CRISC Practice Exam 67 — 20 Questions

Question 1

A risk manager is reviewing the organization's risk treatment plan for a critical web application. The plan includes implementing a web application firewall (WAF), conducting regular penetration tests, and purchasing cyber insurance. The risk manager notes that the residual risk after these treatments is still above the risk appetite. According to CRISC, what should the risk manager do NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Escalate the residual risk to senior management for a decision on whether to accept, further treat, or avoid the risk.. When residual risk exceeds the organization's risk appetite, it must be escalated to senior management, who are responsible for making risk-based decisions. They may choose to accept the risk, allocate resources for further mitigation, or avoid the activity. The risk manager's role is to inform and recommend, not to unilaterally decide or simply monitor.

Answer

Reassess the risk to ensure the risk assessment is accurate and adjust the risk score accordingly.

Answer

Update the risk register to reflect the residual risk and continue monitoring.

Answer

Implement additional controls immediately to reduce the residual risk to an acceptable level.

Question 2

A financial services firm has a critical web application that must remain available 24/7. The risk assessment indicates that a distributed denial-of-service (DDoS) attack could cause significant downtime. The risk owner decides to implement a cloud-based DDoS mitigation service that scrubs traffic before it reaches the application. Which risk response strategy does this represent?

Accepted Answer

Risk mitigation. Implementing a DDoS mitigation service is a classic example of risk mitigation because it reduces the likelihood or impact of a threat. The risk is not avoided (the service continues), not transferred (the firm retains responsibility), and not accepted (action is taken). Mitigation controls are designed to bring residual risk within the organization's risk appetite.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transference

Question 3

A financial services firm has identified that its primary data center is located in a region prone to hurricanes. The risk manager proposes purchasing business interruption insurance to cover potential losses from a catastrophic event. Which risk response strategy does this represent?

Accepted Answer

Risk transfer. Purchasing insurance is a classic example of risk transfer, where the financial impact of a risk is shifted to an insurance provider. The risk event (hurricane) still occurs, but the firm is compensated for losses, protecting its financial stability. This strategy is appropriate when the risk is high-impact but low-frequency, and the cost of insurance is justified.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 4

A global manufacturer is performing an IT risk assessment for its industrial control systems (ICS). The risk team is evaluating threat sources and wants to identify factors that INCREASE the likelihood of a threat event occurring. Which TWO of the following factors increase the likelihood of a threat event? (Choose two.)

Accepted Answer

A well-funded, motivated threat actor targeting the manufacturer's sector.. Likelihood of a threat event rises when exposure and adversary pressure increase. Numerous unpatched, internet-facing ICS components create exploitable pathways, and a well-funded, motivated actor targeting the sector raises both attempt frequency and success probability. Response planning, segmentation, and backup capability are controls that reduce impact or exposure, not factors that increase the chance of an event.

Answer

A mature backup and recovery capability with regularly tested restores.

Answer

A documented and tested incident response plan for OT environments.

Answer

Segmentation that isolates the ICS network from the corporate network.

Question 5

A financial services firm has completed its annual IT risk assessment. The chief risk officer asks the IT risk analyst to classify each identified risk according to the organization's risk taxonomy before any response decisions are made. Which activity should the analyst perform FIRST?

Accepted Answer

Map each risk to the relevant business process and asset owner, and assign a consistent risk category and owner.. Classification and ownership assignment come first because every downstream activity, including quantification, treatment selection, transfer, and governance reporting, depends on knowing what each risk is, who owns it, and how it maps to business processes. Establishing a consistent taxonomy and accountable owner creates the structure required for aggregation and defensible risk acceptance at the enterprise level.

Answer

Recalculate the annualized loss expectancy for every risk using the latest asset valuation data.

Answer

Immediately transfer the highest-rated risks to the cyber insurance carrier to cap the firm's exposure.

Answer

Publish the complete risk register to the board risk committee for formal acceptance of all identified risks.

Question 6

A risk analyst has completed a control self-assessment and found that a key preventive control failed testing in two consecutive quarters. The risk owner asks the analyst to update the risk register. Which action BEST reflects an appropriate risk response?

Accepted Answer

Record the control failure, reassess the inherent and residual risk ratings, and initiate a remediation plan with a target date.. A repeat control failure invalidates prior residual risk assumptions, so the correct response is to record the failure, re-rate inherent and residual risk, and launch a dated remediation plan. Closing the finding, maximizing the rating without analysis, or overwriting the record all distort the risk picture and remove the accountability that drives correction.

Answer

Close the finding because the control is preventive and failures are expected to occur occasionally in any environment.

Answer

Increase the residual risk rating to the maximum and immediately report the organization as non-compliant to regulators.

Answer

Delete the original control from the register and replace it with a new control entry showing a passing test result.

Question 7

A risk practitioner at a healthcare insurer is mapping the organization's IT risk register to the NIST Cybersecurity Framework (CSF) 2.0. Executive leadership wants assurance that the organization understands which assets and business processes depend on which systems before any risk treatment decisions are made. Which CSF 2.0 function and category BEST addresses this requirement?

Accepted Answer

IDENTIFY (ID) — Asset Management (ID.AM). The insurer needs to know which systems support which business processes before deciding on treatment, and that dependency mapping is the core purpose of the IDENTIFY function's Asset Management category. Governance sets direction, PROTECT enforces controls, and DETECT finds events, but none of those produces the asset-to-process inventory that leadership explicitly requested.

Answer

DETECT (DE) — Continuous Monitoring (DE.CM)

Answer

GOVERN (GV) — Risk Management Strategy (GV.RM)

Answer

PROTECT (PR) — Identity Management, Authentication, and Access Control (PR.AA)

Question 8

A retail company is assessing risk for a new customer loyalty application. The risk team determines that the inherent risk is high, then evaluates existing controls and finds that the residual risk is within the organization's risk appetite. The CIO asks what the residual risk rating represents. Which statement BEST describes residual risk in this context?

Accepted Answer

The risk that remains after existing controls are applied and their effectiveness is considered.. Residual risk is the exposure that remains once existing controls are applied and their effectiveness is factored in. Because the loyalty application's controls reduce the high inherent risk to a level inside the stated appetite, the residual rating is what the organization actually carries. It drives the decision to accept, mitigate further, transfer, or avoid the risk.

Answer

The risk that the implemented controls themselves will fail to operate as designed.

Answer

The total risk exposure before any controls are implemented.

Answer

The maximum plausible loss the organization could suffer from a single risk event.

Question 9

A risk practitioner is reviewing the organization's backup and recovery procedures for critical systems. The organization wants to ensure that backups are protected against ransomware attacks that could encrypt both production data and backups. Which of the following controls is MOST effective for this purpose?

Accepted Answer

Implementing immutable backups that cannot be altered or deleted for a set period.. Immutable backups are the most effective control because they cannot be altered or deleted for a set period, ensuring a clean recovery point even if ransomware compromises the network. Other controls like network access controls, encryption, or backup frequency do not prevent backups from being encrypted or deleted by ransomware.

Answer

Performing daily full backups instead of incremental backups.

Answer

Encrypting backups with a strong encryption algorithm.

Answer

Storing backups on the same network as production systems with access controls.

Question 10

A risk practitioner at a healthcare payer is reviewing the organization's disaster recovery (DR) strategy for its core claims adjudication system. The business owner has stated that the maximum tolerable downtime is 4 hours, but the current DR plan relies on restoring from nightly tape backups, which would take at least 30 hours. Which of the following is the MOST appropriate action for the risk practitioner to take FIRST?

Accepted Answer

Document the gap between the recovery time objective and the achievable recovery time, and escalate it to the business owner and IT leadership for a risk decision.. The core issue is a mismatch between the business-required recovery time objective and what the current DR strategy can deliver. The risk practitioner must first document and escalate this gap so the business owner can make an informed risk decision. Directly purchasing technology or rewriting the objective without approval would circumvent governance.

Answer

Perform a full business impact analysis to determine whether the 4-hour maximum tolerable downtime is still valid.

Answer

Update the DR plan to state that the recovery time objective is 30 hours, because that is what the current infrastructure can achieve.

Answer

Immediately purchase a real-time replication solution to meet the 4-hour requirement and inform the business owner after implementation.

Question 11

A retail company's risk practitioner is reviewing how risks flow between the enterprise risk management function and the IT risk function. The CISO argues that IT risks should be reported only within IT, while the CRO wants material IT risks elevated to the enterprise register. Which CRISC principle BEST resolves this disagreement?

Accepted Answer

IT risk is a subset of enterprise risk and material IT risks should be integrated into enterprise risk reporting.. The correct principle is that IT risk is a subset of enterprise risk and material IT risks belong in enterprise reporting. This ensures business leadership sees how technology exposures affect objectives and can allocate resources and set tolerance accordingly. IT still performs the technical analysis, but the results flow upward so governance and strategy reflect the full risk landscape rather than a fragmented view.

Answer

Both registers should be maintained independently and reconciled only during the annual external audit.

Answer

IT risks should remain under the CISO because only technical staff can interpret their likelihood.

Answer

The CRO should take over all IT risk analysis to ensure consistent methodology across the enterprise.

Question 12

A hospital network is selecting key risk indicators (KRIs) for its electronic health record (EHR) availability risk. The risk committee wants indicators that will provide early warning before an outage affects patient care. Which TWO of the following are the most appropriate KRIs for this purpose? (Choose two.)

Accepted Answer

Percentage of critical EHR servers whose monitoring alerts were unacknowledged beyond the response threshold. Replication lag exceeding threshold and unacknowledged critical alerts are leading indicators that measure current degradation of resilience and response capability, giving the risk committee time to intervene before patients are affected. Downtime minutes, long-term MTBF, and raw change volume describe past events or activity levels without predictive value for imminent EHR availability risk, so they do not serve as early-warning KRIs.

Answer

Total number of change requests submitted for the EHR environment during the past quarter

Answer

Mean time between failures (MTBF) of the EHR application servers over the trailing twelve months

Answer

Number of EHR downtime minutes recorded during the previous quarter

Question 13

A newly hired risk analyst is asked to classify the organization's risk universe before any assessment begins. The analyst lists categories such as strategic, operational, financial, compliance, and reputational. Which of the following BEST explains why this categorization is useful for IT risk identification?

Accepted Answer

It provides a structured lens that helps ensure risks across business functions are surfaced and compared, and it supports consistent ownership and reporting.. Defining a risk universe by category gives the practitioner a structured way to surface risks from every function, apply consistent terminology, and roll results up for governance. It prevents blind spots and supports ownership and reporting. The alternatives either mistake categories for the register itself, assume unrealistic exclusivity, or skip the underlying assessments that make aggregation meaningful.

Answer

It replaces the need for a risk register because each category can be tracked in a separate spreadsheet.

Answer

It lets the analyst assign a single numeric risk score to the entire organization without assessing individual risks.

Answer

It guarantees that every risk will be assigned to exactly one category, eliminating duplicate register entries.

Question 14

A software development company is adopting a DevSecOps approach. The risk manager wants to ensure that security risks are identified early in the development lifecycle. Which of the following practices is MOST effective for integrating risk identification into the CI/CD pipeline?

Accepted Answer

Conduct static application security testing (SAST) as part of the build process.. SAST integrated into the build process is the most effective for early risk identification because it analyzes code before it is deployed, providing immediate feedback to developers. This shift-left approach reduces the cost and effort of fixing vulnerabilities later. Other practices like DAST, manual reviews, or RASP occur later or are less scalable for continuous integration.

Answer

Perform dynamic application security testing (DAST) after deployment to production.

Answer

Implement runtime application self-protection (RASP) in production to block attacks.

Answer

Require manual code reviews by the security team before each release.

Question 15

A risk manager is evaluating the security of a new containerized application deployment in a hybrid cloud environment. The organization uses Kubernetes for orchestration and must ensure that container images are free from known vulnerabilities before deployment. Which of the following controls is MOST effective for this purpose?

Accepted Answer

Integrating a container image scanning tool into the CI/CD pipeline.. The most effective control for ensuring container images are free from known vulnerabilities before deployment is to integrate image scanning into the CI/CD pipeline. This allows automated detection and blocking of vulnerable images at build time. Runtime monitoring, network policies, and service meshes address other security aspects but do not meet the pre-deployment vulnerability assurance requirement.

Answer

Enforcing network policies to restrict container-to-container communication.

Answer

Using a service mesh to encrypt all traffic between microservices.

Answer

Implementing runtime security monitoring using a tool like Falco.

Question 16

A hospital's radiology department wants to let contracted teleradiologists read CT scans from home. The scans contain protected health information (PHI) and must remain within the hospital's HIPAA compliance boundary. The CIO asks the risk practitioner to recommend an access approach that minimizes the risk of PHI residing on unmanaged personal devices. Which of the following is the BEST recommendation?

Accepted Answer

Provide teleradiologists with virtual desktop infrastructure (VDI) sessions hosted in the hospital's data center, with local drive and clipboard redirection disabled.. Centralizing PHI in hospital-controlled infrastructure while presenting only a remote display is the most effective way to keep protected health information off unmanaged endpoints. Virtual desktop infrastructure with drive and clipboard redirection disabled preserves clinical workflow yet blocks the common exfiltration paths of copy, print, and local save. Endpoint-centric alternatives leave PHI resident outside the compliance boundary and are far harder to govern.

Answer

Issue each teleradiologist a hospital-owned laptop with full-disk encryption and require them to sign an acceptable use policy.

Answer

Publish the CT images to a password-protected cloud file-sharing folder and email time-limited download links to each teleradiologist.

Answer

Grant teleradiologists VPN access to the PACS and let them install the vendor's diagnostic viewer on their personal computers.

Question 17

A multinational corporation is developing a risk treatment plan for a newly identified risk: a critical vendor's financial instability could disrupt the supply chain. The risk manager is considering several options. Which TWO of the following are examples of risk mitigation controls that directly reduce the likelihood or impact of this risk? (Choose two.)

Accepted Answer

Requiring the vendor to provide audited financial statements quarterly. Qualifying a second supplier and requiring audited financial statements are both mitigation controls. The second supplier reduces impact by providing redundancy, while financial monitoring reduces likelihood by enabling early intervention. Insurance and contract clauses transfer risk, and acceptance does nothing to reduce it, so they are not mitigation.

Answer

Accepting the risk and documenting it in the risk register

Answer

Purchasing supply chain insurance to cover losses from vendor failure

Answer

Transferring the risk to the vendor via a contract clause

Question 18

A risk analyst is building a control assessment for a payment processing environment. She needs to determine whether a new control objective is adequately addressed. She has identified the control objective, the associated risk, and the control activity. Which of the following should she do NEXT to complete the control assessment?

Accepted Answer

Test the operating effectiveness of the control activity and document the results.. After defining the control objective, risk, and control activity, the assessor must test the control's operating effectiveness to determine whether the objective is actually met. Design alone does not prove effectiveness. Testing produces evidence that supports a conclusion, which is the purpose of a control assessment in IT risk management.

Answer

Identify additional risks that could affect the same control objective and add them to the assessment scope.

Answer

Perform a business impact analysis to quantify the potential loss from the risk.

Answer

Revisit the risk register to confirm the risk rating and update the risk appetite statement.

Question 19

A retail company is implementing a new point-of-sale (POS) system that will process credit card transactions. The risk manager is reviewing the network architecture and notes that the POS devices will be on the same flat network as employee workstations and guest Wi-Fi. Which of the following is the MOST effective risk mitigation to protect cardholder data?

Accepted Answer

Segment the POS network from other networks and apply strict firewall rules.. Network segmentation with strict firewall rules is the most effective mitigation because it isolates the POS environment from other networks, preventing attackers from pivoting from compromised workstations or guest Wi-Fi. This aligns with PCI DSS requirements and reduces the scope of compliance. Other controls like encryption, IDS, or MFA are valuable but do not address the fundamental risk of a flat network.

Answer

Require multi-factor authentication (MFA) for all POS transactions.

Answer

Implement full-disk encryption on all POS devices to protect data at rest.

Answer

Deploy an intrusion detection system (IDS) to monitor for malicious traffic.

Question 20

A financial services firm is adopting a DevSecOps model. The risk practitioner wants to ensure that security risks are identified and addressed as early as possible in the software development lifecycle. Which of the following practices BEST supports this objective?

Accepted Answer

Integrating static application security testing (SAST) into the continuous integration pipeline.. Integrating SAST into the CI pipeline allows security checks to run automatically with every code commit, giving developers immediate feedback on vulnerabilities. This shifts security left, enabling fixes during development when they are cheapest and fastest to resolve. Other practices like penetration testing, training, and DAST are valuable but do not provide the same early, continuous, code-level risk detection.

Answer

Conducting a penetration test immediately before production deployment.

Answer

Requiring developers to complete annual secure coding training.

Answer

Performing dynamic application security testing (DAST) on a staging environment.