CRISC Practice Exam 68 — 20 Questions

Question 1

A risk practitioner is reviewing the risk register for a cloud-based customer relationship management (CRM) system. The register contains several entries, and the practitioner must identify which entries represent inherent risk rather than residual risk. Which two of the following entries are examples of inherent risk? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CRM system stores customer personally identifiable information, and a breach could result in regulatory fines.. Inherent risk is the level of risk before any controls are applied. The entry about the hurricane-prone data center with no redundancy and the entry about storing personally identifiable information with potential regulatory fines both describe raw exposures without reference to mitigating controls. The other entries mention implemented controls, control effectiveness reports, or recovery plans, which relate to residual risk after treatment.

Answer

The vendor's SOC 2 report shows no exceptions, and the risk is considered acceptable.

Answer

The organization has a disaster recovery plan that is tested annually and meets recovery objectives.

Answer

After implementing multi-factor authentication and encryption, the likelihood of unauthorized access is rated low.

Question 2

A hospital network is deploying a new medical imaging archive. The risk practitioner learns that the vendor's support engineers require remote access to the archive for maintenance. Which of the following is the BEST control to manage the third-party access risk?

Accepted Answer

Implement privileged access management with session recording, just-in-time elevation, and full session brokering through a jump host.. Third-party remote access creates standing privileged exposure that must be constrained technically, not just contractually. Privileged access management with just-in-time elevation, credential vaulting, session brokering, and recording limits vendor reach to approved windows and produces attributable evidence. Policy signatures, standing admin accounts, and insurance certificates leave the actual access path uncontrolled.

Answer

Grant vendor engineers a dedicated local administrator account with a strong password rotated every 90 days.

Answer

Require the vendor to carry cyber insurance and provide a certificate of insurance annually.

Answer

Require vendor engineers to sign an annual acceptable use policy before access is granted.

Question 3

A risk analyst is assessing the risk of a legacy application that stores customer data in plaintext. The application is scheduled for decommissioning in 18 months, but until then it must remain operational. Which of the following is the BEST risk response?

Accepted Answer

Implement database encryption at rest and in transit for the legacy application as a compensating control until decommissioning.. Implementing encryption at rest and in transit is the best risk response because it directly mitigates the risk of plaintext data exposure. It acts as a compensating control that can be applied without major changes to the legacy application, protecting sensitive data until decommissioning. This approach balances risk reduction with operational continuity, unlike acceptance, transfer, or avoidance which either leave the risk or disrupt business.

Answer

Accept the risk because the application will be decommissioned soon and the cost of encryption is not justified.

Answer

Transfer the risk by purchasing cyber insurance to cover potential data breach costs.

Answer

Avoid the risk by immediately shutting down the legacy application, even if it disrupts business operations.

Question 4

An organization is implementing a new identity and access management (IAM) system. The risk practitioner is asked to identify the control that would BEST reduce the risk of unauthorized access due to compromised user credentials.

Accepted Answer

Implementing multi-factor authentication (MFA) for all user accounts.. Multi-factor authentication (MFA) is the most effective control to reduce the risk of unauthorized access from compromised credentials because it requires an additional factor that an attacker is unlikely to possess. Password policies, training, and account lockout are useful but do not prevent access when valid credentials are stolen and used. MFA directly addresses the risk by adding a barrier that cannot be overcome with the password alone.

Answer

Enforcing a strong password policy with complexity and expiration requirements.

Answer

Implementing account lockout after three failed login attempts.

Answer

Conducting regular security awareness training for all employees.

Question 5

A risk practitioner is interviewing business unit leaders to identify IT risks for an annual risk assessment. One leader states that the customer relationship management system is critical because sales staff cannot work without it. Which of the following BEST describes the risk practitioner's next action to validate this input?

Accepted Answer

Cross-reference the CRM system's criticality with business impact analysis and dependency data.. Stakeholder interviews are a key risk identification technique, but their outputs should be corroborated with objective evidence. Comparing the CRM criticality claim against the business impact analysis, recovery objectives, and dependency maps confirms whether the system genuinely supports critical processes. This validation reduces bias, improves the accuracy of the risk register, and supports defensible prioritization of risk treatment.

Answer

Accept the leader's statement and record the CRM system as a high-risk asset in the register.

Answer

Escalate the statement to the board risk committee for a final criticality decision.

Answer

Schedule a penetration test of the CRM system to determine its risk level.

Question 6

A risk practitioner is reviewing the organization's identity and access management (IAM) controls. The organization uses role-based access control (RBAC) but has experienced several incidents where employees retained access to systems after transferring to different departments. Which of the following is the MOST effective control to address this risk?

Accepted Answer

Integrate the HR system with the IAM system to automatically revoke old roles and grant new roles upon a change in employee status or department.. The root cause of the incidents is that access rights are not updated when employees change roles. The most effective control is to automate the synchronization of role changes from HR to the IAM system, ensuring timely revocation of old access and assignment of new access. This preventive control addresses the issue at the source and reduces reliance on periodic reviews.

Answer

Implement mandatory password rotation every 30 days for all users.

Answer

Conduct periodic user access reviews with managers certifying that their direct reports have appropriate access.

Answer

Require all employees to sign an acceptable use policy annually.

Question 7

An energy utility's board risk committee receives a quarterly IT risk report showing that overall risk exposure is within appetite, yet a recent regulatory audit identified unpatched internet-facing systems. The risk manager must improve the report so the committee is not misled in the future. Which change is MOST effective?

Accepted Answer

Add a section that reconciles reported risk ratings against independent audit and assessment findings.. When a board dashboard shows acceptable exposure while an independent audit finds real gaps, the reporting process lacks validation. Reconciling reported ratings with audit and assessment findings surfaces divergence, drives root-cause analysis, and ensures independent evidence updates the register. Changing frequency or format, or shifting authorship to audit, leaves the underlying data integrity problem intact.

Answer

Delegate preparation of the IT risk report entirely to the internal audit function going forward.

Answer

Increase the reporting frequency from quarterly to monthly without changing the content or data sources.

Answer

Replace quantitative risk ratings with a purely qualitative red, amber, and green status for each risk.

Question 8

A software development company identifies that developers are storing API keys in plaintext within source code repositories. The risk practitioner proposes a risk treatment plan that includes implementing a secrets management solution and rotating all exposed keys. The Chief Technology Officer asks how the risk practitioner will confirm that the treatment plan is reducing the risk over time. Which metric is MOST appropriate for monitoring the effectiveness of this risk response?

Accepted Answer

The number of secrets detected in source code repositories during automated scans each sprint.. The most appropriate metric directly measures whether the risky behavior is decreasing. Automated scans for secrets in source code provide objective, recurring evidence of plaintext credentials. A declining trend confirms the secrets management solution and process changes are effective. Metrics such as total managed keys, rotation time, and training completion are indirect or reactive and do not demonstrate that insecure storage has been reduced over time.

Answer

The percentage of developers who have completed secure coding training in the last year.

Answer

The mean time to rotate API keys after a developer reports a suspected exposure.

Answer

The total number of API keys currently managed by the secrets management solution.

Question 9

An organization is migrating its customer relationship management (CRM) system to a SaaS provider. The vendor's audit report shows a SOC 2 Type II opinion with no exceptions, but the report's period ended eight months ago. The risk practitioner must assess whether the residual risk is acceptable. Which action BEST addresses the gap in assurance?

Accepted Answer

Request a bridge letter or gap letter covering the period since the report ended and review the vendor's remediation of any changes.. SOC 2 Type II reports are point-in-time documents that cover only the stated audit period. When the report is stale, the risk practitioner needs evidence of controls during the gap. A bridge or gap letter is the standard mechanism for that period, supplemented by review of changes and incidents, allowing an informed residual risk determination.

Answer

Perform a penetration test against the SaaS provider's production environment to validate its controls directly.

Answer

Require the vendor to purchase cyber insurance and name the organization as an additional insured as a compensating control.

Answer

Accept the SOC 2 Type II report as sufficient evidence because it was issued by an independent CPA firm.

Question 10

A financial services firm has determined that a critical trading application cannot be patched for a known remote code execution vulnerability because the vendor no longer supports the platform. The risk manager decides to deploy a web application firewall (WAF) with virtual patching and network segmentation to isolate the application from the internal network. Which risk response strategy does this represent?

Accepted Answer

Risk mitigation. The organization is actively reducing the likelihood and impact of a vulnerability by deploying a WAF and network segmentation. These compensating controls are classic risk mitigation actions. Risk mitigation is the appropriate strategy when an organization chooses to implement controls to bring residual risk within appetite rather than accepting, transferring, or avoiding the risk entirely.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk avoidance

Question 11

A risk practitioner is documenting how the organization handles the risk that a critical SaaS vendor could suffer an outage that halts order processing. The vendor publishes a 99.9% uptime commitment and will credit service fees if it is missed. Which action BEST addresses the residual business impact that the credit does not cover?

Accepted Answer

Maintain a documented business continuity plan with a manual order-processing fallback and periodic testing.. Because service credits only refund fees and cannot restore lost orders, the organization retains the operational impact of a vendor outage. A documented and tested business continuity plan with a manual fallback directly reduces that impact by keeping order processing alive, whereas contract changes, assurance reports, and insurance all leave the business unable to operate during the outage.

Answer

Renegotiate the service level agreement to raise the uptime commitment to 99.99%.

Answer

Increase the cyber insurance limit to cover business interruption losses from vendor outages.

Answer

Request the vendor's SOC 2 Type II report and file it with the vendor risk assessment.

Question 12

An organization is designing its identity and access management architecture. The risk practitioner wants to reduce the risk of credential theft leading to unauthorized access to critical systems. Which of the following is the MOST effective control to address this risk?

Accepted Answer

Deploy phishing-resistant multi-factor authentication using FIDO2 security keys for access to critical systems.. Credential theft defeats knowledge-based authentication regardless of password strength, so the strongest mitigation changes the authentication factor itself. Phishing-resistant FIDO2 authentication uses origin-bound public-key cryptography, meaning stolen passwords or relayed phishing sessions cannot authenticate. Complexity rules, lockout, and awareness training are useful supporting controls but do not break the theft-to-access path.

Answer

Enforce a password complexity policy requiring 14 characters with mixed character classes and 60-day expiration.

Answer

Require users to complete annual security awareness training covering password hygiene and social engineering.

Answer

Implement account lockout after five failed attempts and alert the service desk when lockouts occur.

Question 13

A risk practitioner is facilitating a risk identification workshop for a retail bank's new real-time payments service. Business stakeholders keep proposing controls such as multifactor authentication and transaction limits as 'risks.' Which action BEST keeps the identification phase technically sound?

Accepted Answer

Reframe each suggestion by asking what adverse event the control is meant to prevent, and record that adverse event as the risk.. Risk identification captures uncertain events that could affect objectives, while controls are the responses selected later during risk treatment. When stakeholders offer a control, the practitioner should ask what adverse event it is meant to prevent and record that event as the risk. This preserves the register's integrity, allows likelihood and impact to be estimated meaningfully, and keeps the control where it belongs, in treatment planning, so evaluation and appetite comparison remain coherent.

Answer

Escalate to the CISO because stakeholders who cannot distinguish controls from risks should not participate in risk identification workshops.

Answer

Accept the control suggestions as risks but tag them so they are excluded later during risk evaluation and treatment planning.

Answer

Record both the controls and the underlying events in the register, then let the risk committee decide which entries to retain.

Question 14

A global manufacturing company is designing its IT risk reporting program. The board has requested that reports be actionable, comparable over time, and aligned with the enterprise risk management framework. Which TWO of the following characteristics are MOST important for the IT risk reports to meet these objectives? (Choose two.)

Accepted Answer

Reports use consistent risk scoring criteria and definitions across all business units.. Actionable, comparable, and ERM-aligned reporting requires consistent risk scoring criteria and definitions so risks can be compared across units and over time. It also requires presenting risk in business context, linking technical findings to strategic objectives so the board can prioritize. Raw scan outputs and zero-residual-risk filters fail to provide meaningful governance information, and divergent local scales break comparability.

Answer

Reports include only risks that have been fully mitigated to zero residual risk.

Answer

Reports are customized for each business unit using different risk scales to reflect local priorities.

Answer

Reports are generated monthly using raw technical vulnerability scan outputs.

Question 15

A global retailer is identifying IT risks related to a new cloud-based point-of-sale (POS) system. The risk practitioner wants to use a top-down approach. Which of the following is the MOST appropriate starting point for this approach?

Accepted Answer

Mapping the POS system to the retailer's strategic objectives and critical business processes.. A top-down risk identification approach starts with the organization's strategic objectives and critical business processes, then identifies IT risks that could affect them. Mapping the POS system to these objectives ensures that risk identification is business-driven and prioritizes risks with the greatest potential impact on the retailer's goals. This approach contrasts with bottom-up methods that begin with assets or vulnerabilities.

Answer

Reviewing the service level agreement with the cloud provider.

Answer

Cataloging all cloud infrastructure components used by the POS system.

Answer

Conducting a vulnerability scan of the cloud POS environment.

Question 16

A risk practitioner is facilitating a risk assessment workshop for a new cloud-based customer relationship management (CRM) system. The business owner is eager to launch the system and states that the risk assessment is unnecessary because the cloud provider is ISO 27001 certified. Which of the following is the MOST appropriate response from the risk practitioner?

Accepted Answer

Explain that certification reduces some third-party risks but the organization must still assess its own risks and controls.. ISO 27001 certification provides assurance that the cloud provider has a robust security management system, but it does not eliminate the customer's responsibility to assess its own risks. The organization must still evaluate risks related to data integration, user access, configuration, and compliance. The risk practitioner should explain this shared responsibility model. Skipping the assessment or substituting it with a penetration test would be inappropriate.

Answer

Perform a penetration test instead of a risk assessment to satisfy security requirements.

Answer

Agree with the business owner and skip the risk assessment since the provider is certified.

Answer

Escalate the matter to senior management because the business owner is refusing to comply with policy.

Question 17

A risk practitioner is assessing a proposed bring-your-own-device (BYOD) programme for a law firm where attorneys will access matter files containing privileged client data. The CISO asks which controls are MOST important to reduce the risk of data leakage from lost or compromised personal devices. (Choose two.)

Accepted Answer

Deploy mobile device management (MDM) with remote wipe and containerization of firm data.. The two controls that actually prevent privileged client data from being exposed when a personal device is lost or compromised are escrowed full-device encryption and MDM with remote wipe plus containerization. Together they protect data at rest and allow selective removal of firm data, while the other choices are policy, perimeter, or financial measures that do not stop the leakage scenario.

Answer

Require attorneys to sign an acceptable use policy acknowledging that personal devices may be inspected.

Answer

Block all access to matter files from outside the firm's office network by IP allowlisting.

Answer

Increase cyber insurance limits to cover regulatory fines from client data breaches.

Question 18

A multinational retailer operates in a jurisdiction that requires all payment data to remain within national borders. The risk practitioner is asked to verify that a newly deployed cloud payment service complies with this requirement before it goes live. Which activity best provides this assurance?

Accepted Answer

Verifying the configured data storage and processing regions and obtaining contractual commitments on data location.. Data residency obligations are satisfied only by evidence of where data actually resides plus a binding commitment that it stays there. Verifying the provisioned regions, including replication and backup locations, and securing contractual data-location terms directly addresses the regulatory requirement. General certifications and availability agreements speak to security or uptime, not geographic confinement of payment data.

Answer

Reviewing the cloud provider's publicly available service level agreement for uptime commitments.

Answer

Confirming that the provider holds a current ISO/IEC 27001 certification for its information security management system.

Answer

Obtaining the cloud provider's general SOC 2 Type II report covering security and availability.

Question 19

A hospital's radiology department wants to let referring physicians upload imaging orders through a new web portal that stores protected health information (PHI). The risk practitioner must ensure the portal meets the HIPAA Security Rule. Which of the following is the MOST appropriate control to implement first?

Accepted Answer

Conduct a risk analysis to identify threats and vulnerabilities to the PHI processed by the portal.. The HIPAA Security Rule is built on a risk management framework, and its first required implementation specification is an accurate and thorough risk analysis. Before selecting encryption, access controls, or contracts, the organization must identify and evaluate the risks to electronic PHI. That analysis then informs the selection of reasonable and appropriate safeguards for the portal.

Answer

Deploy full-disk encryption on all endpoint devices used by referring physicians.

Answer

Sign a business associate agreement with the portal software vendor.

Answer

Implement role-based access control for all portal users.

Question 20

A software development company is assessing risks related to its cloud infrastructure. The risk team uses a qualitative approach and creates a risk register. During a review, the team notices that a risk related to unauthorized access to customer data has a likelihood rating of 4 (on a 5-point scale) and an impact rating of 5. The risk owner decides to implement multi-factor authentication (MFA) and role-based access control (RBAC). After implementation, the likelihood rating is reduced to 2, while impact remains 5. What is the PRIMARY purpose of updating the risk register with these new ratings?

Accepted Answer

To reflect the current risk posture and support risk-based decision making. The risk register is a living document that should be updated to reflect changes in risk levels after controls are implemented. Updating the ratings provides an accurate view of residual risk, which supports prioritization, resource allocation, and risk-based decision making. While compliance and audit are important, they are not the primary purpose of the update.

Answer

To satisfy regulatory requirements for risk documentation

Answer

To document the cost of the controls implemented

Answer

To provide evidence for the internal audit team