response?

Accepted Answer

Implement compensating controls. The exhibit indicates a critical vulnerability in a core network device (e.g., a Cisco router with a known CVE in its IOS) that is actively being exploited. Implementing compensating controls, such as deploying an access control list (ACL) to block the exploit's specific traffic pattern or enabling Control Plane Policing (CoPP), immediately reduces the attack surface while a permanent patch is scheduled. This is the most appropriate response because it directly mitigates the risk without waiting for a vendor fix or accepting potential compromise.

Answer

Transfer the risk

Answer

Accept the risk

Answer

Ignore the risk

Question 17

Which risk reporting frequency is most appropriate for tactical risk reporting to the CISO/CIO?

Accepted Answer

Quarterly. Tactical risk reporting typically occurs quarterly to provide a balance between timeliness and stability for management decision-making.

Answer

Weekly

Answer

Monthly

Answer

Annually

Question 18

Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system (IDS) alerts. An intrusion detection system (IDS) monitors network traffic for suspicious activity and generates alerts when it detects potential threats. This is a detective control because it identifies and reports security incidents after they occur, rather than preventing them. IDS alerts provide visibility into ongoing or past attacks, enabling incident response.

Answer

Backup restoration after data loss

Answer

Firewall rules blocking unauthorized traffic

Answer

Requiring two-factor authentication

Question 19

An organization uses a SIEM to automatically test access control rules on a continuous basis. This is an example of which type of monitoring?

Accepted Answer

Continuous monitoring. A SIEM that automatically tests access control rules on a continuous basis performs ongoing validation of rule effectiveness and compliance. This is a classic example of continuous monitoring, where security controls are assessed in real-time or near-real-time without manual intervention, ensuring that access policies remain effective against evolving threats.

Answer

Key Risk Indicator monitoring

Answer

Vulnerability scanning

Answer

Periodic control testing

Question 20

During a control monitoring review, the auditor finds that a control designed to detect unauthorized access has not triggered any alerts in six months. What should the risk practitioner do first?

Accepted Answer

Test the control to ensure it is functioning correctly.. The absence of alerts does not automatically confirm that the control is working; it could indicate that the control has failed silently or that the detection logic is misconfigured. The risk practitioner must first test the control (e.g., by simulating an unauthorized access attempt) to verify that it can actually detect and alert on violations. Only after confirming correct functionality can the lack of alerts be interpreted as evidence of effectiveness.

Answer

Document the lack of alerts as evidence of effectiveness.

Answer

Redesign the control with different parameters.

Answer

Increase the frequency of monitoring.