CRISC Practice Exam 60 — 20 Questions

Question 1

A risk manager is evaluating the application of IEC 62443 for industrial control systems. Which THREE of the following are key security requirements addressed by this standard?

Accepted Answer

Identification and authentication control. IEC 62443 is a series of standards specifically designed for the security of Industrial Automation and Control Systems (IACS). It addresses cybersecurity requirements to protect these systems from cyber threats. Identification and authentication control (B) is a foundational requirement, ensuring that only authorized users and devices can access the system, which is critical for preventing unauthorized access to industrial processes.

Answer

Environmental monitoring (temperature, humidity)

Answer

Physical security of data centers

Question 2

An organization uses a qualitative risk assessment methodology. The risk matrix has impact and likelihood scales of 1-5. A risk is assessed with impact=4 and likelihood=3. What is the risk level?

Accepted Answer

High. In a qualitative risk assessment with a 5x5 risk matrix (impact and likelihood scales of 1-5), the risk level is determined by multiplying the impact and likelihood scores. Here, 4 (impact) × 3 (likelihood) = 12. Typically, a product of 12 falls into the 'High' risk category (e.g., 10-15 range), as defined by common CRISC and ISACA frameworks. This aligns with the organization's methodology where scores above a threshold (e.g., 10) are classified as High, not Critical.

Answer

Critical

Answer

Low

Answer

Medium

Question 3

An organization has implemented a new firewall rule to block malicious IP addresses. This is an example of which type of control?

Accepted Answer

Preventive control. A firewall rule that blocks malicious IP addresses is a preventive control because it proactively stops unauthorized traffic before it can reach the internal network. By filtering packets based on source IP addresses, the firewall enforces access control policies at the network layer, preventing potential attacks from ever being initiated. This aligns with the CRISC definition of preventive controls, which are designed to avoid or deter undesirable events.

Answer

Directive control

Answer

Corrective control

Answer

Detective control

Question 4

A university's IT department is implementing a single sign-on (SSO) solution for students and faculty. The solution will integrate with existing Active Directory and a cloud-based learning management system (LMS). During risk identification, the team learns that the SSO vendor had a minor security incident last year. The university's security policy requires multi-factor authentication (MFA) for all administrative access, but the SSO solution does not support MFA for student accounts. The project manager insists that MFA for students is not necessary because they only access academic records. The risk team must identify the most significant risk that could affect the university's reputation. Which risk should be documented?

Accepted Answer

Without MFA, student accounts could be compromised to access sensitive academic data.. The most significant reputational risk is that without MFA, student accounts are vulnerable to credential theft or brute-force attacks. If an attacker compromises a student account, they could access sensitive academic records (e.g., grades, personal data) protected under FERPA, leading to data breaches, legal penalties, and loss of public trust. The SSO vendor's past incident is less relevant because it was minor and does not directly expose the university's data.

Answer

SSO vendor's historical security incident could impact service availability.

Answer

Students may share passwords, leading to account compromise.

Answer

Lack of MFA for administrative accounts could allow unauthorized changes.

Question 5

A multinational corporation is identifying risks associated with cross-border data transfers. Which regulation's risk identification requirements are most relevant?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the most relevant regulation for risk identification in cross-border data transfers because it explicitly governs the transfer of personal data from the European Economic Area (EEA) to third countries. GDPR requires organizations to identify and assess risks related to adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), and potential data localization conflicts. This regulation directly addresses the legal and technical risks of moving data across borders, such as exposure to differing privacy laws and surveillance regimes.

Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Question 6

An organization’s continuous monitoring program includes automated vulnerability scanning and log review. Which of the following is a Key Risk Indicator (KRI) that would BEST signal an increasing risk of a successful network breach?

Accepted Answer

Spike in failed authentication attempts from external IPs. A KRI should be leading, indicating a change in risk level. A spike in failed authentication attempts often precedes a brute force attack or credential compromise, signaling increased risk of breach.

Answer

Average time to patch critical vulnerabilities

Answer

Number of firewall rule changes per month

Answer

Percentage of systems with up-to-date antivirus signatures

Question 7

A company is designing its risk and control monitoring program. Which TWO of the following are key attributes of effective monitoring?

Accepted Answer

Monitoring results should be communicated to stakeholders.. Effective monitoring requires that results are communicated to stakeholders to ensure informed decision-making and timely remediation. Without communication, monitoring loses its value as stakeholders cannot act on identified risks or control deficiencies.

Answer

All controls should be monitored at the same frequency.

Answer

Monitoring should only be performed by external auditors.

Answer

Monitoring should be independent of the control owner.

Question 8

An organization is designing a risk indicator monitoring program for its key financial risks. Which of the following is the BEST example of a key risk indicator (KRI) for credit risk?

Accepted Answer

Percentage of loans that are in default or non-performing.. A key risk indicator (KRI) for credit risk must directly measure the likelihood or impact of a borrower failing to meet their obligations. The percentage of loans that are in default or non-performing is a direct, quantitative measure of credit risk exposure, as it reflects the actual realization of credit losses. This aligns with the CRISC focus on monitoring risk levels to trigger timely responses.

Answer

Number of employees who completed cybersecurity training.

Answer

Percentage of network uptime over the past month.

Answer

Employee turnover rate in the finance department.

Question 9

A risk analyst is reviewing monthly control test results. One control failed testing twice in a row. What is the FIRST step the analyst should take?

Accepted Answer

Perform a root cause analysis of the control failure.. The first step when a control fails testing twice in a row is to perform a root cause analysis (RCA) to understand why the failure occurred. Without identifying the underlying cause, any corrective action or reporting would be premature and could lead to ineffective remediation. This aligns with the CRISC focus on proactive risk monitoring and control improvement before escalating or updating risk ratings.

Answer

Report the failure in the next risk report to management.

Answer

Update the risk register with a higher inherent risk rating.

Answer

Escalate the failure to the risk committee immediately.

Question 10

Which of the following is the BEST indicator that a control is effective in mitigating a risk?

Accepted Answer

Regular testing shows the control consistently reduces the risk to the desired level. The effectiveness of a control is ultimately measured by its ability to consistently reduce residual risk to the organization's defined risk appetite. Regular testing provides empirical evidence that the control is operating as intended and achieving the desired risk mitigation outcome, which is the primary goal of risk treatment.

Answer

The control is automated and runs daily

Answer

The control is documented in a policy

Answer

The cost of the control is lower than the potential loss

Question 11

A company is assessing the risk of a ransomware attack. The security team estimates the threat event frequency as 2 attacks per year, vulnerability as 0.3 (30% chance of success), primary loss as $500,000, and secondary loss as $200,000. What is the annualized loss expectancy (ALE) using the FAIR framework?

Accepted Answer

$420,000. The FAIR framework calculates ALE as Threat Event Frequency × Vulnerability × (Primary Loss + Secondary Loss). Here, 2 × 0.3 × ($500,000 + $200,000) = 2 × 0.3 × $700,000 = $420,000. This correctly accounts for the probability of a successful attack and the total loss per incident.

Answer

$700,000

Answer

$210,000

Answer

$1,400,000

Question 12

During an IT risk assessment, the risk owner decides to accept a risk that falls within the organization's risk appetite. Which of the following actions is most appropriate for the risk owner to take?

Accepted Answer

Document the risk and obtain formal sign-off from the risk owner.. When a risk falls within the organization's risk appetite, the most appropriate action is to formally accept it. The risk owner must document the risk and obtain formal sign-off to ensure accountability and auditability, as required by the risk management framework. This aligns with the principle that risks within appetite do not require additional treatment beyond formal acceptance.

Answer

Eliminate the business process that creates the risk.

Answer

Transfer the risk to a third party via insurance.

Answer

Implement additional controls to reduce the risk to zero.

Question 13

After a risk assessment, the risk owner determines that the residual risk is still above the risk appetite. Which of the following is the MOST appropriate next step?

Accepted Answer

Implement additional controls. When residual risk remains above the risk appetite after initial risk assessment, the most appropriate next step is to implement additional controls to further reduce the risk to an acceptable level. This aligns with the risk treatment process where controls are selected and applied to lower the likelihood or impact of the risk event. Simply transferring, ignoring, or accepting the risk without further action would not address the gap between residual risk and risk appetite.

Answer

Transfer the risk

Answer

Ignore the risk

Answer

Accept the risk

Question 14

Based on the exhibit, which risk is MOST likely to be identified during a risk assessment?

Accepted Answer

Lateral movement risk from DMZ to internal network. The exhibit shows a DMZ architecture where the internal network is separated from the DMZ by a firewall. A risk assessment would identify the potential for an attacker who compromises a DMZ host (e.g., a web server) to pivot through the firewall to the internal network, especially if firewall rules are overly permissive or if the DMZ host has a trust relationship with internal systems. This lateral movement risk is a classic and high-priority finding in such segmented environments.

Answer

Weak passwords on user workstations

Answer

Unauthorized physical access to the data center

Answer

Incomplete audit logs on firewalls

Question 15

A risk assessment reveals a high inherent risk that is within the organization's risk appetite. The risk owner documents the risk and formally accepts it. This is an example of which risk treatment option?

Accepted Answer

Accept. When a risk is within appetite, it may be formally accepted with sign-off.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 16

Match each CRISC domain to its description.

Accepted Answer

Governance: Focuses on establishing and maintaining a framework for IT governance, including organizational structure, policies, and processes.. The four CRISC domains are Governance, IT Risk Assessment, Risk Response and Reporting, and Information Technology and Security. Each domain has a distinct focus: Governance sets the framework, IT Risk Assessment identifies and evaluates risks, Risk Response and Reporting handles responses and communication, and Information Technology and Security protects assets through controls and architecture. Common confusions include swapping Governance with IT Risk Assessment, as both involve risk management but at different levels.

Answer

Governance: Involves identifying, analyzing, and evaluating IT risks to determine their impact and likelihood.

Answer

IT Risk Assessment: Focuses on establishing and maintaining a framework for IT governance, including organizational structure, policies, and processes.

Question 17

During a risk assessment, the risk manager identifies that the likelihood of a cyber-attack is high due to recent industry trends. However, the existing controls are deemed effective in reducing impact. Which of the following is the MOST appropriate risk response?

Accepted Answer

Mitigate. Mitigate is the most appropriate risk response because the likelihood of a cyber-attack is high, but existing controls are effective in reducing the impact. Mitigation involves implementing additional controls or enhancing existing ones to reduce the likelihood or impact further, which aligns with the scenario where controls are already effective but need to be strengthened to address the high likelihood.

Answer

Avoid

Answer

Accept

Answer

Transfer

Question 18

Which type of control is designed to reduce the likelihood of a risk event occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

Answer

Corrective

Answer

Compensating

Answer

Detective

Question 19

A financial institution is implementing a new continuous monitoring solution for its transaction processing systems. The solution generates alerts for suspicious activities. Which TWO of the following are essential considerations when defining the alert thresholds?

Accepted Answer

Historical transaction patterns and baseline deviations. Historical transaction patterns and baseline deviations (B) are essential because alert thresholds must be calibrated to normal behavior to minimize false positives and false negatives. Without understanding typical transaction volumes, values, and frequencies, the monitoring solution cannot distinguish legitimate activity from suspicious anomalies, rendering alerts meaningless.

Answer

Cost of the monitoring solution

Answer

Vendor reputation for support

Answer

Number of employees in the monitoring team

Question 20

During a risk assessment, an organization identifies that its legacy ERP system has a high likelihood of failure during peak transaction periods. The system supports critical financial operations. The risk owner proposes to upgrade the system, but the project would take 18 months and require significant capital investment. The CEO questions whether the risk can be reduced to an acceptable level more quickly. Which of the following is the MOST appropriate immediate risk response?

Accepted Answer

Implement enhanced monitoring and manual fallback procedures.. Enhanced monitoring and manual fallback procedures directly address the immediate risk of system failure during peak periods by providing early detection and a contingency plan to maintain critical financial operations. This response can be implemented quickly without the 18-month timeline and capital investment required for a full system upgrade, aligning with the CEO's request for a faster risk reduction.

Answer

Increase cyber insurance coverage.

Answer

Accept the risk and budget for potential losses.

Answer

Outsource the ERP hosting to a cloud provider.