CRISC Practice Test 7 — 10 Questions

Question 1

Which control type is primarily focused on identifying that a risk event has occurred?

Accepted Answer

Detective. Detective controls are designed to detect incidents after they happen.

Answer

Compensating

Answer

Preventive

Answer

Corrective

Question 2

During a risk assessment, the IT risk manager needs to prioritize risks for treatment. Which of the following risk characteristics should be weighted MOST heavily?

Accepted Answer

The degree to which the risk affects strategic business objectives. In CRISC, risk prioritization is fundamentally driven by alignment with strategic business objectives because IT risk management exists to protect the enterprise’s mission and goals. Even a high-likelihood or high-financial-impact risk may be deprioritized if it does not materially affect the organization’s strategic objectives, as the risk treatment decision must support business value and continuity. This weighting ensures that resources are allocated to risks that most threaten the enterprise’s ability to achieve its core mission.

Answer

The ease of implementing mitigating controls

Answer

The likelihood that the threat will be exploited

Answer

The financial impact calculated in monetary terms

Question 3

A risk manager is categorizing IT risks. Which risk category would a potential fine for violating GDPR be assigned to?

Accepted Answer

Compliance. A fine for violating GDPR is a direct consequence of failing to meet a legal/regulatory obligation, which is the definition of compliance risk. Compliance risk encompasses penalties, sanctions, and legal actions arising from non-conformance with laws, regulations, and standards. Although the fine is monetary, its root cause is regulatory non-compliance, so it belongs in the compliance category.

Answer

Operational

Answer

Financial

Answer

Strategic

Question 4

Based on the exhibit, which aspect of risk monitoring is MOST concerning?

Accepted Answer

The vulnerability has been open for three months with no evidence of monitoring or remediation despite a patch being available.. The vulnerability has been open for three months with a patch available, yet there is no evidence of monitoring or remediation. This indicates a complete breakdown of the risk monitoring process, as the organization failed to track, escalate, or patch a known critical vulnerability, leaving the system exposed to exploitation. In risk monitoring, the absence of any monitoring activity or remediation action over such a long period is far more concerning than the severity alone, as it reflects a systemic failure in the control environment.

Answer

The vulnerability severity is critical.

Answer

The last scan was three months after the initial detection.

Answer

The risk was accepted by the system owner.

Question 5

A hospital's IT risk manager is preparing a quarterly risk report for the executive committee. The report currently lists 240 technical vulnerabilities with CVSS scores but no business context. The CIO asks for a report that helps executives decide where to allocate limited remediation funding. Which change best aligns the report with risk response and reporting objectives?

Accepted Answer

Group vulnerabilities by the business processes and assets they affect, and express exposure in terms of potential impact and likelihood.. Risk reporting to executives must translate technical findings into business language. Grouping vulnerabilities by affected processes and assets and expressing exposure through impact and likelihood gives leaders the context needed to prioritize remediation spending against organizational objectives. Raw counts, technical artifacts, or alphabetical ordering do not support funding decisions because they omit the business consequences that drive risk-based prioritization.

Answer

Report only the total count of vulnerabilities and the percentage remediated within the past quarter.

Answer

Sort the vulnerabilities alphabetically by vendor name so the report is easier to navigate.

Answer

Increase the report's technical depth by including exploit code snippets and packet captures for each vulnerability.

Question 6

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Accepted Answer

Inability to apply security patches due to legacy firmware. IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Answer

Interference with radio frequency signals

Answer

Limited data storage capacity

Answer

High power consumption leading to operational costs

Question 7

A multinational financial services company has implemented a continuous monitoring program for its trading systems. The program uses automated scripts to check system configurations against a baseline every hour. Recently, the company experienced a significant security incident where a malicious actor exploited a misconfigured firewall rule to exfiltrate sensitive customer data. Post-incident analysis revealed that the misconfiguration had been present for 72 hours before detection. The monitoring scripts did not detect the change because the baseline had been updated two weeks prior to include the misconfiguration as part of a planned change that was later reversed without updating the baseline. The company's change management process requires that all configuration changes be approved and documented, but the reversal of the change was not documented. The incident response team was only alerted when a customer reported suspicious activity. The risk practitioner is tasked with recommending improvements to prevent recurrence. Which of the following is the BEST course of action?

Accepted Answer

Implement a change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates.. The root cause is that the baseline was updated to include the misconfiguration, and the subsequent reversal was not documented or reflected in the baseline. A change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates, directly addresses this by ensuring that only approved changes are in the baseline and any unapproved deviation (including reversals) triggers an alert. This prevents the monitoring system from accepting unauthorized changes as normal.

Answer

Enhance incident response procedures to include notification of customers within 24 hours.

Answer

Increase the frequency of monitoring scripts to every 30 minutes.

Answer

Require manual review of all configuration changes by a second analyst.

Question 8

An organization has implemented a firewall (preventive), intrusion detection system (detective), and a backup restoration plan (corrective) to address a specific risk. The risk manager assesses the control effectiveness as follows: design adequacy is strong, but operating effectiveness is weak due to inconsistent patching. Which of the following best describes the residual risk?

Accepted Answer

Residual risk is lower than inherent risk but still significant due to weak operating effectiveness. Residual risk is lower than inherent risk because the three controls (preventive, detective, corrective) do reduce the risk, but it remains significant because weak operating effectiveness — inconsistent patching — means the controls are not functioning as designed. Design adequacy alone does not guarantee risk reduction; actual operating effectiveness determines the true residual level.

Answer

Residual risk cannot be determined without a quantitative analysis

Answer

Residual risk is negligible because multiple controls are in place

Answer

Residual risk is equal to inherent risk because controls are ineffective

Question 9

An international bank is expanding its operations into a new country with strict data localization laws. The IT department plans to use a cloud service provider that stores data in neighboring countries but promises compliance. The risk team has identified several potential risks: regulatory fines for non-compliance, data interception during cross-border transmission, and difficulty in auditing the cloud provider. The legal team advises that the contract includes data protection clauses, but these have not been tested. The risk manager must now prioritize risk identification efforts. What is the MOST important risk identification step the risk team should undertake?

Accepted Answer

Perform a regulatory compliance assessment specific to the new country's laws.. The most critical risk identification step when entering a new country with strict data localization laws is to perform a regulatory compliance assessment specific to that country's laws. This ensures the bank understands the exact legal requirements for data storage, processing, and transfer, which directly informs whether the cloud provider's promised compliance is achievable. Without this assessment, the risk team cannot accurately identify the scope and severity of regulatory fines or other legal risks.

Answer

Review the cloud provider's SOC 2 report.

Answer

Conduct a thorough legal review of the contract's data handling clauses.

Answer

Map data flows to ensure all data is properly classified.

Question 10

A company has implemented a key risk indicator (KRI) for system availability, with a threshold of 99.5%. The monitoring team observes that availability has dropped to 99.2% for two consecutive months. What is the most appropriate next step?

Accepted Answer

Notify the risk owner and initiate a root cause analysis.. A sustained breach of a KRI threshold (99.2% vs. 99.5%) for two consecutive months indicates a systemic issue that requires formal risk management action. The risk owner must be notified to assess the impact, and a root cause analysis (RCA) should be initiated to identify underlying failures—such as network congestion, hardware faults, or software bugs—before any remediation is planned.

Answer

Implement additional redundancy to improve availability.

Answer

Increase the threshold to 99.0% to avoid false alarms.

Answer

Escalate immediately to the board of directors.