CRISC Practice Exam 60 — 20 Questions

Question 1

A logistics firm relies on a third-party cloud provider to host its shipment tracking system. The provider's latest SOC 2 report includes a qualified opinion noting that access review controls were not operating effectively during part of the audit period. The firm's risk practitioner must determine the appropriate risk response. Which of the following is the MOST appropriate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assess the impact of the access review exception on the firm's data and implement compensating controls while the provider remediates.. A qualified SOC 2 opinion identifies a real control failure at the provider, so the firm cannot simply accept the risk or wait a year for the next report. The practitioner should assess how the access review weakness affects the shipment tracking data and deploy compensating controls during remediation. This protects the firm while preserving the vendor relationship and allows for a proportionate, evidence-based response.

Answer

Terminate the contract immediately and migrate the shipment tracking system to a different provider.

Answer

Request the provider's remediation plan and take no further action until the next annual SOC 2 report is issued.

Answer

Accept the risk because the provider holds a SOC 2 report, which demonstrates an adequate control environment.

Question 2

An organization's risk committee is reviewing a consolidated IT risk report before a board meeting. The report shows that a critical payment system has a residual risk rating above tolerance, but the remediation project is not scheduled to complete for nine months due to vendor dependencies. The committee must decide how to report this to the board. Which of the following is the MOST appropriate action?

Accepted Answer

Recommend that the board formally accept the risk above tolerance until remediation completes, documenting the rationale and interim compensating controls.. Residual risk above tolerance that cannot be remediated promptly requires formal acceptance by the governing body. The committee should present the timeline, the vendor dependency, and any compensating controls so the board can make an informed decision. Concealing the timeline, relabeling the risk, or delaying the report all deprive the board of information it needs and violate reporting integrity.

Answer

Delay the board report until the remediation project completes so the report shows only risks within tolerance.

Answer

Report the risk as being addressed by the remediation project and omit the completion timeline to avoid alarming the board.

Answer

Reclassify the residual risk as inherent risk so the rating falls within the board-approved tolerance threshold.

Question 3

A financial services firm's IT risk register shows that a legacy payment gateway has a high inherent risk of data breach. Management decides to purchase a cyber insurance policy that covers up to $5 million per incident, while keeping the gateway in production unchanged. Which risk response option has management chosen?

Accepted Answer

Risk transfer. The scenario describes management choosing to keep the high-risk payment gateway in production while purchasing an insurance policy to cover financial losses. This is risk transfer because the financial impact of a potential breach is shifted to the insurer. Risk mitigation would require implementing controls to reduce likelihood or impact, avoidance would require eliminating the gateway, and acceptance would mean bearing the loss without transferring it.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 4

A multinational retailer's risk register shows a high inherent risk for its point-of-sale (POS) payment environment. After implementing tokenization, the risk owner records a residual risk rating of low. During the next quarterly review, the internal audit team finds that several legacy POS terminals still transmit clear-text card data. Which risk response principle was violated?

Accepted Answer

Risk response must be validated against actual control coverage before residual risk is reported.. Residual risk is only meaningful when it reflects validated control effectiveness across the full scope of the risk. The risk owner lowered the rating based on tokenization without confirming that legacy terminals were included, so the reported low residual risk was inaccurate. Risk response and reporting require evidence that controls operate as designed before risk ratings are adjusted downward, and audit findings should trigger reassessment of the affected register entries.

Answer

Risk response must transfer residual risk to a third party whenever inherent risk is rated high.

Answer

Risk response must be approved by the board before any residual risk rating can be lowered.

Answer

Risk response must always prioritize risk avoidance over risk mitigation for payment environments.

Question 5

A hospital's risk practitioner is identifying risks for a new telehealth platform. The IT director asks which source would be MOST useful for identifying vulnerabilities specific to the platform's underlying commercial software components. Which of the following should the practitioner use?

Accepted Answer

The Common Vulnerabilities and Exposures (CVE) database.. CVE is the standard reference catalog for publicly known vulnerabilities in commercial and open-source products, making it the most direct source for identifying weaknesses in the telehealth platform's software components. The other sources address incidents, business impact, or service performance rather than the technical vulnerabilities present in the commercial software itself.

Answer

A business impact analysis (BIA) questionnaire.

Answer

The IT balanced scorecard and service level reports.

Answer

The organization's incident response postmortem reports.

Question 6

A retail company's IT risk manager is preparing a report for the board's audit committee. The report must summarize the current status of the top ten IT risks, the effectiveness of related controls, and any changes since the last quarter. Which of the following is the MOST important quality for this report to possess?

Accepted Answer

It provides a balanced view of risk exposure and control effectiveness, including areas where remediation is behind schedule.. The report's primary purpose is to enable the audit committee to oversee IT risk effectively. That requires a balanced presentation of exposures and control effectiveness, including unfavorable information such as overdue remediation. Reports skewed toward technical detail, only positive trends, or exhaustive risk lists fail to support informed governance and can hide material exposures from those accountable for oversight.

Answer

It includes every identified IT risk in the register to ensure completeness of disclosure.

Answer

It focuses exclusively on risks that have decreased since the prior reporting period to show progress.

Answer

It uses detailed technical terminology to demonstrate the depth of the IT risk team's analysis.

Question 7

A risk practitioner is estimating the likelihood of a ransomware event for a manufacturing firm. The firm has endpoint protection, network segmentation, and offline backups, but the practitioner learns that a third-party maintenance vendor has persistent remote access with shared credentials and no multi-factor authentication. Which of the following BEST explains how this finding should affect the likelihood estimate?

Accepted Answer

Likelihood should increase because the vendor access path provides an unmitigated entry point.. Likelihood reflects how probable an event is given the threat environment and existing controls. The vendor's shared credentials and lack of multi-factor authentication create a persistent, low-effort entry point that bypasses internal defenses, so it raises the probability of a successful ransomware intrusion. Backup availability and industry averages address recovery and context, not this specific exposure.

Answer

Likelihood should be set to the industry average for manufacturing ransomware incidents.

Answer

Likelihood should decrease because the firm's existing controls are strong.

Answer

Likelihood should remain unchanged because backup availability determines ransomware outcomes.

Question 8

A healthcare payer's risk committee is deciding how to respond to a risk that its cloud-hosted claims processing platform could become unavailable for more than 24 hours. The platform is critical, the provider offers a financially backed 99.95% availability commitment, and the organization lacks the internal capability to run a secondary environment. Which risk response is MOST appropriate?

Accepted Answer

Transfer the financial consequence through contract terms and insurance while implementing a tested recovery capability with the provider.. For a critical platform with no internal recovery capability, the realistic response is layered: contractual remedies and insurance transfer the financial loss, while provider-supported recovery arrangements mitigate the operational outage. Pure acceptance leaves patients and regulators exposed, avoidance is disproportionate, and a stronger SLA alone changes expectations without building the capability to restore service.

Answer

Avoid the risk entirely by terminating the cloud contract and rebuilding the claims platform in an internally managed data center.

Answer

Accept the risk and document the decision, relying on the provider's service level agreement as the sole safeguard.

Answer

Reduce the risk by negotiating a higher availability percentage in the service level agreement without adding recovery arrangements.

Question 9

A multinational retailer's IT risk manager must define key risk indicators (KRIs) for its third-party payment processing relationships. Which TWO characteristics must the selected KRIs exhibit to be effective for ongoing risk monitoring? (Choose two.)

Accepted Answer

They are tied to a specific risk statement and have defined thresholds that trigger escalation.. Effective KRIs are quantifiable on a reliable schedule and explicitly tied to a risk with thresholds that drive escalation. Those two properties turn measurement into monitoring. Restricting indicators to monetary units, refreshing them only annually, or hiding them from the vendor all break the feedback loop that makes an indicator actionable for third-party payment risk.

Answer

They are kept confidential from the vendor so the vendor cannot influence the reported results.

Answer

They are reviewed and updated only during the annual enterprise risk assessment cycle.

Answer

They are expressed exclusively as monetary values so executives can compare them to budget.

Question 10

A risk practitioner is assessing the risk of a distributed denial-of-service (DDoS) attack against an online retailer's public storefront. The CISO asks which factors would MOST directly increase the likelihood that such an attack would succeed in disrupting service. (Choose two.)

Accepted Answer

The storefront's public IP addresses are easily discoverable through DNS records.. DDoS success hinges on whether attack traffic can reach and overwhelm the target. Missing upstream mitigation lets traffic hit the origin unfiltered, and discoverable origin IP addresses let attackers bypass protective layers to strike directly. Together these conditions materially raise the likelihood of service disruption, while payment options, marketing spikes, and support outsourcing do not directly determine whether the attack succeeds.

Answer

The retailer's marketing team runs frequent flash sales with unpredictable traffic spikes.

Answer

The retailer accepts multiple payment card brands at checkout.

Answer

The retailer's customer service team is outsourced to a third party.

Question 11

An organization's risk register lists a risk with an annualized loss expectancy (ALE) of $200,000. A proposed control would reduce the ALE to $50,000, and the control costs $40,000 per year to operate. What is the value of the control's risk reduction?

Accepted Answer

$150,000. The value of the risk reduction is the difference between the original ALE and the residual ALE after the control is applied. Here, $200,000 minus $50,000 equals $150,000. This figure represents the expected annual loss avoided. Comparing it to the $40,000 annual control cost yields a net benefit of $110,000, indicating the control is cost-effective.

Answer

$10,000

Answer

$200,000

Answer

$40,000

Question 12

A risk practitioner has completed a quantitative risk analysis for a customer-facing payment platform. The analysis shows an inherent annualized loss expectancy (ALE) of $2.4 million. Management wants to fund a tokenization control that reduces the ALE to $600,000, but the control costs $1.9 million per year to operate. Which action should the risk practitioner recommend?

Accepted Answer

Reject the tokenization control because its annual cost exceeds the reduction in ALE, and document the accepted residual risk.. Cost-benefit analysis compares the control's annual cost against the reduction in expected loss it produces. Here the $1.9 million cost exceeds the $1.8 million ALE reduction, so the control is not economically justified. The correct response is to advise against funding it while ensuring the remaining $600,000 residual risk is explicitly accepted and documented by the accountable risk owner.

Answer

Defer the decision indefinitely until the inherent ALE increases enough to justify the control cost.

Answer

Implement the tokenization control because it reduces the ALE by $1.8 million.

Answer

Implement the tokenization control and offset the shortfall by reducing the scope of the annual penetration test.

Question 13

A financial services firm's risk committee has approved a risk response plan for its core payment platform. The plan requires monthly tracking of key risk indicators (KRIs) and quarterly reporting of control test results to the board. Six months later, the CIO asks the risk manager to confirm that the approved response is still appropriate given new regulatory guidance. Which of the following should the risk manager do FIRST?

Accepted Answer

Reassess the risk and control environment against the new regulatory guidance to determine whether the approved response remains within tolerance.. When the external environment changes, the risk practitioner must first determine whether the previously approved risk response still keeps the risk within the organization's tolerance. That means reassessing the risk, the effectiveness of existing controls, and the alignment of the response with new regulatory expectations before recommending any change. This maintains evidence-based governance and gives the risk committee a defensible basis for deciding whether to accept, modify, or escalate the response.

Answer

Immediately escalate to the board that the existing risk response plan is invalid and must be replaced.

Answer

Commission a penetration test of the payment platform to produce fresh technical evidence for the committee.

Answer

Suspend the quarterly board reporting until the regulatory guidance has been fully interpreted by legal counsel.

Question 14

A risk practitioner is evaluating the risk that a cloud provider's regional outage disrupts a company's order management system. The company has a recovery time objective (RTO) of four hours, but the provider's documented regional recovery capability is estimated at twelve hours. Which of the following BEST characterizes the risk exposure this gap represents?

Accepted Answer

A residual risk that exceeds the company's risk appetite for this process.. The four-hour recovery objective against a twelve-hour provider capability means the remaining exposure after current arrangements exceeds what the company is willing to tolerate. That is residual risk above appetite, and it should drive treatment decisions such as multi-region architecture, alternate recovery arrangements, or renegotiated service levels rather than being accepted or dismissed as inherent.

Answer

A control deficiency in the provider's disaster recovery testing program.

Answer

An inherent risk that cannot be mitigated through any contractual arrangement.

Answer

A risk that should be accepted because cloud outages are outside the company's control.

Question 15

A software company is defining key risk indicators (KRIs) for its cloud service availability risk. The risk owner wants indicators that provide early warning of deteriorating conditions rather than after-the-fact outcomes. Which TWO of the following are the most appropriate leading KRIs for this risk? (Choose two.)

Accepted Answer

Percentage of critical cloud components operating above 80% capacity utilization.. Leading KRIs detect conditions that precede an adverse event, giving the risk owner time to act. Capacity utilization thresholds and single points of failure both signal latent availability weaknesses before an outage occurs. Outage counts, mean time to restore, and patch currency either describe past events or relate to a different risk category, so they do not satisfy the requirement for early warning indicators specific to cloud service availability.

Answer

Average time to restore service after a cloud availability incident.

Answer

Percentage of virtual machines running without current security patches.

Answer

Number of unplanned availability outages experienced in the past quarter.

Question 16

A risk practitioner is reviewing the organization's vulnerability management process. The team currently relies on the Common Vulnerability Scoring System (CVSS) base score alone to prioritize remediation. The CISO asks for a more risk-based prioritization approach. Which of the following should the practitioner recommend as the MOST effective enhancement?

Accepted Answer

Incorporate the Exploit Prediction Scoring System (EPSS) score and asset criticality into the prioritization.. Risk-based vulnerability prioritization requires combining likelihood of exploitation with business impact. EPSS provides an empirical, forward-looking probability of exploitation, while asset criticality reflects the business consequence if the asset is compromised. Together they allow the team to focus remediation on the findings that present the greatest actual risk, rather than treating all high CVSS findings as equivalent.

Answer

Replace CVSS base scores with the Common Weakness Enumeration (CWE) identifiers for all findings.

Answer

Apply a uniform 30-day remediation deadline to all high and critical CVSS findings.

Answer

Increase the frequency of authenticated vulnerability scans from monthly to weekly.

Question 17

A risk practitioner has completed a risk assessment for a new cloud-based payroll platform. The business owner wants to proceed immediately because the platform will save $200,000 annually. The residual risk exceeds the organization's risk appetite, and no compensating controls are in place. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Escalate the risk to the appropriate risk owner for a formal risk response decision.. Residual risk above appetite requires a formal decision by the risk owner, not by the practitioner or the business sponsor. Escalation ensures the accountable party evaluates response options and either approves mitigation, transfers the risk, avoids the initiative, or grants a documented exception. Simply accepting, controlling, or logging the risk would bypass the governance process that defines who may decide.

Answer

Accept the risk because the financial benefit outweighs the potential loss.

Answer

Document the risk in the risk register and take no further action.

Answer

Implement additional controls immediately and then inform the business owner.

Question 18

A risk practitioner at a healthcare payer is reviewing the organization's identity and access management (IAM) controls. The practitioner discovers that several terminated employees still have active single sign-on (SSO) sessions and directory accounts. Which of the following is the MOST effective control to address this risk?

Accepted Answer

Implement an automated joiner-mover-leaver (JML) process integrated with the HR system to disable accounts and revoke sessions upon termination.. The most effective control is an automated JML process integrated with HR, as it ensures timely and consistent deactivation of accounts and revocation of sessions upon termination. Manual or periodic reviews introduce delays that can be exploited. By automating the leaver process, the organization reduces the risk of unauthorized access and aligns with CRISC principles of implementing preventive controls to mitigate IT risk.

Answer

Enforce a policy that terminated employees must return their laptops and badges before their final paycheck is issued.

Answer

Require managers to submit a ticket to the service desk within 24 hours of an employee's termination to request account deactivation.

Answer

Conduct quarterly user access reviews to identify and remove accounts belonging to terminated employees.

Question 19

An organization's risk register lists a ransomware exposure against its primary order-processing system. The chief information security officer decides to purchase cyber insurance that covers ransomware losses up to $10 million. Which risk response has been selected?

Accepted Answer

Risk transfer. Risk transfer shifts the financial impact of a risk to another party, most commonly through insurance or contractual indemnification. Purchasing a cyber insurance policy leaves the ransomware threat and the system unchanged while moving the monetary consequence to the insurer. Because deductibles, exclusions, and coverage caps remain the organization's burden, the residual risk must still be recorded and accepted.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 20

A healthcare provider has identified a risk that a critical medical imaging system runs on an unsupported operating system. The risk owner determines that the residual risk exceeds the organization's risk appetite, but upgrading the system would cost $2 million and disrupt patient care for several weeks. Which of the following is the MOST appropriate next step?

Accepted Answer

Escalate the risk to the appropriate governance body with options and recommendations for a risk response decision.. When residual risk exceeds the organization's risk appetite, the risk owner must escalate to the governance body empowered to make risk response decisions. That body can weigh the $2 million upgrade cost and patient care disruption against the security exposure, and choose among options such as phased remediation, compensating controls, or formal risk acceptance. Unilateral acceptance, silent closure, or insurance-only responses bypass required governance.

Answer

Transfer the risk by purchasing cyber insurance and take no other action.

Answer

Accept the risk because patient care disruption outweighs the security risk.

Answer

Implement a compensating control and close the risk without further reporting.