CRISC Practice Exam 62 — 20 Questions

Question 1

Which risk assessment approach is most appropriate for a new technology that has limited historical data and high uncertainty?

Accepted Answer

Delphi technique with a panel of experts.. The Delphi technique is most appropriate for a new technology with limited historical data and high uncertainty because it leverages the collective judgment of a panel of experts through iterative, anonymous rounds to reach a consensus on risk likelihood and impact. This approach does not rely on historical loss data or predefined benchmarks, making it ideal for novel or emerging technologies where empirical data is scarce.

Answer

Quantitative risk assessment using ALE calculations.

Answer

Bow-tie analysis to map causes and consequences.

Answer

Automated risk scoring based on industry benchmarks.

Question 2

An organization is implementing a new control to prevent unauthorized access to its critical database. Which type of control is most appropriate for this requirement?

Accepted Answer

Preventive control. A preventive control is the most appropriate because it directly stops unauthorized access before it can occur. For a critical database, this could involve implementing database-level access control lists (ACLs), network firewall rules restricting traffic to specific IP ranges, or mandatory multi-factor authentication (MFA) on the database service. These mechanisms enforce the security policy at the point of entry, blocking the threat actor before any interaction with the data.

Answer

Compensating control

Answer

Corrective control

Answer

Detective control

Question 3

A multinational organization uses a third-party vendor for cloud-based identity management. The vendor recently suffered a data breach that exposed user credentials. The risk manager is now re-evaluating the associated risk. Which of the following steps should the risk manager perform FIRST to identify potential new risks?

Accepted Answer

Update the risk register to include the new threat scenario of credential compromise via the vendor.. After a vendor data breach, the risk manager's first step in risk identification is to update the risk register with the newly realized threat scenario—credential compromise via the vendor. This ensures that the organization formally captures and assesses the risk, enabling subsequent analysis and response. Option A (contract review) is a response step, not identification. Option C (revoking access) is a reactive control. Option D (penetration test) is a later step for validating controls, not the first identification action.

Answer

Review the contract to determine if the vendor is liable for the breach.

Answer

Immediately revoke all vendor access to internal systems.

Answer

Conduct a penetration test of the organization's own systems.

Question 4

A security operations center (SOC) analyst notices multiple failed login attempts from an internal IP address followed by a successful login from an unusual geographic location. Which risk identification technique should the risk manager use to assess this as a potential risk?

Accepted Answer

Perform user and entity behavior analytics (UEBA) on the user account. User and entity behavior analytics (UEBA) uses behavioral baselines and anomaly detection to identify patterns such as multiple failed logins followed by a successful login from an unusual geographic location, which is indicative of account compromise and a potential risk. Option A is incorrect because a phishing simulation tests user susceptibility to phishing attacks, not behavioral anomalies in login patterns. Option B is incorrect because manual log review is time-consuming and may not effectively detect subtle behavioral deviations without automated analysis. Option C is incorrect because a vulnerability scan focuses on system vulnerabilities, not user behavior.

Answer

Run a phishing simulation for the user

Answer

Review the logs manually for other indicators

Answer

Conduct a vulnerability scan on the workstation

Question 5

During a risk assessment, a control self-assessment (CSA) indicates that a key control is operating effectively. However, an independent audit finds multiple control failures. Which of the following is the MOST likely reason for this discrepancy?

Accepted Answer

The CSA participants lacked objectivity. The most likely reason for the discrepancy is that the CSA participants lacked objectivity. Control self-assessments are performed by process owners or staff who may have a vested interest in reporting favorable results, leading to biased or incomplete evaluations. In contrast, an independent audit applies objective testing procedures, which are more likely to uncover actual control failures that the CSA missed or downplayed.

Answer

The audit tested different samples

Answer

The control environment changed

Answer

The CSA was conducted too recently

Question 6

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Accepted Answer

High. Risk score = 3 × 4 = 12, which falls in the high range (12-25).

Answer

Critical

Answer

Medium

Answer

Low

Question 7

Which THREE of the following are common challenges in risk reporting?

Accepted Answer

Timeliness of information.. Timeliness of information is a common challenge in risk reporting because risk data must be current to support effective decision-making. If reports are delayed, the organization may act on outdated risk profiles, leading to inappropriate responses. Real-time or near-real-time reporting is often required, but data aggregation and processing latency can introduce delays.

Answer

Over-reliance on automated tools.

Answer

Lack of board support.

Question 8

A company has identified that its legacy financial system has a high inherent risk due to outdated architecture. The system cannot be replaced for three years. What is the best risk treatment strategy?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring.. When a legacy system cannot be replaced for three years, the most effective risk treatment is to reduce the likelihood and impact of exploitation through compensating controls. Network segmentation limits lateral movement from the legacy system, and enhanced monitoring (e.g., SIEM with custom rules for anomalous traffic) provides early detection of compromise. This aligns with the ISACA risk treatment principle of risk reduction when avoidance or transfer is not feasible.

Answer

Accept the risk and allocate contingency funds for potential incidents.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Avoid the risk by discontinuing the system immediately.

Question 9

You are the IT risk manager for a financial institution that processes high-value transactions. The organization uses a cloud-based core banking system and on-premises servers for backup. During a recent risk assessment, you identified that the cloud provider's service-level agreement (SLA) guarantees 99.9% uptime, but the organization's business impact analysis (BIA) indicates that every hour of downtime costs $500,000. The current recovery time objective (RTO) for the core banking system is 4 hours, but the actual recovery capability is 6 hours due to manual steps in failover. The risk owner has accepted this risk informally. You are asked to recommend a course of action to the risk committee. Which of the following is the most appropriate recommendation?

Accepted Answer

Document the risk gap (actual recovery of 6 hours vs. RTO of 4 hours) and present it to the risk committee for formal risk acceptance or remediation.. The organization has a critical risk gap: the actual recovery capability (6 hours) exceeds the stated RTO (4 hours), meaning the business would incur $1M in losses (2 hours × $500K) before recovery completes. The risk owner's informal acceptance is insufficient for a financial institution processing high-value transactions; formal documentation and risk committee approval are required for governance and regulatory compliance. Presenting the gap enables informed decision-making on whether to accept the risk formally or invest in remediation (e.g., automating failover to meet the 4-hour RTO).

Answer

Accept the risk because the cloud provider's SLA covers 99.9% uptime.

Answer

Continue with informal acceptance since the risk owner has already accepted it.

Answer

Reduce the RTO to 2 hours to align with industry best practices.

Question 10

During a cost-benefit analysis for a new control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce risk by 80% and will cost $150,000 annually to operate. What is the net benefit of implementing the control?

Accepted Answer

$250,000. ALE reduction is 80% of $500,000 = $400,000. Net benefit = ALE reduction - annual control cost = $400,000 - $150,000 = $250,000.

Answer

$400,000

Answer

$100,000

Answer

$350,000

Question 11

A manufacturing company is integrating its operational technology (OT) network with the corporate IT network to enable real-time data analytics. Which of the following risks should be prioritized during the risk assessment?

Accepted Answer

Attack path expansion from IT to OT networks. Integrating OT and IT networks creates a new attack path from the IT network to the OT network. Since OT systems often lack modern security controls and run legacy protocols (e.g., Modbus, DNP3), an attacker who compromises the IT network can pivot into the OT environment, potentially disrupting physical processes. This risk is prioritized because it introduces a direct, high-impact threat to safety and availability that did not exist before the integration.

Answer

Incompatibility of IT and OT software versions

Answer

Increased latency in OT communications

Answer

Loss of data integrity in analytics dashboards

Question 12

A risk assessment using a 5x5 heat map with likelihood and impact scores is an example of which type of risk analysis?

Accepted Answer

Qualitative risk analysis. A 5x5 heat map uses ordinal scales (e.g., 1–5) for likelihood and impact, which are subjective categories rather than precise numerical values. This places it in qualitative risk analysis, where risks are ranked by descriptive labels (e.g., Low, Medium, High) without monetary or statistical quantification.

Answer

Semi-quantitative risk analysis

Answer

Factor Analysis of Information Risk (FAIR)

Answer

Quantitative risk analysis

Question 13

The exhibit shows a log entry from a GRC system. Which of the following is the MOST significant concern regarding this risk score update?

Accepted Answer

The control effectiveness status was not updated alongside the risk score. The risk score update without a corresponding update to the control effectiveness status creates a data integrity issue in the GRC system. Since the residual risk score is calculated as inherent risk multiplied by (1 - control effectiveness), changing the score without adjusting the effectiveness metric means the system's risk calculation is now inconsistent and unreliable for monitoring and reporting purposes.

Answer

The inherent risk score decreased without any change in the business environment

Answer

The comment does not provide sufficient detail on the mitigation project

Answer

The risk owner was not notified of the change

Question 14

A company is conducting a Risk Identification for a new payment processing system. The team discovers that the system does not have encryption at rest. This is an example of:

Accepted Answer

Vulnerability. The absence of encryption at rest in a payment processing system is a weakness or flaw that can be exploited, making it a vulnerability. In risk identification, a vulnerability is a condition or weakness in an asset (e.g., database, storage volume) that, if exploited by a threat, could lead to a risk event. Here, the missing encryption at rest (e.g., AES-256 for stored cardholder data) is a specific security gap, not the threat itself or the resulting risk.

Answer

Control

Answer

Threat

Answer

Risk

Question 15

Based on the exhibit, what is the MOST likely risk scenario?

Accepted Answer

Brute force attack resulting in account compromise. The exhibit shows a high number of failed authentication attempts from a single IP address over a short time window, followed by a successful login. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations until one succeeds, leading to account compromise.

Answer

Phishing attack that captured user credentials

Answer

Insider threat from a legitimate user

Answer

Denial of service attack on the authentication server

Question 16

A risk committee receives a monthly risk report that includes a heat map of inherent risk ratings and a separate list of control deficiencies. The committee members often complain that they cannot easily see which control deficiencies are most critical to address. Which of the following is the BEST improvement to the reporting?

Accepted Answer

Overlay control deficiency impact ratings onto the residual risk heat map. Overlaying control deficiency impact ratings onto the residual risk heat map directly addresses the committee's need to see which control deficiencies are most critical. This integrates control deficiency severity with residual risk levels, allowing the committee to prioritize remediation based on the actual risk exposure, not just inherent risk or a separate list.

Answer

Include a comprehensive list of all key risk indicators (KRIs)

Answer

Provide a separate section on recent audit findings

Answer

Add a timeline of when each control deficiency was first identified

Question 17

Based on the exhibit, which risk should be treated first according to the risk rating?

Accepted Answer

R001, because it has the highest risk level. Risk treatment priority is determined by the risk level, which is a function of both likelihood and impact. In the exhibit, R001 has the highest risk level (e.g., 16), calculated as likelihood × impact, making it the most critical to address first. This aligns with the CRISC principle of prioritizing risks with the highest residual risk rating.

Answer

R003, because the likelihood is highest

Answer

R002, because the impact is highest

Answer

All three should be treated simultaneously

Question 18

Refer to the exhibit. What does the exhibit most likely indicate about the control monitoring?

Accepted Answer

The control is effective but the monitoring configuration is incorrect.. The exhibit shows a control monitoring dashboard where the 'Effectiveness' metric is green (indicating the control is working), but the 'Monitoring Configuration' is red (indicating a misconfiguration in how the control is being monitored). This mismatch means the control itself is effective, but the monitoring setup—such as incorrect alert thresholds, missing log sources, or misconfigured SIEM rules—is not properly capturing or reporting its status. Therefore, the control is effective, but the monitoring configuration is incorrect.

Answer

The control is failing and needs immediate remediation.

Answer

The control is close to target but requires attention.

Answer

The control is meeting its target.

Question 19

An organization is implementing a new access control system. Which of the following is the most important activity to ensure the control is effectively integrated into operations?

Accepted Answer

Updating relevant documentation. Updating relevant documentation ensures that the new access control system's configuration, operational procedures, and troubleshooting steps are formally recorded and accessible to the operations team. Without accurate documentation, the control cannot be consistently maintained, monitored, or recovered during incidents, making it ineffective in day-to-day operations. This activity directly integrates the control into the operational lifecycle by providing a single source of truth for administrators.

Answer

Assigning control ownership

Answer

Performing a cost-benefit analysis

Answer

Conducting a post-implementation review

Question 20

A company plans to deploy an AI-based customer service chatbot that processes personal data. What risk should be identified as the highest priority?

Accepted Answer

Data privacy risk. Processing personal data through an AI chatbot directly introduces data privacy risk as the highest priority because the system will collect, store, and potentially expose sensitive information (e.g., names, contact details, payment data). Under regulations like GDPR or CCPA, any breach or unauthorized access to this data can result in severe fines and reputational damage. While other risks exist, privacy risk is immediate and fundamental to the chatbot's operation.

Answer

Vendor lock-in risk

Answer

Model accuracy risk

Answer

Regulatory compliance risk