CRISC Practice Exam 66 — 20 Questions

Question 1

A risk practitioner is defining key risk indicators (KRIs) for the organization's third-party risk program after several supplier outages disrupted operations. Which TWO characteristics are essential for these KRIs to be effective for the risk committee? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Each indicator is measurable from data that can be collected reliably and repeatedly.. Effective KRIs are measurable from reliable, repeatable data and are linked to thresholds that trigger defined action. Those two properties turn a metric into a decision-support tool for the risk committee. Activity counts, subjective ratings, and annual-only reviews lack the objectivity, relevance, and timeliness needed to warn about third-party disruption before it affects operations.

Answer

Each indicator reflects the total number of suppliers onboarded during the reporting period.

Answer

Each indicator is reviewed only during the annual enterprise risk assessment cycle.

Answer

Each indicator is expressed as a qualitative rating assigned by the relationship manager.

Question 2

During a quarterly risk review, a risk owner reports that a critical trading application has exceeded its residual risk tolerance for the second consecutive quarter despite remediation efforts. The risk owner proposes to continue remediation and report again next quarter. Which of the following should the risk manager do?

Accepted Answer

Escalate the tolerance breach to the risk committee and recommend a formal risk response decision, such as acceptance, additional mitigation, or avoidance.. A residual risk that stays above tolerance across multiple reporting periods is a governance event, not a routine remediation update. The risk manager's role is to make the breach visible, present the evidence and available response options, and let the risk committee decide whether to accept, mitigate further, transfer, or avoid. Documenting that decision maintains accountability and keeps the organization's risk profile aligned with its stated tolerance.

Answer

Accept the risk owner's proposal because remediation is already underway and progress is being made.

Answer

Re-rate the application's residual risk to within tolerance to reflect the remediation work already completed.

Answer

Direct the risk owner to implement additional controls immediately without involving the risk committee.

Question 3

A software company allows developers to push code directly to production using a CI/CD pipeline. A recent post-incident review found that a developer's compromised credentials were used to deploy malicious code that exfiltrated customer data. Which control would MOST effectively reduce the risk of this specific attack path recurring?

Accepted Answer

Require multi-factor authentication for all developer accounts and enforce short-lived deployment tokens scoped to individual pipelines.. The incident path was a stolen credential granting deployment rights. Strengthening authentication with multi-factor authentication and constraining deployment tokens to short-lived, pipeline-scoped values removes both the sufficiency of a password and the blast radius of a captured token. Scanning, logging and training are valuable controls but do not close the authentication and authorization gap that enabled this specific attack.

Answer

Increase logging and alerting on production deployments and review alerts weekly.

Answer

Require developers to complete annual secure coding training and sign an acceptable use policy.

Answer

Implement static application security testing in the pipeline to scan code before deployment.

Question 4

A risk practitioner is conducting a risk assessment for a new mobile application that will process credit card payments. The practitioner needs to identify relevant threats. Which of the following is the MOST appropriate source for identifying threats specific to this application?

Accepted Answer

A threat intelligence feed that includes mobile and payment card threats. Threat intelligence feeds are designed to provide up-to-date information on threats relevant to specific technologies and industries. For a mobile payment app, a feed covering mobile and payment card threats will identify threat actors, attack vectors, and emerging TTPs. This enables the risk practitioner to build a realistic threat landscape. Other sources like audit findings or continuity plans are secondary and do not offer the same breadth or currency.

Answer

The business continuity plan for the payment processing system

Answer

The IT department's list of approved software vendors

Answer

The organization's previous audit findings for other applications

Question 5

A risk analyst is reviewing the organization's identity and access management (IAM) processes after a recent audit finding. The finding states that terminated employees retained active directory accounts for up to 30 days. Which control should the analyst recommend to BEST address this risk?

Accepted Answer

Implement automated deprovisioning integrated with the HR system to disable accounts immediately upon termination.. The audit finding highlights a delay between termination and account disablement, creating a window for unauthorized access. An automated deprovisioning process integrated with the HR system is the most effective preventive control because it removes human latency and ensures accounts are disabled immediately upon termination. Manual tickets and periodic reviews are detective or delayed, and password expiration does not deactivate accounts.

Answer

Require managers to submit a ticket to the IT help desk within 24 hours of an employee's termination.

Answer

Enforce mandatory password changes every 30 days for all employees, including terminated ones.

Answer

Conduct quarterly access reviews to identify and disable accounts of terminated employees.

Question 6

A multinational bank has a risk appetite that allows for a maximum of 5% downtime for its online banking platform per quarter. The platform currently experiences 8% downtime due to frequent distributed denial-of-service (DDoS) attacks. The risk owner proposes investing in a cloud-based DDoS mitigation service. Which of the following should be the risk practitioner's PRIMARY consideration when evaluating this proposed risk response?

Accepted Answer

The expected reduction in downtime and whether it brings residual risk within the bank's risk appetite.. The risk practitioner's primary role is to evaluate whether a proposed risk response will bring residual risk within the organization's risk appetite. Here, the bank's risk appetite for downtime is 5%, but current downtime is 8%. The proposed DDoS mitigation service must be assessed for its ability to reduce downtime to 5% or less. This assessment should consider the service's effectiveness, reliability, and any residual risk. Cost, integration, and vendor reputation are secondary factors that inform the decision but do not replace the core risk-reduction evaluation.

Answer

The total cost of the service compared to the potential financial losses from downtime.

Answer

The service provider's reputation and market share in the DDoS mitigation industry.

Answer

The service provider's ability to integrate with the bank's existing incident response plan.

Question 7

A hospital's radiology department wants to replace its on-premises PACS archive (DICOM images) with a vendor-hosted SaaS platform. The vendor stores images in its own multitenant cloud and provides a web viewer. Before signing, the risk practitioner must confirm which control MOST directly addresses the risk that a vendor-side compromise could expose patient images to other tenants.

Accepted Answer

Verify the vendor enforces strict tenant isolation and encryption key separation in the multitenant storage layer.. Because the images would reside in a shared multitenant platform, the risk that matters most is logical separation failure between customers. Confirming enforced tenant isolation with segregated encryption keys directly addresses that failure mode. Audit reports, right-to-audit clauses and internal penetration tests provide valuable assurance and leverage but do not specifically prevent one tenant from accessing another tenant's DICOM data.

Answer

Require the vendor to publish a SOC 2 Type II report covering the last twelve months.

Answer

Require annual penetration testing of the hospital's own internal network by an external firm.

Answer

Confirm the contract includes a right-to-audit clause allowing the hospital to inspect the vendor's data center.

Question 8

An organization's data classification policy labels customer payment records as confidential. A risk practitioner is reviewing how the data is protected at rest in a public cloud object storage bucket. Which control BEST ensures that a misconfigured bucket does not expose the data to unauthorized parties?

Accepted Answer

Enforce bucket policies and access control lists that deny public access and apply least privilege to identities.. Cloud object storage exposure almost always stems from permissive bucket policies or ACLs. Denying public access and applying least-privilege identity policies prevents unauthorized reads at the point of access, directly protecting confidentiality. Encryption, versioning, and logging are useful complementary controls but do not by themselves stop a misconfiguration from granting access.

Answer

Enable server-side encryption with a customer-managed key for the object storage bucket.

Answer

Configure versioning and object lock on the bucket to preserve data integrity and prevent deletion.

Answer

Enable access logging and monitor the bucket for unusual download activity.

Question 9

A retail bank's risk practitioner is building a risk scenario for its online banking platform. He needs to estimate how frequently an attacker could realistically succeed in exploiting the platform's unpatched web tier. Which of the following provides the MOST quantitative basis for this estimate?

Accepted Answer

Historical loss-event data from the bank's own incident and fraud systems for comparable attack types. Frequency estimation in a risk scenario should be grounded in data that reflects how often the event actually occurs in the organization's own environment. Internal loss-event and incident data capture real attack attempts that succeeded despite existing controls. CVSS scores, industry vulnerability publication rates, and remediation timeliness describe severity or process performance rather than the expected rate of successful exploitation.

Answer

The Common Vulnerability Scoring System (CVSS) base score of each unpatched vulnerability on the web tier

Answer

The mean time to remediate critical vulnerabilities reported by the bank's vulnerability management team

Answer

The annualized rate of new vulnerabilities published in the National Vulnerability Database (NVD) for web servers

Question 10

A financial services firm is completing its annual IT risk assessment. The CISO wants to compare the relative severity of 40 identified risks across different business units and prioritize which ones to treat first. The risk team has limited quantitative data and needs a consistent, repeatable method that reflects both likelihood and impact. Which approach BEST meets this need?

Accepted Answer

Score each risk on defined likelihood and impact scales and plot them on a risk matrix.. When quantitative data is scarce but consistent comparison across many risks is required, a risk matrix with defined likelihood and impact scales is the appropriate tool. It normalizes judgments, reflects both dimensions of risk, and yields repeatable severity ratings that support prioritization across business units. This aligns with standard IT risk assessment practice for relative risk ranking.

Answer

Calculate the annualized loss expectancy for each risk using historical loss data.

Answer

Rank the risks by the total number of identified vulnerabilities associated with each.

Answer

Assign each risk to the business unit that owns the affected asset and treat them independently.

Question 11

During a risk analysis, the risk team finds that a legacy inventory system has a single point of failure: one administrator holds the only credentials for the backup restoration process. The system supports regulatory filings with a hard deadline. Management proposes documenting the situation in the risk register and revisiting it next year. Which action should the risk practitioner take?

Accepted Answer

Escalate the concentration risk and recommend immediate interim controls such as credential escrow or a second trained administrator.. A single point of failure tied to a hard regulatory deadline and held by one person warrants prompt treatment, especially when low-cost interim measures exist. Escalating with a recommendation to escrow credentials or train a second administrator addresses availability and fraud exposure immediately while a permanent solution is designed. Deferring, blocking access, or relying solely on insurance leaves the operational and compliance risk intact.

Answer

Transfer the risk by purchasing additional cyber insurance for the inventory system.

Answer

Agree, because the risk is documented and the system still functions today.

Answer

Remove the administrator's access until a permanent solution is approved.

Question 12

A risk practitioner is assessing a new e-commerce platform. The business owner insists that the platform must be available 24/7. The practitioner identifies that a distributed denial-of-service (DDoS) attack could cause an outage. Which of the following BEST describes the risk scenario?

Accepted Answer

A threat event (DDoS attack) exploiting a vulnerability (inadequate DDoS protection) leading to an impact (loss of availability). A well-formed risk scenario describes a threat event exploiting a vulnerability to produce an impact on business objectives. The DDoS attack is the threat, inadequate DDoS protection is the vulnerability, and loss of availability is the impact. This structure supports consistent risk assessment and treatment planning, and it directly connects to the business owner's availability requirement.

Answer

A risk that is inherent to the e-commerce platform and cannot be mitigated, so it must be accepted

Answer

A control failure (lack of DDoS protection) that directly causes a financial loss without any threat event

Answer

A vulnerability (DDoS attack) causing a threat event (inadequate DDoS protection) resulting in a loss of confidentiality

Question 13

A multinational bank is assessing risk for a new mobile banking feature that stores limited customer data on devices. The risk team must decide whether to use a qualitative or quantitative approach. Which of the following is the MOST important factor in making this decision?

Accepted Answer

The availability of reliable historical loss data and the need to express risk in financial terms.. Selecting a qualitative or quantitative risk assessment method depends primarily on whether reliable data exists to support quantification and whether decisions require financial expression. When loss data is credible and cost-benefit analysis is needed, quantitative methods add value. When data is sparse or decisions are strategic, qualitative methods are more practical and defensible.

Answer

The number of risks identified in the risk register and the size of the assessment team.

Answer

The preference of the business unit sponsor and the timeline for the product launch.

Answer

The regulatory requirement to perform an annual risk assessment and the audit committee's reporting schedule.

Question 14

A risk practitioner at a software company is reviewing external sources to identify emerging IT risks that could affect the organization's cloud-hosted products. The practitioner wants to use sources that provide structured, timely information about newly disclosed software weaknesses. Which TWO of the following sources BEST meet this need? (Choose two.)

Accepted Answer

National Vulnerability Database (NVD) records. Emerging IT risk identification benefits from external, structured, and current sources that describe newly disclosed weaknesses. CVE listings supply standardized identifiers for disclosed vulnerabilities, and NVD records add severity scoring and product mappings that let the practitioner prioritize. Together they provide the timeliness and structure needed. Internal surveys, past audit findings, and facilities logs are either retrospective, unrelated to software weaknesses, or both, so they cannot fulfill the same purpose.

Answer

Prior-year internal audit findings

Answer

Internal employee satisfaction survey results

Answer

Facilities maintenance work order logs

Question 15

A retail company has a risk register that includes a risk of inventory shrinkage due to employee theft. The risk manager decides to implement a new surveillance system and conduct background checks on all new hires. Which risk response strategy is being applied?

Accepted Answer

Risk mitigation. Implementing surveillance and background checks are preventive controls that reduce the likelihood of employee theft. This is a classic risk mitigation strategy, as the company is taking direct action to lower the risk rather than accepting, avoiding, or transferring it. Mitigation is appropriate when the risk is significant and controls can cost-effectively reduce it.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 16

A financial services company's risk register shows that a critical vulnerability in its online banking application has a high likelihood of exploitation and a high impact. The risk owner decides to implement a web application firewall (WAF) and conduct monthly penetration tests. Which risk response strategy is being applied?

Accepted Answer

Risk mitigation. The organization is reducing the likelihood and impact of the vulnerability by adding a WAF and performing regular penetration tests. These actions are classic risk mitigation controls that lower residual risk. Avoidance would mean discontinuing the online banking service, transfer would involve insurance, and acceptance would mean no action.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 17

A risk practitioner at a regional bank is building a threat landscape for its new mobile payment platform. A recently published report from a national CERT indicates that a loosely organized group has been targeting payment APIs across the region, exploiting known authentication weaknesses. The practitioner wants to determine whether this group should be treated as a relevant threat source in the risk register. Which of the following is the MOST appropriate FIRST step?

Accepted Answer

Assess the group's capability, intent, and opportunity against the bank's specific mobile payment assets.. Threat sources become relevant only when evaluated against the organization's own assets through capability, intent, and opportunity. A CERT report signals activity in the sector, but the bank must determine whether the group can realistically reach and exploit its mobile payment APIs. That asset-centric analysis is the first step before the threat is entered into the risk register or any control is selected.

Answer

Immediately add the group to the risk register as a high-rated threat because it appears in a national CERT report.

Answer

Implement additional authentication controls on the mobile payment APIs to mitigate the reported weaknesses.

Answer

Subscribe to additional commercial threat intelligence feeds to obtain more detail on the group's activities.

Question 18

A risk practitioner is reviewing the organization's risk response plan for a database containing personally identifiable information (PII). The plan states that the database will be encrypted at rest, access will be restricted to authorized personnel, and regular backups will be performed. Which risk response strategy is being applied?

Accepted Answer

Risk mitigation. Implementing encryption, access controls, and backups are all mitigation actions that reduce the likelihood or impact of a breach. The organization is actively managing the risk rather than avoiding, transferring, or accepting it. Therefore, the risk response strategy is mitigation.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Question 19

A multinational manufacturer has completed a quantitative risk analysis for a ransomware scenario affecting its primary ERP system. The analysis shows an annualized loss expectancy (ALE) of $2.4 million. A proposed endpoint detection and response (EDR) solution would cost $600,000 annually and is projected to reduce the ALE by 60%. The CFO asks the risk practitioner to justify the investment. Which of the following is the BEST response?

Accepted Answer

The EDR solution delivers a net risk reduction benefit of $840,000 annually, so it should be approved.. The control reduces the $2.4 million ALE by 60%, avoiding $1.44 million in expected annual loss, and costs $600,000 per year. The net benefit of $840,000 is positive, so the investment is economically justified. The other responses either invoke unsupported benchmarks, assume an unstated appetite threshold, or rely on the percentage reduction without considering cost.

Answer

The EDR solution should be approved because any control that reduces risk by more than half automatically satisfies the cost-benefit test.

Answer

The EDR solution costs 25% of the ALE, which is within the accepted industry benchmark for control spending.

Answer

The EDR solution should be rejected because the residual ALE of $960,000 remains above the organization's risk appetite.

Question 20

An e-commerce company discovers that a third-party payment processor suffered a breach exposing customer card data. The processor contract includes a clause requiring the vendor to indemnify the company for breach-related costs. The risk owner updates the register to show that financial loss from this vendor risk is now borne by the processor. Which risk response strategy has been applied?

Accepted Answer

Risk transfer. An indemnification clause that makes the payment processor bear breach-related costs shifts the financial consequence of the risk to a third party, which is risk transfer. The breach risk itself and reputational exposure remain with the company, but the monetary loss is contractually reassigned. Mitigation, avoidance, and acceptance do not describe a contractual shifting of financial responsibility, so transfer is the correct classification.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation