CRISC Practice Exam 62 — 20 Questions

Question 1

A bank is adopting a third-party API gateway to expose account balance services to fintech partners. The risk practitioner must ensure that a partner's excessive or unusual API consumption cannot degrade service for other partners or core banking systems. Which control is MOST appropriate to address this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement per-partner rate limiting and quotas at the API gateway, with circuit breakers to shed load before core systems are affected.. The risk is availability degradation caused by disproportionate consumption from one partner. Enforcing per-partner rate limits and quotas at the gateway constrains each consumer, and circuit breakers prevent overload from propagating into core banking. Contractual caps, mutual TLS and response encryption address expectations, authentication and confidentiality respectively, none of which stop a single partner from exhausting shared capacity.

Answer

Encrypt account balance responses with a format-preserving encryption scheme before returning them.

Answer

Require all partners to sign a service level agreement specifying maximum transaction volumes.

Answer

Enforce mutual TLS between partners and the API gateway for all balance requests.

Question 2

A hospital's risk team has documented that its infusion pump fleet runs an unsupported operating system, creating a high risk of compromise. Replacing the pumps requires capital approval that will take 18 months, and the pumps cannot be taken offline in the interim. Which risk response is MOST appropriate for the risk practitioner to recommend?

Accepted Answer

Implement compensating controls such as network segmentation and strict access controls until the pumps are replaced.. The best response is to reduce risk through compensating controls while the long-term replacement is planned. Because the pumps cannot be removed and replacement is 18 months away, the risk practitioner should recommend interim mitigation that lowers exposure without disrupting patient care. This aligns with the CRISC principle of selecting a response proportionate to risk and maintaining operations.

Answer

Avoid the risk by immediately decommissioning all infusion pumps and switching to manual dosing.

Answer

Accept the risk and log it in the risk register for the next annual review.

Answer

Transfer the risk by purchasing cyber liability insurance that covers medical device incidents.

Question 3

A healthcare organization is required by regulation to retain patient records for seven years. The risk manager is evaluating a new cloud storage solution that offers encryption at rest but stores data in multiple jurisdictions. Which of the following is the MOST critical risk consideration when selecting this solution?

Accepted Answer

The legal and regulatory requirements for data residency in each jurisdiction. For a healthcare organization, regulatory compliance is paramount. Storing patient records in multiple jurisdictions can breach data residency laws, resulting in severe penalties. While encryption, physical security, and availability are relevant, they do not address the legal risk of unauthorized cross-border data storage. The risk manager must prioritize compliance with data residency requirements before other technical controls.

Answer

The encryption algorithm used by the cloud provider

Answer

The availability of the cloud service and its uptime guarantees

Answer

The physical security of the cloud provider's data centers

Question 4

A risk practitioner is evaluating the effectiveness of the organization's security awareness training program. The practitioner wants to determine whether the training is reducing the risk of phishing attacks. Which of the following metrics would be MOST indicative of the program's effectiveness?

Accepted Answer

The click-through rate on simulated phishing campaigns over time.. The click-through rate on simulated phishing campaigns is the most indicative metric because it directly measures employee behavior in response to phishing attempts. A declining click-through rate over time demonstrates that employees are learning to recognize and avoid phishing, which reduces the risk of successful attacks. Other metrics like completion rates or breach counts are either indirect or influenced by external factors.

Answer

The number of phishing emails reported by employees to the security team.

Answer

The percentage of employees who completed the annual security awareness training.

Answer

The number of phishing incidents that resulted in a data breach.

Question 5

A risk practitioner at a financial services firm is updating the risk register. For a risk involving unauthorized access to the customer database, the risk owner has decided to purchase a cyber liability insurance policy that covers breach-related costs. Which risk response option has the risk owner selected?

Accepted Answer

Risk transfer. The risk owner chose to purchase insurance, which is a financial arrangement that shifts the potential loss to an insurer. This is a textbook example of risk transfer. The other options do not match because the organization is not eliminating the activity (avoidance), not implementing controls to reduce likelihood or impact (mitigation), and not simply bearing the risk without action (acceptance).

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 6

A financial services firm has a risk register entry for a critical trading application. The business owner proposes adding a redundant data center to reduce downtime risk. The risk practitioner notes that the redundancy will cost $2 million annually and reduce expected annual loss from $3 million to $500,000. Which factor is MOST important for the risk practitioner to evaluate before recommending approval?

Accepted Answer

Whether the redundant data center aligns with the firm's risk appetite and tolerance.. Before recommending a risk response, the practitioner must confirm alignment with the organization's risk appetite and tolerance. The cost-benefit analysis supports the redundancy, but appetite alignment ensures the response is consistent with governance and strategic objectives. Evaluating appetite and tolerance is the overarching criterion that determines whether a control is appropriate, not merely whether it is affordable or technically feasible.

Answer

Whether the redundant data center will eliminate all downtime risk for the trading application.

Answer

Whether the business owner has the authority to approve the $2 million annual expenditure.

Answer

Whether the $2 million annual cost is lower than the $3 million expected annual loss.

Question 7

An organization is implementing a bring your own device (BYOD) program. The risk practitioner is asked to identify the control that BEST reduces the risk of data leakage from lost or stolen mobile devices.

Accepted Answer

Implement mobile device management (MDM) with remote wipe and encryption enforcement.. The most effective way to reduce data leakage from lost or stolen BYOD devices is to enforce encryption and enable remote wipe through MDM. This ensures that even if the device is compromised, the data remains protected or can be erased. Other controls are helpful but do not provide the same direct technical mitigation.

Answer

Require complex passwords on all BYOD devices.

Answer

Conduct annual security awareness training for BYOD users.

Answer

Prohibit storing any corporate data on BYOD devices.

Question 8

A retail company is launching a new mobile payment application. The risk practitioner is identifying risk response options for the risk of payment fraud. Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Tokenization of payment card data. Tokenization and real-time fraud detection are both mitigation controls because they actively reduce the risk of payment fraud. Tokenization minimizes the value of stolen data, while fraud detection identifies and blocks suspicious transactions. The other options represent risk transfer, risk avoidance, and risk acceptance, which do not reduce the inherent risk.

Answer

Accepting the risk of fraud and monitoring it quarterly

Answer

Deciding not to offer mobile payments in certain countries

Answer

Purchasing cyber insurance to cover fraud losses

Question 9

A risk practitioner is assessing the security of the organization's software development lifecycle (SDLC). The organization wants to integrate security controls to reduce the risk of introducing vulnerabilities into production. Which TWO of the following are the MOST effective preventive controls to implement during the development phase? (Choose two.)

Accepted Answer

Conduct static application security testing (SAST) on source code before code is merged into the main branch.. The most effective preventive controls during development are those that stop vulnerabilities from being introduced in the first place. Static application security testing (SAST) analyzes code before it is merged, catching flaws early. Secure coding training and standards give developers the skills to write safer code. Both are proactive measures integrated into the development phase, unlike DAST, WAF, or penetration testing, which are detective or perimeter controls applied later.

Answer

Implement a web application firewall (WAF) in front of the production application to block malicious traffic.

Answer

Perform dynamic application security testing (DAST) on applications in the production environment after deployment.

Answer

Conduct a penetration test on the application after it is deployed to production.

Question 10

A risk manager is evaluating the organization's vulnerability management program. The organization scans its external-facing systems weekly but has no process for prioritizing vulnerabilities based on business impact. Which of the following should the risk manager recommend as the MOST effective improvement?

Accepted Answer

Implement a risk-based vulnerability prioritization process that considers asset criticality, threat intelligence, and exploitability.. The program lacks a risk-based approach to prioritization. The most effective improvement is to implement a process that ranks vulnerabilities by the risk they pose, considering asset criticality, threat intelligence, and exploitability. This ensures that limited resources are directed to the most significant risks, aligning vulnerability management with business objectives.

Answer

Require all vulnerabilities to be remediated within 30 days regardless of severity to enforce a strict SLA.

Answer

Outsource vulnerability scanning to a third-party provider to gain access to more comprehensive threat data.

Answer

Increase the frequency of external scans to daily to catch vulnerabilities faster.

Question 11

A risk practitioner is reviewing the organization's risk register and notes that a critical web application has a high inherent risk of SQL injection. The development team proposes implementing a web application firewall (WAF) with virtual patching. The risk practitioner's primary responsibility in this scenario is to:

Accepted Answer

Evaluate whether the proposed control reduces risk to an acceptable level within the organization's risk appetite.. The risk practitioner's core duty is to evaluate risk responses, not to implement them or accept risk. In this scenario, the proposed WAF with virtual patching is a mitigation control. The practitioner must assess whether it reduces the SQL injection risk to a level consistent with the organization's risk appetite. This involves considering control effectiveness, potential residual risk, and cost-benefit. Only after this evaluation can the risk owner make an informed decision.

Answer

Immediately implement the WAF and virtual patching to address the vulnerability before any exploitation occurs.

Answer

Transfer the risk by purchasing cyber insurance that covers SQL injection attacks, since the WAF may not be fully effective.

Answer

Accept the risk because the WAF will eventually be deployed and the residual risk will be managed by the IT team.

Question 12

A software development company is launching a new mobile application that will collect user location data. The risk manager identifies that the data collection could violate privacy regulations if not properly disclosed. The legal team recommends updating the privacy policy and obtaining explicit user consent. Which risk response strategy is this?

Accepted Answer

Risk mitigation. By updating the privacy policy and obtaining explicit consent, the company is implementing controls to reduce the likelihood of privacy violations. This is a mitigation strategy because it addresses the risk directly through compliance measures. Avoidance would mean not collecting data, transfer would involve shifting liability, and acceptance would mean doing nothing.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Question 13

An insurance company's risk committee is reviewing a new mobile claims application. A penetration test found that the app stores authentication tokens in plaintext in the device's shared application storage, where any other app on a rooted or jailbroken device can read them. The development team proposes to add certificate pinning. Which of the following is the MOST appropriate risk response?

Accepted Answer

Mitigate the finding by storing tokens in the platform's secure hardware-backed keystore and removing them from shared application storage.. When a penetration test identifies plaintext storage of authentication tokens in shared application storage, the root cause is insecure secret handling on the endpoint. Moving tokens into the platform's hardware-backed keystore binds them to the application and blocks other apps from reading them. Certificate pinning, insurance, and root detection either address different threats or fail to remove the vulnerability, so remediation of the storage design is the correct response.

Answer

Accept the finding because certificate pinning will prevent token interception by malicious applications.

Answer

Avoid the risk by blocking the application from running on rooted or jailbroken devices.

Answer

Transfer the risk by purchasing a cyber liability policy that covers mobile application data breaches.

Question 14

A retail company's risk register shows that a point-of-sale system vulnerability has a high likelihood and high impact. The IT team proposes applying a vendor patch, but the patch has not been tested with the custom payment application. Which risk response strategy is being considered?

Accepted Answer

Risk mitigation. The IT team is proposing a patch to reduce the likelihood of exploitation, which is a mitigation response. Mitigation is the appropriate strategy when an organization chooses to implement controls to lower risk rather than accept, transfer, or avoid it. The untested patch introduces a secondary risk that must be managed, but the primary response strategy remains mitigation.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 15

A hospital's risk register identifies that a critical medical imaging server runs an unsupported operating system, creating a high likelihood of exploitation. The vendor will not release a patch, and the server cannot be taken offline because it supports active patient care. The CISO asks the risk practitioner to reduce the likelihood of exploitation without disrupting imaging services. Which risk response is MOST appropriate?

Accepted Answer

Isolate the imaging server on a dedicated network segment with strict firewall rules and deploy a host-based intrusion prevention system.. When a critical asset cannot be patched or replaced, compensating controls are the correct mitigation approach. Network segmentation limits lateral movement, and host-based IPS can detect and block exploitation attempts on the unsupported system. These measures reduce likelihood without requiring downtime, unlike acceptance, avoidance, or pure risk transfer, which do not address the technical vulnerability in this operational context.

Answer

Accept the risk because the server is essential to patient care and cannot be taken offline for replacement.

Answer

Avoid the risk by immediately decommissioning the imaging server and moving all imaging workloads to a cloud provider.

Answer

Transfer the risk by purchasing cyber insurance that covers medical device downtime and regulatory fines.

Question 16

A risk practitioner is evaluating the organization's vulnerability management programme. The organization scans its internal network weekly, but the CIO is concerned that critical internet-facing services are not adequately covered. Which TWO of the following changes would MOST improve the identification of exploitable vulnerabilities on externally exposed assets? (Choose two.)

Accepted Answer

Implement continuous external attack surface scanning that includes discovery of unknown internet-facing assets.. Improving identification of exploitable vulnerabilities on internet-facing services requires seeing the full external attack surface and knowing which findings matter. Continuous external attack surface scanning discovers and inventories exposed assets, including unknown ones, while threat intelligence correlation prioritizes vulnerabilities that attackers are actively exploiting, focusing remediation where it reduces real risk.

Answer

Require business units to self-attest quarterly that their internet-facing applications have no known vulnerabilities.

Answer

Deploy a web application firewall (WAF) in front of all internet-facing applications and enable blocking mode.

Answer

Increase the frequency of credentialed internal vulnerability scans from weekly to daily.

Question 17

A healthcare organization's risk register shows that a critical server lacks vendor support and has a high inherent risk of failure. The risk owner proposes to implement redundant hardware and a failover cluster. The cost of the redundancy is $200,000, while the estimated annual loss from failure is $150,000. Which factor is MOST important for the risk practitioner to consider when evaluating this proposed risk response?

Accepted Answer

The cost of the control compared to the expected loss. The risk practitioner must perform a cost-benefit analysis. The proposed control costs $200,000, while the expected annual loss is $150,000, meaning the control costs more than the risk it mitigates. Unless there are intangible or regulatory factors, the response is not cost-effective. The most important factor is the comparison of control cost to expected loss, which guides whether to mitigate, accept, or seek a cheaper alternative.

Answer

The likelihood of the server failing in the next year

Answer

The risk tolerance of the IT department

Answer

The residual risk after implementing the redundancy

Question 18

A retail company is launching a new e-commerce platform. The risk management team has identified that the platform's payment gateway integration could be exploited to intercept customer credit card data. The team proposes several controls. Which of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Encrypting payment data in transit using TLS 1.3. Risk mitigation controls reduce the likelihood or impact of a risk. Tokenization and TLS encryption both directly reduce the risk of credit card data interception by making the data unusable or unreadable to attackers. Cyber insurance transfers risk, avoiding online payments avoids risk, and outsourcing shares risk; none of these directly mitigate the technical vulnerability.

Answer

Purchasing cyber insurance to cover financial losses from a data breach

Answer

Deciding not to accept credit card payments online

Answer

Outsourcing the payment processing to a third-party provider

Question 19

A software development company uses a third-party cloud provider to host its source code repositories. The risk practitioner discovers that the provider's contract does not include a right-to-audit clause. The provider has a strong security reputation but is unwilling to add the clause. The company's risk appetite for third-party risk is low. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a risk assessment to determine the potential impact of the missing right-to-audit clause.. The first step in risk response is to assess the risk. The missing right-to-audit clause creates uncertainty about the provider's security controls, which is particularly concerning given the low risk appetite. A risk assessment will evaluate the likelihood and impact, allowing the risk practitioner to recommend an appropriate response, such as negotiating alternative assurance, accepting with compensating controls, or terminating the contract.

Answer

Terminate the contract and migrate the source code to an in-house data center.

Answer

Request that the provider provide a SOC 2 Type II report as a compensating control.

Answer

Accept the risk because the provider has a strong security reputation.

Question 20

A financial services firm is deploying a new trading platform. The risk committee has approved a risk treatment plan that includes a requirement to implement a circuit breaker that halts trading if losses exceed a predefined threshold. The project manager asks the risk practitioner to verify that the control is designed effectively before go-live. Which activity BEST validates the design of this risk mitigation control?

Accepted Answer

Review the control's technical specification and conduct a tabletop walkthrough with the trading and technology teams.. Design effectiveness testing confirms that a control, as planned, will mitigate the identified risk before it is relied upon. Reviewing specifications and walking through scenarios with stakeholders validates the logic, thresholds, and responsibilities. Live monitoring tests operating effectiveness, internal audit provides later assurance, and vendor documentation only confirms feature availability. The pre-go-live design validation is the most direct and timely way to confirm the circuit breaker will work as intended.

Answer

Monitor trading losses for the first month after go-live and confirm that the circuit breaker activates when the threshold is breached.

Answer

Confirm that the vendor's product documentation states the circuit breaker feature is included in the licensed version.

Answer

Ask the internal audit team to add the circuit breaker to the annual audit plan and review it during the next audit cycle.