CRISC Practice Exam 64 — 20 Questions

Question 1

A company has a low risk appetite but high risk tolerance. Which of the following scenarios is consistent with this situation?

Accepted Answer

The company invests heavily in cybersecurity controls but accepts some residual risk. A low risk appetite means the company is unwilling to accept high levels of risk, while high risk tolerance indicates it can absorb the financial or operational impact of residual risk that remains after controls are applied. Investing heavily in cybersecurity controls reduces inherent risk to a low residual level, aligning with the low appetite, and the acceptance of some residual risk is consistent with the high tolerance. This scenario reflects a balanced approach where controls are prioritized to meet appetite, and tolerance allows for manageable leftover risk.

Answer

The company avoid controls and accepts high risk

Answer

The company has aggressive growth targets and accepts any IT risk

Answer

The company invests minimally in controls and has low residual risk

Question 2

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?

Accepted Answer

Expanded attack path from IT to OT systems. Connecting OT networks to IT networks expands the attack surface, allowing threats from the corporate network to reach ICS/SCADA systems, which were previously isolated.

Answer

Higher licensing costs for industrial software

Answer

Increased complexity of data analytics

Answer

Reduced operational efficiency due to network latency

Question 3

An organization is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. Which of the following is the PRIMARY risk introduced by this IT/OT convergence?

Accepted Answer

Expansion of the attack surface to OT systems. The primary risk is the expansion of the attack surface, as previously isolated OT systems become accessible from the corporate network, increasing the likelihood of cyber attacks propagating to critical industrial systems.

Answer

Reduced availability of OT systems

Answer

Higher cost of network equipment

Answer

Increased complexity of data analytics

Question 4

A risk practitioner discovers that a critical control deficiency has been open for six months beyond the agreed remediation date. What is the MOST appropriate reporting action?

Accepted Answer

Report the overdue deficiency to senior management for escalation.. A critical control deficiency that remains unresolved six months past its remediation date represents a significant governance failure and an elevated risk exposure that exceeds the organization's risk appetite. The risk practitioner's primary reporting obligation under CRISC principles is to escalate such overdue deficiencies to senior management, who have the authority and accountability to enforce remediation, allocate resources, or accept the risk formally. This aligns with the monitoring and reporting domain, where timely escalation of control failures is essential to maintain the integrity of the risk management process.

Answer

Notify the control owner and request an updated remediation plan.

Answer

Accept the delay and extend the remediation date by six months.

Answer

Update the risk register to reflect the increased residual risk and close out the deficiency.

Question 5

An organization's risk committee reviews a risk heat map showing that a key IT risk has moved from the "high" to "medium" category. However, the associated control's effectiveness has decreased from 95% to 85%. What is the most likely explanation?

Accepted Answer

The inherent risk has decreased due to external factors.. The risk heat map shows a reduction in residual risk from high to medium, yet the control effectiveness dropped from 95% to 85%. This apparent contradiction is best explained by a decrease in inherent risk—the risk before controls are applied. If inherent risk falls (e.g., due to external factors like new regulations or reduced threat activity), the residual risk can decrease even if the control becomes less effective, because the starting risk level is lower.

Answer

The control testing frequency was increased.

Answer

The risk assessment methodology was changed.

Answer

The control owner has implemented additional compensating controls.

Question 6

A healthcare organization is implementing a new electronic health records (EHR) system. During the risk assessment, the risk practitioner discovers that the system's access control mechanism allows any authenticated user to view patient records without additional authorization checks. This violates the principle of least privilege and could lead to unauthorized disclosure of protected health information (PHI). The IT team proposes implementing role-based access control (RBAC), but it will require significant changes to the system configuration and user training. The project manager is concerned about delays to the go-live date. The organization has a moderate risk appetite but must comply with HIPAA regulations. Which of the following actions should the risk practitioner recommend FIRST?

Accepted Answer

Implement a temporary compensating control, such as logging and monitoring all accesses to patient records, and proceed with go-live while RBAC is developed.. It balances the immediate need to go live with the critical requirement to protect PHI. Logging and monitoring all accesses acts as a detective compensating control, providing visibility into unauthorized disclosures while the more robust RBAC preventive control is developed. This approach aligns with the organization's moderate risk appetite and HIPAA compliance obligations by not accepting the risk outright, but also not delaying the project unnecessarily.

Answer

Accept the risk because the likelihood of unauthorized access is low.

Answer

Proceed with the go-live as scheduled and plan to implement RBAC in a future upgrade.

Answer

Delay the go-live until RBAC is fully implemented to ensure compliance.

Question 7

A risk assessment identifies a threat with high likelihood and high impact. The risk owner proposes transferring the risk via cyber insurance. However, the insurance policy has a high deductible and excludes certain attack types. Which THREE of the following should be considered when evaluating the effectiveness of this risk transfer?

Accepted Answer

The cost of the insurance premium relative to the expected loss. Risk transfer effectiveness depends on policy coverage, residual risk after transfer, and cost-benefit. Likelihood reduction is not directly applicable as transfer does not reduce likelihood.

Answer

The impact of the risk on operational productivity

Answer

The likelihood of the threat event occurring

Question 8

In the context of ERM integration, IT risk is typically considered a subset of which broader risk category?

Accepted Answer

Operational risk. In Enterprise Risk Management (ERM) integration, IT risk is typically categorized as a subset of operational risk because it directly impacts the availability, integrity, and confidentiality of information systems and data, which are core operational assets. Operational risk encompasses failures in internal processes, people, and systems, and IT risk—such as system outages, data breaches, or software defects—falls squarely within this domain. This alignment is reinforced by frameworks like COSO and ISO 31000, which treat technology-related failures as operational risk events.

Answer

Strategic risk

Answer

Financial risk

Answer

Compliance risk

Question 9

During a quarterly risk review, the CISO notes that the number of failed authentication attempts has increased by 300% over the last month. The IT team confirms no changes to authentication systems. This metric is BEST categorized as which of the following?

Accepted Answer

Key Risk Indicator (KRI). A Key Risk Indicator (KRI) is a metric used to signal a change in risk exposure. A 300% increase in failed authentication attempts, with no changes to the authentication system, strongly indicates a potential ongoing brute-force attack or credential stuffing campaign, directly elevating the risk of unauthorized access. This metric is not measuring performance (KPI), contractual service levels (SLA), or the effectiveness of a specific control (KCI), but rather a change in the risk landscape.

Answer

Key Performance Indicator (KPI)

Answer

Service Level Agreement (SLA) metric

Answer

Key Control Indicator (KCI)

Question 10

Which of the following is a key component of an IT risk management programme that documents identified risks, their likelihood, and impact?

Accepted Answer

Risk register. The risk register is the central repository within an IT risk management programme that formally documents identified risks, their assessed likelihood, and potential impact. It serves as the authoritative record for tracking risk ownership, mitigation status, and residual risk levels, enabling ongoing monitoring and reporting. Without a risk register, an organization cannot systematically manage or communicate its risk posture.

Answer

Risk management policy

Answer

Business continuity plan

Answer

Incident response plan

Question 11

A multinational corporation uses a common identity management system (IdM) across all subsidiaries. During a risk assessment, it is discovered that the IdM system has a critical vulnerability that could allow privilege escalation. The patch requires a 4-hour downtime. The risk manager must decide the best course of action considering the organization's risk appetite of 'low' and the fact that the IdM system is critical for business operations. Which of the following is the BEST approach?

Accepted Answer

Schedule the patch during the next maintenance window.. Scheduling the patch during the next maintenance window aligns with the organization's low risk appetite by addressing the critical vulnerability in a controlled manner, while minimizing operational disruption. The IdM system is critical for business operations, so applying the patch immediately during business hours (Option C) would cause unacceptable downtime, and delaying indefinitely (Option D) would violate the low risk appetite. A 4-hour downtime is typical for identity management systems like Active Directory or LDAP, where patching requires a reboot or service restart, and a planned maintenance window allows for proper testing and rollback procedures.

Answer

Implement a compensating control and delay patching.

Answer

Apply the patch immediately during business hours.

Answer

Accept the risk and postpone patching indefinitely.

Question 12

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Accepted Answer

Deploying network segmentation. Deploying network segmentation (D) reduces the likelihood of a ransomware attack by limiting lateral movement. If an endpoint is compromised, segmentation using VLANs or firewall rules (e.g., 802.1Q, ACLs) prevents the ransomware from spreading to critical systems, thereby reducing the attack surface and the probability of widespread encryption. User awareness training (E) directly reduces likelihood by teaching users to recognize phishing emails and malicious attachments, which are the primary initial vectors for ransomware delivery.

Answer

Installing intrusion detection systems

Answer

Conducting periodic vulnerability scans

Answer

Regularly backing up critical data

Question 13

A retail company is assessing the risk of a POS malware attack. Which approach would BEST quantify the potential financial impact?

Accepted Answer

Scenario analysis with input from business and IT stakeholders. Scenario analysis with input from business and IT stakeholders is the best approach because it allows the organization to model specific POS malware attack scenarios, incorporating both technical threat vectors (e.g., memory scraping of track data) and business context (e.g., PCI DSS fines, card reissuance costs, brand damage). This collaborative method produces a more accurate and contextualized financial impact estimate than purely historical or technical assessments, especially for emerging or evolving threats like POS malware.

Answer

Vulnerability scanning and penetration testing

Answer

Annualized Loss Expectancy (ALE) calculation based on past incidents

Answer

Failure Mode and Effects Analysis (FMEA)

Question 14

You are the risk manager for a healthcare provider. A risk assessment identified that patient data is transmitted over unencrypted connections between clinics and the data center. The existing controls include strong network perimeter defenses. The risk is rated as high. Management is concerned about the cost of implementing encryption. You have proposed a control that encrypts data in transit. However, the network team argues that the perimeter controls are sufficient. What is the MOST appropriate response?

Accepted Answer

Implement encryption as recommended because it addresses the vulnerability directly.. Encrypting data in transit directly addresses the vulnerability of unencrypted connections, which is the root cause of the high risk. Perimeter controls like firewalls and IDS/IPS do not protect the confidentiality of data once it leaves the protected network boundary, as they cannot prevent interception on the wire. Implementing encryption (e.g., TLS 1.2/1.3 or IPsec) ensures end-to-end confidentiality regardless of perimeter strength.

Answer

Transfer the risk to a third party by outsourcing data transmission.

Answer

Accept the risk because perimeter controls are in place.

Answer

Reduce the risk rating to medium since perimeter controls provide compensating security.

Question 15

A company's IT risk manager is evaluating Key Risk Indicators (KRIs) for the cybersecurity function. Which TWO of the following are valid examples of leading KRIs?

Accepted Answer

Patch lag metric for critical systems. A patch lag metric measures the time taken to apply security patches to critical systems, which is a proactive indicator of potential vulnerability exposure before an exploit occurs. As a leading KRI, it predicts future security incidents by highlighting delayed remediation efforts, aligning with the CRISC focus on forward-looking risk indicators.

Answer

System downtime due to security incidents

Answer

Number of audit findings related to access controls

Answer

Number of successful cyber attacks in the past quarter

Question 16

Which TWO of the following are primary objectives of control monitoring?

Accepted Answer

To provide assurance to stakeholders that controls are functioning.. Control monitoring's primary objectives are to provide assurance to stakeholders that controls are functioning as intended and to verify that controls are operating effectively on an ongoing basis. This aligns with the CRISC framework's emphasis on continuous assurance over control performance, not just periodic assessment.

Answer

To calculate the financial impact of control failures.

Answer

To determine the design adequacy of controls.

Answer

To identify new risks that were not previously assessed.

Question 17

During a risk identification workshop, the team identifies a potential data leakage from a legacy system. What is the FIRST step the risk owner should take?

Accepted Answer

Document the risk and its source. The first step for the risk owner is to formally document the risk and its source. This ensures that the identified data leakage from the legacy system is captured in the risk register, establishing a baseline for analysis and treatment. Without documentation, subsequent steps like risk scoring, control implementation, or escalation cannot be properly justified or tracked.

Answer

Implement encryption immediately

Answer

Assign a risk score

Answer

Report to senior management

Question 18

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

Accepted Answer

Conduct a tabletop exercise with the updated plan. A tabletop exercise validates the updated incident response plan by simulating a realistic scenario, allowing the response team to practice their roles and identify gaps in the new procedures. This directly addresses the root cause—the plan was outdated and the team failed to execute it correctly—by ensuring the plan is current and the team is familiar with its execution. Without this validation, the updated plan remains untested and the same failure mode could recur.

Answer

Add more detective controls

Answer

Update the risk register

Answer

Increase insurance coverage

Question 19

Which THREE of the following are valid risk identification methods according to ISACA's Risk IT Framework? (Select exactly 3.)

Accepted Answer

Scenario analysis. Scenario analysis is a valid risk identification method under ISACA's Risk IT Framework because it involves developing hypothetical scenarios to identify potential threats and vulnerabilities that could lead to risk events. This technique helps organizations anticipate and prepare for plausible adverse situations by analyzing their impact on IT assets and business objectives.

Answer

Segregation of duties

Answer

Risk acceptance

Question 20

A technology startup is developing a mobile payment application. During a risk identification workshop, the team identifies a risk that the application may not comply with Payment Card Industry Data Security Standard (PCI DSS) requirements. What is the BEST way to categorize this risk?

Accepted Answer

Compliance risk.. Non-compliance with PCI DSS is a direct violation of regulatory requirements, making it a compliance risk. For a mobile payment application handling cardholder data, PCI DSS mandates specific security controls (e.g., encryption of PAN, access controls, logging). Failure to meet these standards exposes the startup to fines, legal sanctions, and potential loss of the ability to process payments.

Answer

Strategic risk.

Answer

Operational risk.

Answer

Reputational risk.