CRISC Practice Exam 61 — 20 Questions

Question 1

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). Detective controls identify incidents after they occur. An intrusion detection system (IDS) monitors network traffic and alerts on suspicious activity, making it a detective control.

Answer

Firewall

Answer

Backup and recovery procedure

Answer

Data encryption

Question 2

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Accepted Answer

Risk reduction by implementing redundant systems. Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Answer

Risk avoidance by decommissioning the system

Answer

Risk transfer through cyber insurance

Answer

Risk acceptance because mitigation is too costly

Question 3

A company's risk appetite statement specifies that the organization is willing to accept a moderate level of operational risk to achieve strategic agility. This statement directly influences which activity during IT risk identification?

Accepted Answer

Establishing risk tolerance thresholds for operational risk. Risk appetite guides which risks are acceptable and helps prioritize risk scenarios, influencing the scope of risk identification.

Answer

Defining the IT risk universe

Answer

Determining the risk capacity of the organization

Answer

Selecting threat intelligence sources

Question 4

After a data breach has been contained, what is the most important action for identifying underlying IT risks?

Accepted Answer

Perform a root cause analysis. Root cause analysis systematically identifies the weaknesses that allowed the breach, directly contributing to risk identification. Updating the risk register, implementing controls, and reviewing insurance are subsequent steps.

Answer

Update the risk register

Answer

Implement new security controls

Answer

Review cyber insurance policy

Question 5

Refer to the exhibit. This JSON snippet defines a monitoring policy for S3 bucket access. Which of the following is a potential risk that might NOT be detected by this monitoring policy?

Accepted Answer

Unauthorized DELETE operations from any IP.. The monitoring policy only covers PutObject and GetObject actions. DeleteObject is not included, so unauthorized DELETE operations would go undetected. Option A (GET from trusted IP) is monitored, as GetObject is covered. Option B (PUT from trusted IP) is also monitored because PutObject is covered; if the policy denies such PUTs, that would still be detected by the monitoring. Option D (PUT from outside trusted IP) is likewise monitored. Only DELETE actions are completely outside the monitoring scope.

Answer

Unauthorized GET operations from within the trusted IP range.

Answer

Unauthorized PUT operations from within the trusted IP range.

Answer

Unauthorized PUT operations from outside the trusted IP range.

Question 6

A risk analyst is reviewing the results of control testing for a critical business process. Which THREE of the following are valid reasons to classify a control as ineffective?

Accepted Answer

The control was not executed as per procedure.. A control that is not executed as per its documented procedure indicates an operational failure. Even if the control design is sound, failure to follow the procedure means the control did not operate as intended, rendering it ineffective in mitigating the risk.

Answer

The control was tested once and passed.

Answer

The control owner was not available during the test.

Question 7

An internal audit report identifies that the IT department did not patch a critical vulnerability in a database server for 90 days. The risk manager wants to identify the root cause risk. Which approach should be used?

Accepted Answer

Perform a root cause analysis on the patching process. The risk manager needs to identify the root cause risk, which requires understanding why the patching process failed to apply a critical security update within the required timeframe. A root cause analysis (RCA) on the patching process systematically examines procedural breakdowns, such as missed scanning cycles, lack of change management approval, or insufficient prioritization of database-specific patches (e.g., Oracle Critical Patch Updates). This approach directly addresses the underlying process deficiency rather than merely documenting or re-verifying the vulnerability.

Answer

Interview the database system owner

Answer

Conduct a new vulnerability scan

Answer

Update the risk register with the finding

Question 8

During an IT risk assessment, a risk owner has identified a risk with a high inherent risk score. After reviewing control effectiveness, the residual risk remains medium. The organization decides to accept the residual risk. Which TWO of the following actions should the risk owner take?

Accepted Answer

Obtain sign-off from the risk owner. The risk owner must formally acknowledge and accept the residual risk after the decision to accept has been made. This sign-off demonstrates that the risk owner is aware of the remaining exposure and agrees to the risk acceptance, which is a key governance step in the risk management process. Without this sign-off, the acceptance is not formally recognized, and accountability remains unclear.

Answer

Transfer the risk to a third party

Answer

Eliminate the activity that creates the risk

Answer

Implement additional controls to reduce risk further

Question 9

A Key Control Indicator (KCI) for a critical firewall rule set shows an exception rate of 12% over the past month, exceeding the acceptable threshold of 5%. The control owner is responsible for remediation. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a root cause analysis of the exceptions. The first step in addressing an elevated KCI is to investigate the root cause of the exceptions to determine if they are due to rule misconfigurations, policy violations, or other issues before taking corrective action.

Answer

Temporarily disable the firewall rules causing exceptions

Answer

Implement an automated rule change management process

Answer

Update the KCI threshold to 12%

Question 10

Which TWO of the following are primary sources of IT risk identification? (Select exactly TWO.)

Accepted Answer

Incident reports. Incident reports are a primary source of IT risk identification because they provide direct evidence of past security events, such as malware infections, unauthorized access attempts, or system failures. By analyzing incident reports, risk practitioners can identify patterns, root causes, and control weaknesses that represent current or emerging risks. This historical data is essential for updating the risk register and prioritizing remediation efforts based on actual impact.

Answer

Asset inventory

Answer

Risk appetite

Answer

Policy documents

Question 11

Which COBIT 2019 governance objective focuses on ensuring that the enterprise's risk appetite and tolerance are understood, articulated, and communicated, and that risk is managed appropriately?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically designed to ensure that the enterprise's risk appetite and risk tolerance are defined, communicated, and understood, and that risk is managed within those boundaries. It focuses on aligning risk management with enterprise objectives and ensuring that residual risk is acceptable.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 12

An organization is conducting a post-implementation review of a new data loss prevention (DLP) control. Which TWO metrics are Key Control Indicators (KCIs) that would best measure the control's effectiveness?

Accepted Answer

Percentage of DLP policy violations that were not blocked. The percentage of DLP policy violations that were not blocked directly measures the control's failure rate—its inability to prevent unauthorized data exfiltration. A high percentage indicates ineffective policy configuration or insufficient detection coverage, making it a key control indicator (KCI) for effectiveness. Option E is correct because the number of authorized exceptions to DLP policies reflects how often the control is deliberately bypassed, which can indicate gaps in policy design or excessive risk acceptance, both of which undermine the control's intended effectiveness.

Answer

Cost of the DLP solution per year

Answer

Average time to respond to DLP incidents

Answer

Number of DLP alerts generated per day

Question 13

A company uses a third-party vendor to process customer data. The vendor's security control monitoring reports show no issues. However, the company's internal monitoring detects anomalies in vendor response times. What is the BEST interpretation?

Accepted Answer

The anomalies may indicate a control gap in the vendor's environment.. The discrepancy between the vendor's security monitoring reports (showing no issues) and the company's internal monitoring (detecting anomalies in response times) suggests a potential control gap in the vendor's environment. Response time anomalies can indicate underlying security issues such as resource exhaustion, data exfiltration, or compromised systems that the vendor's monitoring may not be capturing. This misalignment warrants further investigation rather than dismissal.

Answer

The vendor's monitoring is accurate; the anomalies are false positives.

Answer

The internal monitoring should be disabled to avoid confusion.

Answer

The vendor's monitoring is more reliable than internal monitoring.

Question 14

A multinational corporation is assessing the risk of non-compliance with GDPR. Which of the following is the BEST approach to quantify the potential fine?

Accepted Answer

Base the estimate on the organization's annual global turnover. Under GDPR, the maximum fine for non-compliance is the greater of €20 million or 4% of the organization's annual global turnover. Therefore, basing the estimate on annual global turnover directly aligns with the regulatory formula used by supervisory authorities, making it the most accurate and defensible quantification approach for potential fines.

Answer

Estimate based on the cost of cyber insurance premiums

Answer

Calculate the cost of data breach using the Ponemon Institute model

Answer

Use industry benchmarks for data breach costs

Question 15

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to sign standard contractual clauses and encrypt all data. Standard Contractual Clauses (SCCs) are a GDPR-approved transfer mechanism that legally binds the vendor to EU data protection standards, even in a weak-law jurisdiction. Combined with encryption of all data at rest and in transit, this provides both a legal and technical safeguard, reducing the risk of non-compliance to an acceptable level without abandoning the vendor.

Answer

Avoid by choosing a vendor in a country with strong data protection laws

Answer

Accept the risk because the vendor offers the best price

Answer

Purchase cyber insurance to cover potential fines

Question 16

A third-party vendor is classified as high risk due to its access to sensitive data. Which THREE activities should be part of ongoing monitoring for this vendor?

Accepted Answer

Contract compliance reviews to ensure terms are met.. Contract compliance reviews are a fundamental ongoing monitoring activity for high-risk vendors. They ensure the vendor continues to adhere to agreed-upon security controls, data handling procedures, and service-level agreements (SLAs) throughout the relationship, not just at onboarding. This is a continuous verification process, distinct from one-time checks.

Answer

Requiring SOC 2 Type II certification before contract signing.

Answer

Initial onboarding security questionnaire review.

Question 17

A company is evaluating controls for a high-risk process. Which control type is designed to stop a risk event from occurring?

Accepted Answer

Preventive. A preventive control is designed to stop a risk event from occurring by implementing barriers or safeguards before the event can happen. For a high-risk process, this might include access control lists (ACLs) on a firewall that block unauthorized traffic, or input validation routines in an application that reject malformed data before it can trigger a buffer overflow. By proactively eliminating the threat vector, preventive controls reduce the likelihood of the risk event to zero for the protected path.

Answer

Detective

Answer

Corrective

Answer

Compensating

Question 18

A risk practitioner is designing a risk report for the board of directors. Which TWO content elements are most appropriate for strategic risk reporting? (Select two.)

Accepted Answer

Trend analysis of top key risk indicators. Trend analysis of top key risk indicators (KRIs) is appropriate for strategic risk reporting because it provides the board with a high-level, forward-looking view of how key risks are evolving over time. This enables informed decision-making on risk appetite and strategic direction without overwhelming directors with operational details.

Answer

List of all control deficiencies

Answer

Names of employees who failed phishing tests

Answer

Detailed log analysis results

Question 19

A bank is identifying IT risks and categorizes a potential data breach as both a compliance risk (due to GDPR) and a reputational risk. This is an example of:

Accepted Answer

Multiple risk categories for a single risk. A single risk can belong to multiple categories; this is normal in risk categorization.

Answer

Risk aggregation

Answer

Improper risk classification

Answer

Risk scenario overlap

Question 20

During a risk assessment, the risk manager finds that a critical application has a single point of failure in its network path. The application's availability requirement is 99.99%. The current design achieves only 99.9% uptime. Which risk metric should be calculated first?

Accepted Answer

Risk gap between required and current service level.. The risk manager must first quantify the risk gap between the required 99.99% availability (approximately 52.56 minutes of downtime per year) and the current 99.9% availability (approximately 525.6 minutes per year). This gap of 473.04 minutes per year establishes the magnitude of the risk exposure before any financial calculations (ALE, SLE, EF) can be performed, as those metrics depend on knowing the actual downtime that needs to be costed.

Answer

Annualized Loss Expectancy (ALE) based on potential downtime cost.

Answer

Exposure factor (EF) representing the percentage of loss.

Answer

Single loss expectancy (SLE) for a single outage event.