CRISC Practice Exam 61 — 20 Questions

Question 1

A risk practitioner is helping a mid-sized healthcare organization update its IT risk register after migrating patient scheduling to a SaaS platform. The vendor's SOC 2 Type II report shows no exceptions, but the contract omits breach notification timelines and data deletion commitments. Which action BEST addresses the residual risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amend the contract to include specific breach notification timelines, data deletion rights, and audit rights, then reassess the residual risk.. The vendor's SOC 2 Type II report gives assurance over controls, but it does not replace contractual protections. Missing breach notification timelines and data deletion commitments create legal, regulatory, and reputational risk that the organization must address. Amending the contract to include these terms, along with audit rights, directly mitigates the gap and allows the risk practitioner to reassess residual risk accurately.

Answer

Accept the risk because the SOC 2 Type II report confirms the vendor's controls are operating effectively.

Answer

Transfer the risk by purchasing a cyber insurance policy that covers third-party data breaches.

Answer

Perform a penetration test against the SaaS platform to validate the vendor's security controls.

Question 2

A risk practitioner is preparing a quarterly report for the board risk committee. Senior management wants the report to show that IT risk is being managed within appetite, but the practitioner discovers that two critical control failures were identified three weeks ago and remediation is only 40 percent complete. Which approach best satisfies the practitioner's reporting obligation?

Accepted Answer

Report the failures with their current remediation status, the residual risk exposure, and an expected completion date.. Risk reporting must give governance bodies a timely, accurate view of material exposures and the status of treatment. Disclosing the control failures along with remediation progress, residual risk, and an expected completion date lets the risk committee judge appetite alignment and direct action. Suppressing or diluting the information misstates the control environment and undermines oversight.

Answer

Report only that remediation is 40 percent complete, without describing the underlying failures or their impact.

Answer

Exclude the failures from the report because remediation is already underway and the exposure is temporary.

Answer

Report the control failures only after remediation is complete so the committee receives final, accurate information.

Question 3

A multinational bank must report technology risk to its board risk committee each quarter. The committee has asked the risk team to strengthen the reporting so it drives decisions rather than just describing activity. Which TWO of the following changes would BEST achieve that objective? (Choose two.)

Accepted Answer

Add trend analysis showing how key risk indicators have moved against their thresholds over several reporting periods.. Reporting that drives decisions must connect metrics to the limits leadership approved and show direction over time. Trend analysis against thresholds and breach status against appetite both give the committee a basis to act, such as approving remediation funding or accepting a documented exception. Expanded narratives, more metrics, or delegated authorship add volume or shift perspective without improving the committee's ability to decide.

Answer

Include a longer narrative describing every control test performed during the quarter.

Answer

Delegate the entire board report to the IT operations manager to reduce preparation time.

Answer

Increase the number of metrics reported from twenty to sixty to provide more coverage.

Question 4

A risk practitioner is evaluating the organization's identity and access management (IAM) controls as part of an IT risk assessment. The organization has a hybrid environment with on-premises Active Directory and a cloud identity provider. Which TWO of the following are the MOST significant risks that should be prioritized? (Choose two.)

Accepted Answer

Inconsistent identity synchronization between the on-premises directory and the cloud identity provider, leading to stale or orphaned accounts.. In hybrid IAM, the greatest risks arise from controls that grant or preserve broad access without adequate oversight. Excessive standing privileges on service accounts enable attackers to move laterally and persist, while synchronization failures can leave active cloud credentials for users who should no longer have access. Both directly undermine the principle of least privilege and are often missed because they sit between on-premises and cloud governance processes.

Answer

The organization uses single sign-on (SSO) for cloud applications, which may create a single point of failure.

Answer

Users are required to change passwords every 90 days without a history check.

Answer

Some legacy applications do not support multi-factor authentication (MFA).

Question 5

A global retailer's risk committee is reviewing a proposal to transfer the financial impact of payment card fraud to an insurer through a cyber insurance policy. The policy has a $2 million retention and excludes losses caused by unencrypted cardholder data at rest. The organization's cardholder database is currently unencrypted. Which of the following is the MOST significant limitation the risk manager should highlight?

Accepted Answer

The exclusion for unencrypted cardholder data means the transfer will not respond to a loss from the current database configuration.. Transferring risk through insurance is effective only when the loss event is actually covered. An exclusion for unencrypted cardholder data at rest directly conflicts with the current state of the cardholder database, so a breach of that database would not be indemnified. The risk manager must flag this gap so the committee understands that the proposed transfer does not address the organization's most likely fraud loss scenario, and that encryption or another response is needed.

Answer

Cyber insurance cannot be used as a risk response because it does not reduce the likelihood of a fraud event.

Answer

The insurer, not the risk committee, will now own the risk and control decisions for the payment environment.

Answer

The retention amount is too low to provide meaningful financial protection for a global retailer.

Question 6

A risk manager at a retail bank is assessing risks introduced by a new open-source container orchestration platform. The platform will host internal APIs that process non-public customer information. Which TWO of the following are the MOST significant risks that should be prioritized in the risk register? (Choose two.)

Accepted Answer

Hard-coded secrets and API keys in container images or orchestration manifests.. Unpatched container images and hard-coded secrets directly threaten the confidentiality and integrity of non-public customer information. These risks are highly exploitable and can lead to data breaches, regulatory penalties, and reputational damage. Policy gaps, licensing costs, and community support delays are important but secondary; they do not represent immediate, high-impact threats to customer data in a banking context.

Answer

The platform's community support model may delay resolution of non-security bugs.

Answer

Lack of a documented container orchestration policy and standards for secure configuration.

Answer

Increased licensing costs due to the open-source platform's commercial support model.

Question 7

A risk practitioner is reviewing the organization's identity and access management (IAM) processes. The organization wants to reduce the risk of excessive access rights for employees who change roles internally. Which of the following controls is MOST effective for this risk?

Accepted Answer

Automating role-based access revocation and provisioning upon HR role changes.. The most effective control to reduce excessive access rights from internal role changes is automated role-based access revocation and provisioning triggered by HR events. This ensures immediate removal of old access and assignment of new access, directly addressing the risk. Other controls like vacation policies, periodic reviews, or database-level least privilege are either indirect or incomplete.

Answer

Enforcing least privilege at the database level only.

Answer

Implementing mandatory vacation policies for all employees.

Answer

Conducting periodic user access reviews by managers.

Question 8

An organization has decided to purchase cyber insurance to cover potential losses from a ransomware event affecting its order-processing systems. Which risk response has the organization selected?

Accepted Answer

Risk transfer. Insurance is the classic transfer response: a premium is exchanged for the insurer's assumption of defined financial losses. The operational risk of ransomware remains with the organization, which is why transfer is often paired with mitigation. Avoidance would end the activity, mitigation would reduce likelihood or impact directly, and acceptance would retain the loss without external coverage.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 9

A healthcare provider has experienced repeated phishing incidents that led to credential compromise. The risk committee has approved a new email security control that will quarantine suspicious messages and enforce multifactor authentication. Which TWO activities are essential to validate that the control is operating effectively after implementation? (Choose two.)

Accepted Answer

Conduct periodic control testing by simulating phishing campaigns and reviewing whether messages are quarantined and MFA is enforced.. Validation of a control requires evidence that it operates as intended in the production environment. Simulated phishing tests combined with MFA enforcement checks directly exercise the control against realistic threats, while performance metrics and exception reporting provide continuous, quantifiable evidence of effectiveness. Vendor documentation, policy acknowledgment, and project delivery metrics may support the program but do not demonstrate that the control is actually working.

Answer

Review the vendor's marketing materials and SOC 2 report to confirm the product supports quarantine and MFA features.

Answer

Confirm that the project to implement the control was completed within the approved budget and schedule.

Answer

Ask employees to sign an acknowledgment that they have read the updated acceptable use policy.

Question 10

A multinational retailer's risk register shows a high inherent risk rating for its third-party payment processor. The processor has since obtained an independent SOC 2 Type II report with no exceptions, and the retailer's contract includes a right-to-audit clause. The risk owner proposes lowering the residual risk rating to low. Which factor is MOST important for the risk practitioner to consider before approving the revised rating?

Accepted Answer

Whether the SOC 2 report's scope and testing period cover the specific services, systems, and controls the retailer relies on.. Before reducing residual risk based on third-party assurance, the practitioner must confirm that the assurance actually covers the systems, services, and control objectives the organization relies upon. Scope and period alignment determines whether the SOC 2 Type II opinion is relevant evidence. Auditor reputation, audit clause usage, and public breach history may inform judgment but cannot substitute for verifying that the report addresses the specific risk under review.

Answer

Whether the retailer has exercised its right-to-audit clause at least once in the past three years.

Answer

Whether the processor's SOC 2 report was issued by a well-known audit firm with a strong market reputation.

Answer

Whether the processor has publicly announced any data breaches during the current fiscal year.

Question 11

A retail company's risk register lists 'unauthorized access to the customer loyalty database' with a likelihood of 4 and an impact of 5 on a 1-5 scale. The CISO asks the risk practitioner to reduce the risk to an acceptable level. Which action BEST represents risk treatment in this situation?

Accepted Answer

Deploy database activity monitoring and enforce least-privilege access to the loyalty database.. Risk treatment means selecting and applying controls that change the likelihood or impact of an identified risk. Enforcing least privilege and monitoring database activity directly reduce the chance of unauthorized access, which is the likelihood dimension in the register. Re-scoring, escalation and insurance are assessment, governance and transfer activities that leave the underlying exposure unchanged.

Answer

Report the risk to the board risk committee and request a decision on acceptance.

Answer

Recalculate the likelihood and impact scores with the database team and update the risk register.

Answer

Purchase a cyber insurance policy that covers privacy breach response costs.

Question 12

A multinational manufacturer is migrating its disaster recovery capability for a core ERP system from a warm standby data center to a cloud-based recovery service. The risk practitioner is validating the recovery design. Which TWO of the following should be validated to confirm the recovery time objective can realistically be met? (Choose two.)

Accepted Answer

Verify that automated failover orchestration and DNS redirection complete within the documented recovery time objective.. Validating a recovery time objective requires measuring the steps that consume restoration time and confirming the target environment can carry production load. Failover orchestration and DNS cutover are typically the longest sequential activities, and pre-provisioned capacity determines whether the restored service can actually run. Replication lag addresses data loss, while assurance reports and retention schedules address different objectives.

Answer

Confirm the actual data replication lag and whether it stays within the recovery point objective during peak transaction periods.

Answer

Confirm the backup retention schedule aligns with the organization's data classification policy.

Answer

Review the cloud provider's SOC 2 report to confirm its availability commitments.

Question 13

A hospital's risk practitioner is evaluating a new telehealth platform that will process protected health information (PHI). The platform will be hosted by a third-party vendor. Which of the following is the MOST critical risk to address during contract negotiations?

Accepted Answer

The vendor's data breach notification timeline and liability for regulatory penalties.. When a third party processes PHI, the hospital must ensure the business associate agreement clearly assigns responsibility for breach notification and regulatory penalties. This contractual protection is the most critical risk treatment because it directly addresses the hospital's legal and financial exposure under HIPAA. Other concerns like subcontractors, uptime, and data residency are important but secondary to the allocation of liability.

Answer

The vendor's service level agreement (SLA) for platform uptime.

Answer

The vendor's use of subcontractors to support the platform.

Answer

The vendor's geographic location and data residency practices.

Question 14

A risk manager is evaluating the security of a new API gateway that will expose internal microservices to external partners. The gateway will handle authentication, rate limiting, and request routing. Which risk is MOST critical to address before go-live?

Accepted Answer

Weak authentication and authorization mechanisms that could allow partners to access unauthorized microservices.. The API gateway is the security boundary for external partners. Weak authentication and authorization could allow unauthorized access to internal microservices, directly threatening data confidentiality and integrity. While logging, rate limiting, and internal TLS are important, they are secondary to ensuring that only authorized entities can reach the appropriate services. Addressing authentication and authorization first prevents the most severe impact.

Answer

Insufficient logging of API requests, which could hinder forensic investigations.

Answer

Inadequate rate limiting that could allow denial-of-service attacks.

Answer

Lack of TLS encryption for internal traffic between the gateway and microservices.

Question 15

A risk practitioner is preparing a risk report for the executive committee. The committee has limited time and has previously complained that reports contain too much technical detail. Which approach BEST communicates the most critical IT risks to this audience?

Accepted Answer

Summarize the top risks by business impact and alignment with risk appetite, with recommended actions.. Executive risk reporting must be selective, business-oriented, and connected to appetite. Summarizing top risks by business impact and appetite alignment, with recommended actions, gives the committee what it needs to govern: which exposures matter, how they compare to tolerance, and what decisions are required. Full registers, scan counts, and incident-only reporting either overwhelm, mislead, or arrive too late.

Answer

Focus on the number of vulnerabilities detected in the latest technical scan.

Answer

Provide the full risk register with all identified risks and their control test results.

Answer

Present only risks that have already resulted in a confirmed loss or incident.

Question 16

A healthcare organization is migrating its electronic health records (EHR) to a SaaS provider. The provider offers a standard contract with a 99.9% uptime SLA but no right to audit. The risk manager is concerned about data integrity and availability. Which of the following is the BEST risk response to address the lack of audit rights?

Accepted Answer

Negotiate a contract amendment to include audit rights or obtain independent third-party attestations such as SOC 2 Type II reports.. The best response is to obtain assurance through contractual audit rights or independent attestations like SOC 2 Type II. This directly addresses the lack of visibility into the provider's controls, which is critical for data integrity and compliance. Other options either accept the risk without assurance, implement costly redundancies that do not solve the problem, or transfer financial risk without addressing the control gap.

Answer

Transfer the risk by purchasing cyber insurance that covers data breaches at the SaaS provider.

Answer

Implement a redundant on-premises EHR system to mitigate the risk of provider failure.

Answer

Accept the risk because the SLA guarantees uptime and the provider is reputable.

Question 17

A financial services firm operates a high-volume transaction processing platform. During a risk assessment, the risk owner determines that the residual risk of database corruption exceeds the risk appetite. The database vendor offers a patch that reduces the vulnerability but requires a 12-hour outage. Business stakeholders refuse the outage. The risk practitioner is asked to recommend a risk response that aligns with the risk appetite without disrupting operations. Which of the following is the BEST recommendation?

Accepted Answer

Implement database replication to a secondary node and fail over during a maintenance window, then apply the patch.. The best response reduces residual risk to within appetite while respecting the business constraint against a 12-hour outage. Database replication provides a compensating control that enables patching with minimal downtime, effectively mitigating the vulnerability. Acceptance, transfer, and avoidance either leave risk above appetite or introduce unacceptable business disruption.

Answer

Avoid the risk by decommissioning the transaction platform and migrating to a new solution.

Answer

Accept the residual risk and document it in the risk register with a review date in six months.

Answer

Transfer the risk by purchasing cyber liability insurance that covers data corruption events.

Question 18

A financial services firm is deploying a new customer portal on a public cloud. The security team proposes using digital certificates to authenticate the portal to clients and sign sensitive transaction data. The risk manager must evaluate the residual risk after certificate deployment. Which of the following is the MOST significant residual risk related to the certificate lifecycle?

Accepted Answer

The certificate authority's root certificate might be compromised, allowing attackers to forge certificates.. A root certificate authority compromise is the most significant residual risk because it can invalidate the trust model for all certificates issued under that CA. Unlike internal control gaps or operational issues, this risk is external and can have widespread impact, including forged certificates for the organization's portal. Risk managers must consider third-party dependencies and the potential for cascading effects when evaluating residual risk.

Answer

The certificate's private key might be stored in a hardware security module (HSM) with weak access controls.

Answer

The certificate's public key algorithm might be deprecated, requiring reissuance.

Answer

Certificate revocation lists (CRLs) might become too large to distribute efficiently.

Question 19

An organization's risk committee is reviewing key risk indicators (KRIs) for its customer-facing web applications. The KRI for average patch latency has breached its threshold for two consecutive quarters, yet the risk register still lists the associated risk as medium with no treatment plan. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Escalate the KRI breach to the risk owner and require reassessment of the risk rating and treatment plan.. A KRI that breaches its threshold for two consecutive quarters signals that the underlying risk profile has deteriorated, yet the register still shows a stale medium rating without treatment. The practitioner should escalate to the accountable risk owner so the risk can be reassessed and a documented treatment decision made. Unilateral rating changes, premature insurance recommendations, and deferred discussion all bypass the owner's accountability and delay necessary action.

Answer

Immediately raise the risk rating to high in the risk register without consulting the risk owner.

Answer

Wait until the next scheduled quarterly risk committee meeting to present the KRI trend for discussion.

Answer

Recommend purchasing additional cyber insurance to cover the potential loss from unpatched applications.

Question 20

A risk practitioner is assessing the security of an organization's use of public cloud infrastructure. The organization stores sensitive data in object storage buckets. Which TWO of the following are the MOST significant risks related to misconfigured cloud storage? (Choose two.)

Accepted Answer

Insufficient logging and monitoring of access to bucket objects.. Misconfigured cloud storage most often results in data exposure through overly permissive access policies and goes unnoticed due to insufficient logging and monitoring. These two risks directly affect confidentiality and the ability to detect and respond to incidents. Other options are either less directly related to misconfiguration or are not security risks in the same sense.

Answer

Use of a single cloud region for data residency.

Answer

Inability to export data due to vendor lock-in.

Answer

Lack of encryption at rest for stored objects.