CRISC Practice Exam 63 — 20 Questions

Question 1

A risk practitioner is assessing the organization's backup and recovery controls for a critical on-premises database. The recovery time objective (RTO) is four hours and the recovery point objective (RPO) is fifteen minutes. The current design replicates backups nightly to an offsite tape vault. Which finding is MOST significant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Nightly backups cannot satisfy the fifteen-minute recovery point objective, so up to a day of data could be lost.. The RPO of fifteen minutes requires that no more than fifteen minutes of data can be lost, which demands frequent replication or continuous data protection. Nightly backups leave up to a full day of transactions at risk, so the design cannot meet the business requirement. This mismatch is the most significant finding and must drive a redesign toward more frequent replication.

Answer

Tape media have a limited shelf life and may degrade before they are needed for restoration.

Answer

The recovery time objective of four hours may be unachievable without a documented disaster recovery test.

Answer

The backup media are stored offsite, which introduces a delay in retrieving them during a recovery.

Question 2

A retail company is implementing a new point-of-sale (POS) system that accepts contactless payments. The risk practitioner identifies that the existing network segmentation between the POS environment and the corporate network is inadequate. The risk committee asks for compensating controls that will reduce the risk of lateral movement from a compromised POS terminal. Which TWO of the following controls BEST address this risk? (Choose two.)

Accepted Answer

Implement network access control (NAC) that requires POS terminals to authenticate and comply with a hardened configuration before joining the network.. Lateral movement from a compromised POS terminal is best mitigated by preventive controls that restrict network traffic and enforce device trust. A next-generation firewall with least-privilege rules limits what the POS network can reach, and network access control ensures only compliant, authenticated devices connect. Together they compensate for weak segmentation by reducing the pathways and trust an attacker can exploit. Encryption, scanning, and centralization do not directly block lateral movement.

Answer

Store payment card data in a centralized encrypted database on the corporate network to simplify management.

Answer

Enable full disk encryption on all POS terminals to protect payment card data at rest.

Answer

Conduct quarterly vulnerability scans of the POS environment to identify missing patches.

Question 3

A university is deploying a new student information system that will store grades, financial aid records, and health center notes. The risk practitioner must determine the data classification that drives encryption, access, and retention requirements. Which factor is MOST important in setting that classification?

Accepted Answer

The potential harm to students and the university if the data is disclosed, altered, or unavailable.. Classification should be driven by the impact of compromise, because that impact determines how strong encryption, access, and retention controls must be. Student health notes and financial aid records cause significant harm if exposed or altered, so harm analysis is the correct basis. Volume, tooling cost, and vendor defaults are operational or commercial factors that cannot reliably indicate sensitivity.

Answer

The vendor's default classification assigned in the student information system's configuration templates.

Answer

The volume of records the system will hold and the projected annual growth rate.

Answer

The cost of the encryption and access management tools required to protect the system.

Question 4

A healthcare organization has identified that its patient portal has a vulnerability that could expose sensitive data. The risk owner decides to implement multifactor authentication (MFA) for all users. After implementation, the risk practitioner conducts a follow-up assessment and finds that some users are sharing credentials, potentially bypassing MFA. The risk practitioner should FIRST:

Accepted Answer

Report the control failure to the risk owner and reassess the residual risk.. When a control is found to be ineffective or circumvented, the risk practitioner must first report the control failure to the risk owner and reassess the residual risk. This ensures that the risk owner is aware of the changed risk landscape and can make an informed decision on whether to accept, mitigate, or transfer the risk. The reassessment should consider the extent of credential sharing, its impact on the MFA control's effectiveness, and any additional vulnerabilities. Only after this reassessment should further actions, such as training or technical controls, be considered.

Answer

Recommend additional security awareness training for all users.

Answer

Implement technical controls to prevent credential sharing, such as device fingerprinting.

Answer

Accept the residual risk because MFA is still partially effective.

Question 5

A multinational bank is subject to GDPR and local data protection laws. The risk practitioner is reviewing a risk treatment plan for a new customer analytics platform that will process personal data across three jurisdictions. The plan proposes to rely on the vendor's standard contractual clauses (SCCs) as the primary control for cross-border data transfers. Which factor is MOST important for the risk practitioner to evaluate when assessing the adequacy of this risk response?

Accepted Answer

Whether the vendor's SCCs have been updated to the latest regulatory version and whether a transfer impact assessment has been completed for each jurisdiction.. When SCCs are used as a cross-border transfer control, their adequacy depends on being current with regulatory requirements and being supported by a transfer impact assessment for each destination jurisdiction. The risk practitioner must evaluate legal validity and local law conflicts, not just technical security or retention practices. This ensures the risk response actually mitigates the regulatory risk of unlawful data transfers under GDPR and local laws.

Answer

Whether the analytics platform uses encryption in transit and at rest for all personal data.

Answer

Whether the vendor has a SOC 2 Type II report covering the analytics platform's security controls.

Answer

Whether the vendor's data retention policy aligns with the bank's internal records management schedule.

Question 6

A multinational corporation has a risk register entry for a supplier that provides critical components. The supplier has a history of financial instability, and the risk of supply chain disruption is high. The risk owner decides to dual-source the components from a second supplier. Which risk response strategy does this represent, and what is the primary benefit?

Accepted Answer

Risk mitigation, because it reduces the likelihood of disruption. Dual-sourcing is a risk mitigation technique that reduces the likelihood of supply chain disruption by providing an alternative source. It does not transfer, avoid, or accept the risk; it actively reduces it. The primary benefit is increased resilience and reduced dependency on a single supplier.

Answer

Risk transfer, because the risk is shared with the second supplier

Answer

Risk avoidance, because the organization avoids relying on a single supplier

Answer

Risk acceptance, because the organization accepts the supplier risk but adds a backup

Question 7

A risk manager is reviewing the risk treatment plan for a new mobile banking application. The plan includes implementing multi-factor authentication (MFA) and conducting regular vulnerability scans. The risk manager wants to ensure that the controls are operating effectively. Which of the following should be performed to verify the effectiveness of the controls?

Accepted Answer

Control testing. To verify that controls are operating effectively, the risk manager should perform control testing. This involves examining and testing the controls to ensure they are implemented correctly and functioning as intended. Risk assessment, gap analysis, and BIA serve different purposes and do not provide assurance on control effectiveness.

Answer

Gap analysis

Answer

Business impact analysis (BIA)

Answer

Risk assessment

Question 8

A financial services firm is deploying a security information and event management (SIEM) platform. The risk practitioner is asked to advise on how to keep the alert pipeline trustworthy so that detection and response decisions rest on reliable data. Which of the following is the MOST important control to prioritize?

Accepted Answer

Protect the integrity and time synchronization of log sources and the collection path end to end.. A SIEM is only as reliable as the events it receives, so the priority is ensuring those events are authentic and consistently time-stamped. Protecting log sources and the transport path against tampering, and synchronizing clocks, prevents attackers from hiding activity or fabricating evidence. Volume, tuning, and packet capture all matter operationally but none of them restores confidence in data that could have been altered.

Answer

Enable full packet capture retention for at least ninety days across all network segments.

Answer

Tune correlation rules to reduce the number of alerts reaching the analyst queue.

Answer

Maximize the number of log sources ingested so that no event type is missed.

Question 9

A risk practitioner is working with the IT team to design controls for a new cloud-based human resources system. The team proposes using encryption for data at rest and in transit, role-based access controls, and regular backups. The risk practitioner notes that these controls address confidentiality, integrity, and availability. Which of the following should the risk practitioner recommend to ensure the controls remain effective over time?

Accepted Answer

Implement a continuous monitoring program that includes automated alerts for control failures.. Continuous monitoring with automated alerts ensures that controls are consistently effective by detecting failures or deviations quickly. In a cloud environment, where changes are frequent, periodic assessments or audits are insufficient. Continuous monitoring provides ongoing assurance and supports timely risk response, aligning with CRISC best practices for maintaining risk within appetite.

Answer

Document the controls in the risk register and review them during the next audit.

Answer

Perform a penetration test after the system goes live and then every two years.

Answer

Conduct an annual risk assessment to re-evaluate the risks and controls.

Question 10

A financial services firm's risk register shows that a critical trading application has a high inherent risk of unauthorized access. The risk owner decides to implement multifactor authentication (MFA) and role-based access controls (RBAC). After implementation, the residual risk score decreases but remains above the risk appetite. Which of the following should the risk practitioner recommend NEXT?

Accepted Answer

Perform additional risk response to further reduce the residual risk to within appetite.. The correct answer is to perform additional risk response because residual risk still exceeds the risk appetite. CRISC emphasizes that risk treatment is iterative: after controls are applied, if residual risk is not within appetite, further action is needed. This could include additional controls, risk avoidance, or transfer, but the key is to continue treatment until risk is acceptable.

Answer

Accept the residual risk because the controls have reduced it significantly.

Answer

Remove the existing controls and reassess the inherent risk.

Answer

Transfer the entire risk to a third party through insurance.

Question 11

A multinational corporation is deploying a new enterprise resource planning (ERP) system across 30 countries. The risk manager identifies that data residency laws in several countries require customer data to remain within national borders. The project team proposes using a single global cloud region for simplicity. Which risk response strategy is MOST appropriate for the risk manager to recommend?

Accepted Answer

Mitigate the risk by implementing data localization controls, such as regional data centers or data residency zones.. The correct answer is to mitigate the risk by implementing data localization controls. This approach directly addresses the legal requirement while allowing the ERP deployment to continue. Risk mitigation is appropriate when the risk can be reduced to an acceptable level through controls, and it balances business needs with compliance obligations.

Answer

Accept the risk because the cloud provider's global presence ensures compliance.

Answer

Avoid the risk by canceling the ERP deployment in countries with strict data residency laws.

Answer

Transfer the risk by outsourcing data management to a third-party provider.

Question 12

A software development company is adopting a DevOps model and wants to accelerate deployments. The risk manager is concerned that rapid changes could introduce security vulnerabilities. The team proposes implementing automated security testing in the CI/CD pipeline. Which of the following BEST describes the risk response strategy being applied?

Accepted Answer

Risk mitigation. The correct answer is risk mitigation. By integrating automated security testing into the CI/CD pipeline, the company is implementing a control that reduces the likelihood of vulnerabilities reaching production. This is a proactive mitigation strategy that aligns with CRISC's emphasis on embedding risk management into business processes.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 13

A risk practitioner is assessing the security of an organization's software development lifecycle (SDLC). The organization wants to integrate security early to reduce the cost and impact of fixing vulnerabilities. Which TWO of the following practices are MOST effective for achieving this goal? (Choose two.)

Accepted Answer

Training developers on secure coding practices.. Integrating security early in the SDLC means identifying and fixing vulnerabilities during development rather than after deployment. Static application security testing (SAST) and secure coding training are both shift-left practices that enable developers to find and prevent flaws early, reducing remediation costs. Penetration testing, post-deployment audits, and WAFs are later-stage or runtime controls that do not achieve early integration.

Answer

Performing penetration testing just before production release.

Answer

Using a web application firewall (WAF) to block attacks in production.

Answer

Conducting a security audit after the application is deployed.

Question 14

A risk manager is evaluating the risk of a distributed denial-of-service (DDoS) attack against the organization's public-facing web application. The organization has a 1 Gbps internet connection and no DDoS mitigation service. Which of the following is the MOST important factor in determining the potential impact of a volumetric DDoS attack?

Accepted Answer

The bandwidth of the organization's internet connection compared to the attack traffic volume.. In a volumetric DDoS attack, the attacker floods the target with a high volume of traffic to exhaust network bandwidth. The potential impact is primarily determined by whether the attack traffic exceeds the organization's internet connection capacity. If the attack volume is greater than 1 Gbps, the link will be saturated, causing an outage. Thus, the bandwidth of the connection relative to the attack volume is the most critical factor in assessing impact.

Answer

The geographic location of the attackers launching the DDoS attack.

Answer

The number of users who will be unable to access the application during the attack.

Answer

The type of web server software used to host the application.

Question 15

During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control will cost $100,000 annually and is expected to reduce the ALE by 80%. What is the net benefit of implementing this control?

Accepted Answer

$300,000. The current annual loss expectancy (ALE) is $500,000. An 80% reduction lowers the ALE by $400,000, resulting in a new ALE of $100,000. The annual control cost is $100,000, so the net benefit is the reduction in ALE ($400,000) minus the control cost ($100,000), which equals $300,000.

Answer

$100,000

Answer

$400,000

Answer

$500,000

Question 16

When assessing IT risks, which of the following is the PRIMARY purpose of developing risk scenarios?

Accepted Answer

To identify specific threats and vulnerabilities that could impact objectives. The primary purpose of developing risk scenarios in IT risk assessment is to identify specific threats and vulnerabilities that could impact business objectives. Risk scenarios provide a structured narrative that links threat sources, vulnerabilities, and potential impacts, enabling a focused analysis of how adverse events might occur. This is foundational for prioritizing risks and determining appropriate controls, rather than for calculating exact losses, compliance, or continuity planning.

Answer

To calculate the exact financial loss

Answer

To satisfy regulatory compliance

Answer

To create a business continuity plan

Question 17

Which component of the NIST Cybersecurity Framework is primarily concerned with developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The NIST Cybersecurity Framework Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. The Protect function is explicitly defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services, covering areas like access control, awareness training, data security, and protective technology. This matches the question's wording exactly, making Protect the correct answer.

Answer

Detect

Answer

Identify

Answer

Recover

Question 18

An organization uses a KRI that tracks the average time to patch critical vulnerabilities. The metric has been increasing over the past three months. What does this indicate from a risk perspective?

Accepted Answer

The risk of exploitation is increasing. An increasing average time to patch critical vulnerabilities indicates that the organization is taking longer to remediate known security weaknesses. From a risk perspective, this directly increases the window of exposure, making it more likely that an attacker will exploit a vulnerability before a patch is applied. Therefore, the risk of exploitation is increasing.

Answer

The control effectiveness is improving

Answer

The risk appetite has been reduced

Answer

The risk of exploitation is decreasing

Question 19

A risk assessment report includes both inherent and residual risk ratings. The inherent risk for a process is rated as 'high' based on a 5×5 heat map. After applying a set of controls, the residual risk is rated as 'medium'. What does this indicate about the control effectiveness?

Accepted Answer

Controls are partially effective in reducing risk.. The reduction from high to medium indicates that controls are partially effective in reducing risk, but not completely.

Answer

Controls increased the risk level.

Answer

Controls are fully effective and eliminate all risk.

Answer

Controls are not effective at all.

Question 20

A retail company is conducting a risk assessment for its point-of-sale (POS) systems. The risk team determines that the inherent risk of a malware attack is high. The company implements endpoint detection and response (EDR) tools and network segmentation. After these controls, the risk is re-evaluated. What is this re-evaluated risk called?

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls are implemented. In this scenario, the company applied EDR and network segmentation to reduce the high inherent risk of malware. The re-evaluated risk is the residual risk, which should be compared to the organization's risk appetite to determine if further action is needed.

Answer

Control risk

Answer

Detection risk

Answer

Inherent risk