CRISC Practice Exam 64 — 20 Questions

Question 1

A healthcare organization is assessing risks to its electronic health record (EHR) system. The risk team is evaluating the likelihood of a threat event. Which TWO factors are MOST relevant when estimating the likelihood of a threat exploiting a vulnerability? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The skill level and motivation of the threat actor. Likelihood estimation in risk assessment focuses on factors that influence the probability of a threat exploiting a vulnerability. The skill and motivation of the threat actor and the ease of discovery and exploitability of the vulnerability are direct determinants of that probability. Regulatory fines, user count, and control costs are related to impact or treatment, not likelihood.

Answer

The number of users with access to the EHR system

Answer

The regulatory fines associated with a data breach

Answer

The cost of implementing additional security controls

Question 2

A global retailer is migrating its point-of-sale (POS) transaction processing to a public cloud provider. The risk practitioner must ensure that the organization's payment card data remains compliant with PCI DSS. Which of the following is the MOST appropriate control to implement FIRST?

Accepted Answer

Conduct a data discovery and classification exercise to identify all cardholder data locations.. The first step in any cloud migration involving cardholder data is to discover and classify that data to define the PCI DSS scope. Without knowing where the data resides, the organization cannot accurately apply encryption, firewalls, or contractual controls. Data discovery ensures that all subsequent risk treatments are targeted and complete, forming the foundation for compliance.

Answer

Implement a web application firewall (WAF) in front of the cloud-based POS application.

Answer

Require the cloud provider to sign a PCI DSS attestation of compliance (AOC).

Answer

Encrypt all cardholder data at rest and in transit using strong cryptography.

Question 3

A manufacturing firm's risk practitioner is facilitating a workshop to identify IT risks for a new industrial control system (ICS) rollout. Operational engineers, IT staff, and a third-party integrator are present. Which of the following approaches BEST supports comprehensive IT risk identification in this setting?

Accepted Answer

Facilitate a structured, cross-functional workshop using techniques such as brainstorming and scenario analysis, supplemented by asset and threat information.. Cross-functional, structured workshops combine the operational, technical, and business knowledge needed to identify risks comprehensively, and supplementing them with asset and threat data grounds the discussion in evidence. Relying on a vendor, a single team's scan output, or waiting for live incidents all narrow the input or defer identification until treatment is far more costly.

Answer

Postpone identification until the ICS has been in production for six months so real incidents can be observed.

Answer

Rely solely on the third-party integrator's risk assessment because they designed the ICS architecture.

Answer

Ask only the IT security team to complete a vulnerability scan and treat the scan output as the risk list.

Question 4

A financial services firm is migrating its customer relationship management (CRM) system to a SaaS provider. The risk practitioner must assess the provider's security posture. Which of the following is the MOST reliable source of assurance?

Accepted Answer

A SOC 2 Type II report covering the relevant trust services criteria.. For a SaaS provider handling customer data, the most reliable assurance comes from an independent audit of controls over time. A SOC 2 Type II report provides exactly that, covering relevant trust services criteria. Other sources are either self-reported, point-in-time, or not designed for comprehensive risk assessment.

Answer

The provider's marketing materials and security whitepaper.

Answer

The provider's completed self-assessment questionnaire.

Answer

A penetration test report the provider commissioned last year.

Question 5

A bank's risk committee is reviewing a proposal to increase the risk appetite threshold for third-party data processing failures from 2 to 5 incidents per year. The head of internal audit objects, noting that three such failures occurred in the last 12 months and one caused a regulatory finding. Which action should the risk committee take FIRST?

Accepted Answer

Evaluate whether existing third-party controls and remediation plans can bring incident frequency within the current threshold before changing the appetite.. Risk appetite defines the level of risk the organization is willing to accept and should guide performance, not be retrofitted to justify it. Before raising the threshold, the committee must determine whether improved third-party controls can reduce failures to within the existing limit. Adjusting appetite to match poor results would normalize the exposure, conflict with the regulatory finding, and weaken governance oversight.

Answer

Immediately approve the new threshold to align reporting with actual performance and close the audit finding.

Answer

Reject the proposal and take no further action because the current threshold already reflects the board's intent.

Answer

Delegate the decision to the third-party management team since they own the vendor relationships.

Question 6

A risk practitioner is reviewing the risk register of an e-commerce company and finds that several risks were identified only through past incident reports. The chief risk officer asks how to broaden risk identification to surface risks that have not yet materialized. Which of the following approaches is MOST effective for identifying emerging and previously unconsidered risks?

Accepted Answer

Conduct scenario analysis workshops with business, technology, and external stakeholders to explore plausible future events.. Scenario analysis workshops are forward-looking and draw on cross-functional and external perspectives to imagine plausible events that have no internal incident history. They are well suited to surfacing emerging risks such as regulatory shifts, technology changes, and third-party dependencies. Historical incident reviews, audit findings, and vulnerability counts are valuable but backward-looking or narrow in scope, so they cannot fulfill the goal of identifying risks that have not yet materialized.

Answer

Increase the frequency of reviewing historical incident tickets to capture patterns in past outages.

Answer

Track the number of open vulnerabilities in the vulnerability management system and escalate when thresholds are exceeded.

Answer

Rely on the annual external audit findings to identify control weaknesses that could become risks.

Question 7

A risk practitioner is evaluating the effectiveness of the organization's IT change management process. Which of the following metrics would BEST indicate that the process is effectively reducing risk?

Accepted Answer

Percentage of changes that are tested in a non-production environment before deployment.. The percentage of changes tested in a non-production environment is a leading indicator of effective change management. It shows that the organization is proactively identifying and mitigating risks before changes reach production. This directly reduces the likelihood of incidents caused by changes, making it the best metric for assessing risk reduction.

Answer

Number of changes implemented per month.

Answer

Percentage of changes that are rolled back due to failures.

Answer

Average time to implement a change.

Question 8

A small retail company has determined that the risk of a point-of-sale (POS) system malware infection is high. The company decides to implement a whitelisting solution that only allows approved applications to run on POS terminals. This is an example of which risk response?

Accepted Answer

Risk mitigation. The company is implementing a whitelisting solution to prevent malware on POS terminals. This is a preventive control that reduces the likelihood of the risk occurring. Risk mitigation is the correct response because it involves taking action to reduce the probability or impact of a risk. Risk acceptance would mean doing nothing, risk transfer would involve shifting the financial impact, and risk avoidance would mean eliminating the activity. Since the company is actively reducing the risk while continuing the activity, it is mitigation.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 9

A risk practitioner is identifying IT risk scenarios for a new e-commerce platform. The platform will process credit card payments and store customer data. Which TWO of the following are examples of external threats that should be considered in the risk identification process? (Choose two.)

Accepted Answer

Organized criminal groups targeting payment card data.. External threats are actors or events outside the organization that can cause harm. Organized criminal groups and hacktivists are both external threat actors with different motivations. They should be included in risk identification for an e-commerce platform. The other options describe internal threats or vulnerabilities, which are not external threats.

Answer

Third-party service providers with inadequate security controls.

Answer

Disgruntled employees with access to customer databases.

Answer

Software bugs in the e-commerce application code.

Question 10

A risk practitioner has completed a risk assessment and documented the findings. Management must now decide how to address each identified risk. Which of the following BEST describes the purpose of the risk response process?

Accepted Answer

To select and implement actions that bring residual risk within the organization's risk appetite. Risk response is the decision and action phase that follows assessment. Its purpose is to bring residual risk into alignment with the organization's risk appetite through mitigation, transfer, avoidance, or authorized acceptance. It is not about eliminating all risk, merely documenting ratings, or centralizing ownership in one team; it is about taking proportionate, accountable action on the exposures that matter.

Answer

To document the inherent risk rating for each asset so it can be reported to regulators

Answer

To transfer ownership of every risk to the information security team for remediation

Answer

To eliminate all identified risks regardless of the cost of the controls required

Question 11

A risk practitioner is reviewing the organization's cryptographic key management practices after an audit finding. Which TWO of the following practices are MOST important to protect the confidentiality and integrity of cryptographic keys throughout their lifecycle? (Choose two.)

Accepted Answer

Define and enforce a cryptoperiod for each key type with scheduled rotation and retirement.. Protecting keys across their lifecycle requires both a secure execution and storage environment and disciplined lifecycle governance. Hardware security modules or managed vaults keep key material confidential and enforce access, while a defined cryptoperiod with rotation and retirement limits how much data any single key protects. Email distribution of backups, shared master keys across environments, and custodian documentation do not provide these protections.

Answer

Document key custodians in the configuration management database and review the list annually.

Answer

Use the same master key across all environments to simplify key management and reduce operational cost.

Answer

Email encrypted key backups to the security team's shared mailbox for disaster recovery availability.

Question 12

A software company has identified that a critical third-party library used in its product has a known remote code execution vulnerability. The vendor has not released a patch, and the product is used by customers who cannot accept downtime. The risk practitioner recommends isolating the library's functionality in a sandboxed process with restricted permissions. Which risk response strategy does this represent?

Accepted Answer

Risk mitigation. Sandboxing the vulnerable library is a mitigation response because it adds a compensating control that reduces the impact of a potential exploit. Since no patch is available and downtime is not acceptable, mitigation through isolation is the most practical strategy. This approach lowers risk while maintaining product availability for customers.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Question 13

A risk manager is assessing the security posture of a containerized application deployment in a public cloud. The organization uses Kubernetes for orchestration. Which TWO of the following are the MOST significant risks specific to this environment? (Choose two.)

Accepted Answer

Container images may contain vulnerable dependencies that are not patched regularly.. The most significant risks are vulnerable container images and unencrypted Kubernetes secrets in etcd. Vulnerable images can introduce exploitable flaws, while unencrypted secrets can be read by attackers with etcd access. Both are specific to containerized Kubernetes environments and require proactive controls such as image scanning and etcd encryption. The other options describe misconceptions or false assumptions that do not represent the primary risks.

Answer

Container orchestration platforms automatically enforce network segmentation, eliminating the risk of lateral movement.

Answer

The cloud provider's shared responsibility model means the organization is not responsible for the security of the underlying nodes.

Answer

Kubernetes RBAC is enabled by default and cannot be misconfigured, so access control risks are minimal.

Question 14

A risk analyst is building a risk register for a newly deployed customer relationship management (CRM) system that stores personally identifiable information (PII). The analyst needs to document the risk that an attacker could exfiltrate the PII database. Which of the following BEST represents the threat component of this risk statement?

Accepted Answer

An external attacker with data exfiltration capability.. A well-formed risk statement links a threat source to a vulnerability and an impact. The attacker with exfiltration capability is the threat source, while the unencrypted PII fields are the vulnerability and the dollar figure is the impact. Identifying the threat source correctly lets the risk analyst select appropriate controls, such as monitoring for exfiltration behavior, and enables meaningful comparison across other risks in the register.

Answer

The CRM database contains unencrypted PII fields.

Answer

The financial impact of a PII breach is estimated at $2 million.

Answer

The likelihood of a PII breach is rated as high.

Question 15

A risk practitioner is conducting an IT risk assessment for a retail bank's new mobile payment application. The threat landscape includes hacktivists, organized crime, and insiders. The practitioner needs to estimate the likelihood of a data breach. Which of the following factors is MOST important to consider when estimating likelihood?

Accepted Answer

The effectiveness of existing controls and the threat's capability to exploit them.. Likelihood estimation in IT risk assessment depends on threat capability and motivation relative to control effectiveness. For a mobile payment app, threats like organized crime have high capability, but robust controls can reduce likelihood. The correct factor directly addresses this relationship, while others focus on impact, vulnerability count, or benchmarks that do not provide a direct likelihood estimate.

Answer

The industry benchmarks for mobile payment application security spending.

Answer

The number of vulnerabilities identified in the application's source code.

Answer

The financial impact of a potential data breach on the bank's reputation.

Question 16

A risk practitioner is reviewing the organization's vulnerability management programme. The vulnerability scan report shows thousands of findings, and remediation teams are overwhelmed. Which of the following is the MOST effective approach to prioritize remediation?

Accepted Answer

Prioritize using threat intelligence and exploitability data combined with the business criticality of the affected assets.. Vulnerability management fails when severity is confused with risk. The most effective approach combines exploitability signals, such as active exploitation and threat intelligence, with the business criticality of the asset, so remediation effort targets findings that could actually harm the organization. A pure CVSS threshold, blanket assignment, or extra scanning does not answer the prioritization question.

Answer

Remediate all findings with a Common Vulnerability Scoring System (CVSS) base score of 7.0 or higher within 30 days.

Answer

Assign every finding to the system owner and require monthly status reporting until all findings are closed.

Answer

Purchase an additional scanning tool and run scans more frequently to build a complete inventory of findings.

Question 17

A risk practitioner is assessing the risk associated with the organization's use of third-party APIs that integrate with its core banking platform. The practitioner needs to determine the MOST effective way to monitor the risk exposure of these APIs on an ongoing basis. Which of the following approaches BEST addresses this requirement?

Accepted Answer

Implement API gateway logging and monitor for anomalous behavior using predefined risk thresholds.. Continuous monitoring of third-party API risk requires real-time or near-real-time data. API gateway logging with anomaly detection and risk thresholds provides ongoing visibility into API usage and potential threats. Other options like annual assessments, monthly reports, or static scores are point-in-time or retrospective and do not meet the need for continuous monitoring of dynamic risk exposure.

Answer

Use a static risk score assigned to each third-party API at onboarding.

Answer

Conduct an annual security assessment of each third-party API provider.

Answer

Require third-party API providers to submit monthly compliance reports.

Question 18

A risk manager at a retail bank is reviewing the security architecture of an internal API that moves funds between customer accounts. The API is reachable only from the bank's private network, and developers argue that mutual TLS and OAuth 2.0 token validation are unnecessary because external attackers cannot reach it. Which risk principle should the risk manager apply to challenge this reasoning?

Accepted Answer

Defense in depth, because internal network reachability does not eliminate the need for authentication and encryption on sensitive transaction paths.. The developers are treating private network reachability as a substitute for authentication, which contradicts defense in depth. Because attackers routinely gain internal footholds and move laterally, a funds-transfer API must require mutual authentication and token validation so that network location alone never authorizes a transaction. The other choices address financial treatment or measurement rather than the architectural control gap.

Answer

Single loss expectancy, because the bank should quantify the cost of one unauthorized transaction before adding controls.

Answer

Risk acceptance, because the residual risk of an internal-only API falls within the bank's stated risk appetite for network-perimeter controls.

Answer

Risk transference, because the bank can purchase cyber insurance to cover unauthorized internal transactions.

Question 19

A risk manager at a multinational bank is assessing the risk of a new third-party SaaS provider that will process customer transaction data. The provider stores data in a country with different data protection laws. Which of the following is the MOST critical risk factor to evaluate FIRST?

Accepted Answer

The legal and regulatory requirements for cross-border data transfers and the provider's compliance with them.. Cross-border data transfers introduce legal and regulatory risks that can override operational and financial considerations. The bank must first determine whether the transfer is lawful under applicable data protection laws and whether the provider meets those requirements. Technical controls and SLAs are important but secondary to the fundamental question of legality.

Answer

The provider's financial stability and ability to remain in business for the contract duration.

Answer

The provider's service level agreements and uptime guarantees for transaction processing.

Answer

The technical security controls implemented by the provider, such as encryption and access management.

Question 20

A risk analyst at a healthcare provider is assessing the risk of a ransomware attack on a clinical data repository. The analyst estimates that a ransomware event would cost $800,000 in recovery and downtime, and that such an event is likely to occur once every four years. What is the annualized loss expectancy (ALE) for this risk?

Accepted Answer

$200,000. Annualized loss expectancy expresses expected yearly loss as single loss expectancy multiplied by annualized rate of occurrence. With an $800,000 single loss and a four-year recurrence, the ARO is 0.25, producing an ALE of $200,000. This normalized annual figure lets the healthcare provider compare the ransomware risk directly against other risks and against the cost of proposed controls.

Answer

$800,000

Answer

$3,200,000

Answer

$100,000