CRISC Practice Exam 63 — 20 Questions

Question 1

Refer to the exhibit. An organization has identified vulnerabilities on a critical server. The risk owner has limited resources and can remediate only one finding this quarter. Based on the information provided, which approach is the most appropriate risk assessment decision?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remediate the SSL/TLS certificate vulnerability first, as it affects a critical service and has a higher severity.. The SSL/TLS certificate vulnerability affects a critical service (likely HTTPS) and has a higher severity rating, making it the most urgent risk to address given limited resources. Risk assessment prioritizes remediating vulnerabilities that pose the greatest threat to critical business functions, even if another finding is easier to fix. The risk owner should allocate the single remediation slot to the highest-severity vulnerability on a critical server to maximize risk reduction.

Answer

Remediate both findings by reallocating budget from another project.

Answer

Remediate the SSH vulnerability first because it is easier to fix (upgrade OpenSSH).

Answer

Accept both risks because they are low and medium severity, and resources are limited.

Question 2

GlobalTech Inc., a multinational corporation, is planning to migrate its customer data to a new cloud platform. The migration involves transferring sensitive personally identifiable information (PII) from an on-premises database to a cloud-based CRM. The risk manager conducted a risk assessment and identified several risks, including unauthorized access during transit and residual data exposure due to misconfiguration. Mitigation controls include encryption in transit, encryption at rest, and strict access controls. The residual risk after mitigation is assessed as medium. The risk appetite statement defines that 'No data breach incidents resulting in regulatory fines exceeding $1 million are acceptable.' The estimated potential fine from a breach is $5 million with a likelihood of 2% after controls. The cost of additional controls to reduce likelihood to 0.5% is $500,000. The migrating team proposes to purchase cyber insurance with a $3 million coverage for $200,000 annual premium. The board of directors prefers to accept the residual risk to avoid additional costs. What should the risk manager do?

Accepted Answer

Advise the board to avoid the migration until all risks are eliminated.. The residual risk after mitigation still exceeds the risk appetite: the potential fine of $5 million exceeds the $1 million threshold, and neither the proposed insurance (which covers only $3 million and does not reduce the residual risk) nor additional controls (cost $500,000 to reduce likelihood to 0.5%, but the expected loss of $25,000 is still below $1 million? Actually, the expected loss after additional controls would be $5M * 0.5% = $25,000, which is within appetite; however, the board prefers to accept the residual risk, but the risk manager must align with the risk appetite statement. The board's preference conflicts with the risk appetite; therefore, the risk manager should advise avoidance (not migrate until risks are eliminated) as it is the only option that ensures no breach exceeds the $1M fine threshold. Options B and C leave the risk above appetite, and D is costly and may not fully eliminate the risk of a breach exceeding $1M, so avoidance is the most prudent choice.

Answer

Recommend purchasing cyber insurance to transfer the risk.

Answer

Accept the board's decision since the residual risk is medium.

Answer

Recommend implementing additional controls to reduce likelihood to 0.5%.

Question 3

A risk manager is reviewing the risk register and notices that several risks have been identified as 'high' but no risk owner has been assigned. Which of the following is the MOST appropriate action to ensure proper risk identification going forward?

Accepted Answer

Update the risk identification policy to mandate that risk owners be identified during the initial risk identification phase.. The risk identification phase should include assigning risk owners to ensure accountability from the outset. Without a risk owner, identified risks cannot be properly managed, monitored, or escalated. Mandating owner assignment during initial identification embeds ownership into the process, preventing gaps in risk governance.

Answer

Provide training to risk owners on their responsibilities.

Answer

Assign risk owners after the risk assessment is completed.

Answer

Conduct an audit of the risk identification process.

Question 4

What is the primary purpose of a risk heat map in IT risk reporting?

Accepted Answer

Provide a visual representation of risk levels. A risk heat map visualizes risks based on likelihood and impact, helping prioritize attention.

Answer

Show control performance metrics

Answer

Display risk trends over time

Answer

List upcoming risk events

Question 5

A financial institution is selecting a risk assessment methodology for evaluating cybersecurity risks across its critical systems. Which of the following is the PRIMARY consideration when choosing between qualitative and quantitative approaches?

Accepted Answer

Availability of reliable numerical data for risk factors. The choice between qualitative and quantitative risk assessment hinges on the availability of reliable numerical data. Quantitative methods require precise, objective data (e.g., asset values, historical loss frequencies, exposure factors) to compute metrics like Annualized Loss Expectancy (ALE). Without such data, the results would be misleading, making qualitative approaches (using ordinal scales and expert judgment) more appropriate. This is the primary technical gate, as it directly determines the feasibility and validity of the quantitative model.

Answer

The skill level of the risk assessment team

Answer

The organization's risk appetite statement

Answer

Compliance with regulatory requirements

Question 6

An organization uses a quantitative risk analysis method. The annualized loss expectancy (ALE) for a specific risk is calculated as $500,000. The cost of implementing a control is $150,000 per year, and it is expected to reduce the ALE by 80%. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The current ALE is $500,000. An 80% reduction means the ALE decreases by $400,000, resulting in a new ALE of $100,000. The annual control cost is $150,000. The net benefit is the reduction in ALE ($400,000) minus the control cost ($150,000), which equals $250,000. Option C is correct because it correctly calculates the net benefit as the risk reduction minus the control cost.

Answer

$50,000

Answer

$400,000

Answer

$350,000

Question 7

An organization is evaluating risks and decides to purchase cyber insurance to cover potential financial losses from data breaches. Which risk treatment option does this represent?

Accepted Answer

Transfer. Transfer involves shifting risk to a third party, such as through insurance or outsourcing with liability transfer.

Answer

Accept

Answer

Mitigate

Answer

Avoid

Question 8

Which TWO of the following are examples of external risk identification sources? (Choose two.)

Accepted Answer

Regulatory bulletins from government agencies. Regulatory bulletins from government agencies (Option B) are external risk identification sources because they originate outside the organization and provide authoritative information on compliance requirements, legal changes, and mandated controls. Threat intelligence feeds from industry sources (Option D) are also external, as they aggregate data on emerging threats, vulnerabilities, and attack patterns from third-party vendors or open-source communities, helping organizations proactively adjust defenses. The other options (A, C, E) are internal sources or are not primarily used for risk identification from an external perspective.

Answer

Incident response reports from the security operations center

Answer

Internal vulnerability scan reports

Answer

Industry benchmarking reports

Question 9

An organization is evaluating a new security control that costs $50,000 annually to implement and maintain. The current annualized loss expectancy (ALE) for a related risk is $200,000. The control is expected to reduce the ALE by 85%. Using cost-benefit analysis, what is the net benefit of implementing this control?

Accepted Answer

$120,000. The reduction in ALE is 85% of $200,000 = $170,000. The annual control cost is $50,000. Net benefit = $170,000 - $50,000 = $120,000.

Answer

$30,000

Answer

$170,000

Answer

$150,000

Question 10

An organization is developing a vendor risk management program. Which THREE activities should be included in the initial onboarding assessment for a high-risk vendor?

Accepted Answer

Evaluating contract compliance requirements. Evaluating contract compliance requirements is a critical initial onboarding activity for a high-risk vendor because it ensures the vendor's service level agreements (SLAs), data protection clauses, and regulatory obligations (e.g., GDPR, PCI DSS) are formally documented and enforceable. This step establishes the legal and operational baseline for risk acceptance and ongoing monitoring, directly supporting the risk response strategy within the vendor risk management program.

Answer

Conducting an onsite physical security inspection

Answer

Analyzing the vendor's financial statements

Question 11

Match each key risk indicator (KRI) to its description.

Accepted Answer

Mean Time to Detect (MTTD): The average time taken to detect an incident after it occurs.. In CRISC, KRIs like MTTD, MTTR, vulnerability percentage, and incident count provide early warning. Common mistakes include confusing MTTD and MTTR, or mixing incident count with vulnerability metrics.

Answer

Mean Time to Detect (MTTD): The average time taken to respond to and resolve an incident.

Answer

Number of Security Incidents per Month: The proportion of systems that have critical security patches not applied.

Question 12

A risk manager is prioritizing risks based on their inherent risk scores. Which of the following factors should be considered when prioritizing treatment actions?

Accepted Answer

The cost-benefit analysis of controls. Prioritization should consider the risk level and the cost-benefit of controls to ensure efficient use of resources.

Answer

The residual risk after controls

Answer

Only the inherent risk score

Answer

The likelihood of control failure

Question 13

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

Accepted Answer

Tune the system to reduce false positives. B is correct because tuning the system involves adjusting detection thresholds, rules, or machine learning models to reduce false positives while maintaining sensitivity to actual fraud. This directly addresses the root cause—poorly calibrated detection logic—without sacrificing the system's primary function or incurring unsustainable costs.

Answer

Accept the false positives as a cost of doing business

Answer

Remove the monitoring system to focus on other controls

Answer

Hire additional analysts to review all alerts

Question 14

Which TWO of the following are appropriate actions when a control deficiency is identified during monitoring? (Select exactly two.)

Accepted Answer

Document the deficiency and its impact. Documenting the deficiency and its impact is a fundamental step in the risk and control monitoring process. It ensures that the nature, severity, and potential consequences of the control failure are formally recorded, which is essential for risk assessment, reporting, and audit trails. Without this documentation, the organization cannot properly evaluate the risk exposure or justify remediation efforts.

Answer

Increase the risk appetite

Answer

Ignore if the deficiency is minor

Answer

Immediately terminate the control owner

Question 15

An organization wants to promote a risk-aware culture. Which initiative best supports this goal?

Accepted Answer

Encouraging incident reporting without blame. Encouraging incident reporting without blame directly supports a risk-aware culture by removing the fear of punishment, which motivates employees to report issues promptly. This allows the organization to identify and respond to risks early, rather than hiding them, and aligns with the risk response principle of learning from incidents to improve controls.

Answer

Focusing only on technical controls

Answer

Limiting risk awareness training to IT staff

Answer

Punishing employees who cause security incidents

Question 16

An organization uses Key Control Indicators (KCIs) to measure the effectiveness of its firewall change management process. Which KCI would best indicate a process deficiency?

Accepted Answer

Exception rate for changes not following the standard process. A high exception rate indicates that changes are frequently bypassing the standard process, signaling a control weakness.

Answer

Percentage of changes approved by the change advisory board

Answer

Average time to implement a change

Answer

Number of firewall rules added per month

Question 17

Which of the following is a key advantage of using a quantitative risk analysis approach such as FAIR?

Accepted Answer

Produces objective, comparable financial metrics. Quantitative analysis provides objective, financially meaningful results that can be compared across organizations.

Answer

Quick to perform with minimal data

Answer

Provides subjective rankings easy to communicate

Answer

Eliminates uncertainty in risk estimates

Question 18

A manufacturing company uses an industrial control system (ICS) that is connected to the corporate network for monitoring. The risk manager is identifying risks related to this connectivity. Which of the following is the MOST significant risk?

Accepted Answer

Compromise of ICS causing physical damage to manufacturing equipment.. The most significant risk is that a compromise of the ICS could lead to physical damage, such as equipment destruction, safety hazards, or environmental release. Unlike IT systems where data loss is the primary concern, ICS failures directly impact the physical world, making safety and operational integrity the top priority in risk identification.

Answer

Malware infection spreading from corporate to ICS network.

Answer

Network congestion due to ICS traffic affecting corporate users.

Answer

Unauthorized access to corporate data through the ICS connection.

Question 19

Refer to the exhibit. Given the organization's risk appetite is Low, which risk response is most appropriate?

Accepted Answer

Implement additional monitoring to reduce residual risk to Low.. With a Low risk appetite, the organization requires residual risk to be Low. Option D proposes implementing additional monitoring to reduce the Medium residual risk to Low, which aligns with the risk appetite. This is a corrective response that mitigates the risk without unnecessary business disruption.

Answer

Accept the current residual risk because it is Medium.

Answer

Avoid the risk by discontinuing operations.

Answer

Transfer the risk via insurance.

Question 20

A smart manufacturing company has deployed hundreds of IoT sensors and actuators across its production line. These devices are connected directly to the corporate network without any segmentation and communicate using unencrypted protocols. A third-party vendor manages all IoT devices and has administrative access from their own network. Recently, the IT team detected unusual outbound traffic from the IoT segment to unknown IP addresses on the internet. The risk manager is leading a risk identification workshop. Based on this scenario, what is the most critical risk to the organization that should be identified and documented?

Accepted Answer

Unauthorized remote access to the corporate network via the IoT devices. The most critical risk is unauthorized remote access to the corporate network via the IoT devices. The IoT devices are directly connected to the corporate network without segmentation and communicate using unencrypted protocols, while a third-party vendor has administrative access from their own network. The unusual outbound traffic to unknown IP addresses strongly suggests that an attacker has compromised the vendor's network or the devices themselves, using the unencrypted protocols (e.g., MQTT without TLS, Modbus/TCP) to pivot into the corporate network, bypassing perimeter defenses.

Answer

Compliance violation with industry regulations

Answer

Loss of data integrity due to tampering with sensor measurements

Answer

Physical damage to equipment due to unsafe actuator commands