CRISC Practice Exam 65 — 20 Questions

Question 1

A retail company is assessing risk for a legacy point-of-sale system that cannot be patched. The risk team wants to identify controls that would reduce the likelihood of a successful exploitation of known vulnerabilities on these terminals. Which TWO of the following are preventive controls that would BEST reduce the likelihood of exploitation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Segment the point-of-sale terminals onto a dedicated network with strict firewall rules limiting outbound and inbound traffic. Preventive controls reduce the likelihood of a successful attack. Network segmentation with restrictive firewall rules and application allowlisting both stop exploitation attempts from succeeding on unpatched terminals by limiting reachability and blocking unauthorized code execution. Logging, backups, and vulnerability scanning are valuable but are detective or corrective in nature and do not lower the probability of exploitation.

Answer

Conduct quarterly vulnerability scans of the point-of-sale network

Answer

Enable detailed logging and forward terminal logs to a centralized SIEM for monitoring

Answer

Perform daily backups of terminal configuration and transaction data

Question 2

A financial services firm has completed a risk assessment of its trading platform. The chief risk officer wants to ensure the assessment results are comparable across business units and that the reasoning behind each likelihood and impact rating is transparent to auditors. Which action BEST supports this objective?

Accepted Answer

Document the rating scales and the specific criteria and evidence used to assign each likelihood and impact value. Comparability and auditability depend on defined rating scales, explicit criteria for each level, and documented evidence supporting each likelihood and impact assignment. These elements let different business units apply the same methodology and let auditors trace how each score was derived, which is more valuable than changing matrix size or centralizing decisions.

Answer

Increase the number of risks in the register to ensure no scenario is overlooked

Answer

Recalculate all risk scores using a 10×10 matrix instead of a 5×5 matrix

Answer

Assign all risk scoring decisions to a single central analyst

Question 3

A retail organization is migrating its point-of-sale (POS) processing to a cloud-hosted payment platform. The risk practitioner must select an encryption approach that protects cardholder data while it is actively being processed in memory by the payment application. Which of the following is the MOST appropriate control for this scenario?

Accepted Answer

Implement confidential computing using hardware-based trusted execution environments (TEEs) for the payment workload.. Cardholder data exists in three states, and each requires a different control: in transit, at rest, and in use. The scenario specifies active in-memory processing, which only confidential computing with hardware trusted execution environments addresses, because the enclave keeps memory encrypted and isolated from privileged software. Transport encryption and at-rest encryption leave the processing window exposed.

Answer

Encrypt the payment database tablespaces using transparent data encryption (TDE).

Answer

Enable TLS 1.3 for all connections between the POS terminals and the cloud payment platform.

Answer

Store all cardholder data in a tokenized vault and replace PANs with surrogate values in the payment application.

Question 4

A retail company is moving its customer loyalty application to a SaaS platform. The risk practitioner must ensure that the cloud provider's security controls are adequate. Which of the following is the MOST effective way to obtain assurance over the provider's controls?

Accepted Answer

Review the provider's SOC 2 Type II report.. A SOC 2 Type II report is specifically designed to provide independent assurance over a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. It covers both design and operating effectiveness over a period, making it the most reliable evidence for a risk practitioner assessing a cloud provider's control environment.

Answer

Rely on the provider's ISO 9001 certification.

Answer

Conduct a penetration test of the provider's environment.

Answer

Request the provider's completed security questionnaire.

Question 5

A national retail chain is building a risk register for its new e-commerce platform. The CISO asks the risk practitioner to identify the inherent risk associated with a recently disclosed SQL injection vulnerability in a third-party payment gateway module. Which of the following BEST describes inherent risk in this scenario?

Accepted Answer

The risk that exists before any controls or mitigation efforts are applied to the SQL injection vulnerability in the payment gateway module.. Inherent risk is the level of risk before any controls or mitigation actions are applied. In the context of the SQL injection vulnerability, it represents the raw exposure that the organization faces if nothing is done. This baseline is essential for risk practitioners to prioritize risks and later evaluate the effectiveness of controls by comparing inherent and residual risk. The other options describe residual risk, vendor-specific risk, or risk appetite exceedance, none of which define inherent risk.

Answer

The risk that the third-party payment gateway vendor will fail to patch the SQL injection vulnerability within the agreed service level agreement.

Answer

The risk that the organization's risk appetite statement will be exceeded due to the SQL injection vulnerability.

Answer

The level of risk that remains after the organization implements compensating controls such as a web application firewall and input validation.

Question 6

A multinational corporation is implementing a risk treatment plan for a critical vendor that has poor security controls. The risk practitioner has recommended contract renegotiation to include security requirements, but the vendor refuses. The business unit insists on continuing the relationship due to cost savings. The risk practitioner's next step should be to:

Accepted Answer

Escalate the issue to the risk committee for a decision on risk acceptance.. The risk practitioner must escalate to the risk committee when the business unit refuses to mitigate a risk that exceeds appetite. The committee has the authority to accept the risk on behalf of the organization. Simply documenting or implementing controls without addressing the governance gap would leave the organization exposed without proper oversight.

Answer

Document the risk in the risk register and continue monitoring without escalation.

Answer

Implement compensating controls internally to reduce the vendor risk.

Answer

Terminate the vendor relationship immediately without further discussion.

Question 7

A risk practitioner is assessing the security of a new software-defined wide area network (SD-WAN) deployment that will carry regulated traffic between branch offices and a cloud environment. The vendor's controller is managed by a third party. Which of the following risks should the practitioner identify as the MOST significant?

Accepted Answer

The SD-WAN controller could be compromised through the third-party management interface, allowing policy manipulation and traffic redirection.. In SD-WAN architectures, the controller is a high-value target because it defines and enforces forwarding, segmentation, and encryption policies across all sites. When that controller is managed by a third party, the organization inherits supply-chain and access-control risk. A compromise there can bypass many perimeter defenses and affect every branch simultaneously, so it warrants the greatest attention in a risk assessment of regulated traffic.

Answer

Branch office staff may bypass the SD-WAN by using personal mobile hotspots for internet access.

Answer

The organization may lose visibility into application performance across the SD-WAN fabric.

Answer

SD-WAN appliances may not support the organization's existing network access control (NAC) solution.

Question 8

A hospital is implementing a new electronic health record (EHR) system. The risk practitioner is concerned about the risk of unauthorized access to patient data by internal staff. Which of the following controls is MOST effective in mitigating this risk?

Accepted Answer

Role-based access control (RBAC) with least privilege.. RBAC with least privilege is a preventive control that restricts access based on job roles, ensuring staff can only access the patient data necessary for their duties. This directly mitigates the risk of unauthorized internal access. While training, encryption, and monitoring are valuable, they do not prevent an authorized user from accessing data they should not see.

Answer

Logging and monitoring of all access to patient records.

Answer

Encryption of patient data at rest.

Answer

Annual security awareness training for all staff.

Question 9

A risk practitioner is identifying risks associated with the decommissioning of a legacy data center. The organization plans to migrate all remaining applications to a cloud environment. Which TWO of the following are the MOST significant risks that should be included in the risk register for this project? (Choose two.)

Accepted Answer

Incomplete destruction of sensitive data on decommissioned storage media, leading to unauthorized disclosure.. The decommissioning of a legacy data center involves unique risks. Loss of institutional knowledge can lead to migration errors and outages, while incomplete data destruction can cause data breaches. These two risks are directly tied to the decommissioning process and should be prioritized in the risk register. Regulatory data residency, cloud cost spikes, and continuity plan updates are important but are either related to the cloud migration itself or are control activities, not the primary risks of decommissioning.

Answer

Failure to update the IT service continuity plan to reflect the new cloud architecture.

Answer

Inability to meet new regulatory requirements for data residency in the cloud environment.

Answer

Increased cloud subscription costs due to unexpected usage spikes after migration.

Question 10

A multinational corporation is deploying a new IoT-based inventory management system across its warehouses. The risk practitioner identifies that the IoT devices use default administrative credentials and unencrypted communication protocols. The vendor states that a firmware update to address these issues will not be available for six months. The business cannot delay the deployment due to competitive pressures. Which risk response strategy is MOST appropriate in this situation?

Accepted Answer

Accept the risk and proceed with deployment, documenting the decision and implementing compensating controls such as network segmentation and monitoring.. Given the business imperative to deploy and the unavailability of a timely patch, risk acceptance with compensating controls is the most appropriate response. This approach acknowledges the residual risk while reducing it through segmentation and monitoring. It also documents the decision for future review, aligning with CRISC principles of balancing risk and business objectives.

Answer

Transfer the risk by purchasing cyber insurance that covers IoT-related breaches.

Answer

Avoid the risk by canceling the IoT deployment and continuing with the existing manual inventory process.

Answer

Mitigate the risk by immediately replacing the IoT devices with a different vendor's products that have better security features.

Question 11

A retail company has identified that its point-of-sale (POS) terminals are running an outdated operating system that no longer receives security patches. The risk practitioner recommends upgrading the terminals to a supported OS. The cost of the upgrade is $500,000, while the estimated annual loss from a potential breach is $2,000,000 with a 30% likelihood. Which risk response strategy is being recommended?

Accepted Answer

Risk mitigation. Upgrading the POS terminals to a supported operating system is a mitigation strategy because it reduces the likelihood of a breach by addressing the unpatched vulnerability. The cost-benefit analysis ($500,000 upgrade vs. $600,000 expected annual loss) supports this action. Mitigation is appropriate when controls can reduce risk to an acceptable level.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 12

A healthcare organization is required by law to retain patient records for seven years. The IT department proposes storing backups on tapes that are kept in an on-site vault. The risk manager notes that the on-site vault is in a flood zone. Which risk response strategy is being applied if the organization decides to move the tapes to a secure off-site facility in a different geographic region?

Accepted Answer

Risk mitigation. The correct answer is risk mitigation. By moving backups to an off-site facility, the organization implements a control that reduces the risk of flood damage. This is a classic example of mitigation, where the goal is to lower the probability or impact of a threat, rather than avoiding the activity or transferring the risk.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk avoidance

Question 13

An IT risk analyst is preparing a report for the board risk committee. The committee wants a single view of how much loss the organization could face from IT risks over the next year if no additional controls are implemented. Which metric should the analyst use?

Accepted Answer

Annualized loss expectancy (ALE). The board requested a single monetary view of potential annual loss from IT risks with no additional controls, which is precisely what annualized loss expectancy provides. ROSI is a control-investment metric, control deficiency rate measures control performance, and RTO is a time-based recovery target. Only ALE combines likelihood and financial impact into an expected annual loss figure suitable for board-level risk reporting.

Answer

Return on security investment (ROSI)

Answer

Recovery time objective (RTO)

Answer

Control deficiency rate

Question 14

A risk practitioner is reviewing the organization's identity and access management (IAM) controls. The identity team proposes implementing just-in-time (JIT) privileged access with automated approval workflows and session recording. Which risk is MOST effectively mitigated by this approach compared to standing privileged accounts?

Accepted Answer

The risk that unused or stale privileged accounts accumulate and are exploited by attackers or insiders.. Standing privileged accounts are a persistent target because they remain valid even when unused. Just-in-time provisioning eliminates standing entitlements, granting elevated rights only for an approved, time-bound session. This shrinks the attack surface, removes dormant accounts that attackers and insiders could exploit, and adds approval and recording as compensating detective controls.

Answer

The risk of a denial-of-service attack saturating the network perimeter during peak business hours.

Answer

The risk that database administrators can read sensitive data in production without leaving an audit trail.

Answer

The risk of credential stuffing attacks against the single sign-on portal used by all employees.

Question 15

A multinational manufacturer is consolidating IT risk data from business units into a single enterprise risk report for the board. The risk manager must ensure the report supports effective risk-based decision making. Which TWO of the following characteristics are MOST important for the consolidated report to include? (Choose two.)

Accepted Answer

Consistent risk rating criteria and definitions applied across all business units.. An enterprise risk report earns its value by enabling decisions, which requires two things: comparability and relevance to tolerance. Consistent rating criteria and definitions across business units make aggregated data trustworthy, while showing residual risk against approved tolerance tells the board where intervention is needed. Together they convert disparate unit-level data into a coherent enterprise view that supports prioritization, resource allocation, and formal risk acceptance decisions.

Answer

A complete inventory of every IT asset and its configured technical settings.

Answer

A forecast of IT budget spend for the next three fiscal years.

Answer

Detailed descriptions of every control deficiency identified during the reporting period.

Question 16

A risk practitioner at a regional hospital is building a risk register for its new electronic health record (EHR) system. The system stores protected health information (PHI) and is subject to HIPAA. The practitioner wants to ensure that the risk register captures the potential for unauthorized disclosure of PHI. Which of the following should the practitioner PRIMARILY use to identify the relevant threats and vulnerabilities for this system?

Accepted Answer

A vulnerability assessment combined with a threat modeling exercise. Threat modeling and vulnerability assessment are complementary techniques that together provide a comprehensive identification of threats and vulnerabilities. Threat modeling explores how threat agents could exploit weaknesses, while vulnerability assessment discovers actual technical flaws. This combination ensures the risk register is grounded in both design-level and operational weaknesses, which is essential for a system holding PHI. Other methods either focus on control effectiveness or impact, not identification.

Answer

A review of the vendor's SOC 2 Type II report

Answer

A control self-assessment (CSA) workshop with clinical staff

Answer

A business impact analysis (BIA) focused on recovery time objectives

Question 17

A retail company is conducting a risk assessment for its point-of-sale (POS) system. The risk team has identified several factors that could affect the likelihood of a data breach. Which TWO factors are considered threat event frequency components that increase the likelihood of a breach? (Choose two.)

Accepted Answer

The number of attempted intrusions per month. Threat event frequency is the rate at which threat actors attempt to exploit a vulnerability. The number of attempted intrusions per month directly measures this rate. The presence of organized crime groups targeting retail payment systems indicates a higher frequency of attacks because these groups are actively seeking to compromise POS systems. The other factors relate to vulnerability, detection, or impact, not the frequency of threat events.

Answer

The strength of the encryption used for payment card data

Answer

The percentage of POS terminals running outdated software

Answer

The average time to detect a breach

Question 18

A multinational corporation has a risk register entry for a potential data breach of customer information. The risk owner has decided to purchase cyber insurance to cover financial losses from a breach. Which of the following BEST describes the residual risk after this risk response?

Accepted Answer

The residual risk remains, but the financial impact is partially transferred to the insurer.. Cyber insurance transfers a portion of the financial risk to the insurer, but the organization retains residual risk, including non-financial impacts and any uncovered losses. The residual risk is not eliminated or reduced to zero; it remains but with a lower financial exposure. This is a key concept in risk response: transference does not remove all risk.

Answer

The residual risk is reduced to zero because the risk has been transferred.

Answer

The residual risk is increased because the insurance policy may not cover all breach scenarios.

Answer

The residual risk is eliminated because the insurance covers all financial losses.

Question 19

A financial services firm has a risk register entry for a core banking application with an inherent risk score of 9 (high). The risk owner implements a new database activity monitoring tool and role-based access reviews. After implementation, the residual risk score is reassessed at 6 (medium). The risk owner now wants to formally document that the risk has been reduced to an acceptable level. Which action should the risk practitioner recommend NEXT?

Accepted Answer

Update the risk register to reflect the new residual risk score and obtain risk owner sign-off.. After implementing risk mitigation controls, the risk practitioner must ensure the risk register is updated with the new residual risk score and that the risk owner formally accepts the remaining risk. This confirms that the risk treatment has been effective and that the residual risk is within the defined risk appetite. Documentation and sign-off are essential for auditability and governance.

Answer

Escalate the residual risk to the board of directors for approval.

Answer

Initiate a new risk assessment to identify any remaining vulnerabilities.

Answer

Perform a penetration test to validate the effectiveness of the new controls.

Question 20

A newly appointed risk owner is reviewing a risk register entry for an aging payroll application. The entry shows a likelihood rating, an impact rating, an inherent risk score, and a residual risk score, but no owner signature or review date. Which action should the risk practitioner take FIRST to strengthen the register's usefulness for IT risk assessment?

Accepted Answer

Confirm the accountable risk owner and establish a review date so the entry has clear ownership and currency.. A register entry is only actionable when someone is accountable and the data is kept current. Confirming the risk owner and setting a review date converts a static record into a managed risk with monitoring and escalation paths. Scoring adjustments, escalations, or field deletions do not remedy the underlying governance gap that the scenario describes.

Answer

Escalate the entry to the audit committee as an unowned high risk requiring immediate remediation funding.

Answer

Recompute the inherent and residual scores using a different likelihood and impact scale.

Answer

Remove the inherent risk score and retain only the residual risk score to simplify reporting.