CRISC Practice Test 7 — 10 Questions

Question 1

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

Accepted Answer

Conduct a threat modeling workshop with the development team.. Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Answer

Perform a vulnerability scan on the CRM server.

Answer

Run a penetration test against the CRM application.

Answer

Review the business impact analysis for the CRM.

Question 2

A company has identified a risk of data exfiltration through an outdated encryption protocol. The risk assessment team determines that the likelihood is low, but the impact is very high. The company decides to update the encryption protocol. This risk response is an example of:

Accepted Answer

Risk mitigation. Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 3

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

Accepted Answer

Unauthorized access to patient medical records.. The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.

Answer

Denial of service due to excessive login attempts.

Answer

Insufficient encryption of data in transit.

Answer

Phishing attacks targeting portal users.

Question 4

A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?

Accepted Answer

Document the vulnerability and assess the associated risk in the risk register. The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

Answer

Apply a virtual patch via an intrusion prevention system

Answer

Isolate the application from the network

Answer

Notify the application owner and request an emergency patch

Question 5

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Accepted Answer

Risk Avoidance. Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 6

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. A high false positive rate in a detective control leads to alert fatigue, where security personnel may ignore or dismiss alerts, increasing the risk that actual security incidents are missed. Option A is a consequence but not the most significant. Option C may occur but is secondary. Option D is an operational impact but does not directly increase risk.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 7

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

Accepted Answer

To determine the criticality and recovery time objectives of business processes. The primary purpose of a business impact analysis (BIA) is to identify critical business processes, determine their recovery priorities, and establish recovery time objectives (RTOs) and recovery point objectives (RPOs). Option B is incorrect because identifying vulnerabilities is part of a vulnerability assessment, not a BIA. Option C is incorrect because identifying potential threat actors is part of threat modeling. Option D is incorrect because inventorying IT assets is part of asset management, not the primary goal of a BIA.

Answer

To identify vulnerabilities in IT systems

Answer

To identify potential threat actors

Answer

To inventory all IT assets

Question 8

A multinational corporation is conducting a risk assessment for its new online payment platform. The platform processes transactions in multiple currencies and stores sensitive customer financial data. The risk team has identified that the encryption algorithm used for data at rest is outdated and could be vulnerable to advanced attacks. The company's risk appetite is low for data breaches. The security team recommends upgrading the encryption to a modern standard, but the upgrade will require a 48-hour downtime impacting all global transactions. The business unit is concerned about revenue loss during the downtime. As the risk practitioner, what is the BEST course of action to balance security and business continuity?

Accepted Answer

Plan the upgrade during a low-traffic period and implement compensating controls such as additional monitoring during the downtime.. The best course of action because it balances the need to mitigate a high-risk encryption vulnerability with business continuity. By scheduling the upgrade during a low-traffic period and implementing compensating controls (e.g., enhanced monitoring and intrusion detection), the organization reduces the likelihood of exploitation during the 48-hour downtime while minimizing revenue loss. This aligns with the low risk appetite for data breaches and demonstrates a risk-based decision that treats the vulnerability without accepting unacceptable exposure.

Answer

Accept the risk and delay the upgrade until the next scheduled maintenance window in three months.

Answer

Outsource the payment processing to a third-party vendor that already uses modern encryption.

Answer

Implement the upgrade immediately to mitigate the vulnerability, accepting the revenue loss.

Question 9

Which of the following is an example of a 'configuration vulnerability' that should be identified during vulnerability assessment?

Accepted Answer

Default administrative passwords left unchanged on a network device. A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

Answer

A buffer overflow in a custom application

Answer

An SQL injection flaw in a web form

Answer

Missing security patches on a server

Question 10

Which TWO of the following are examples of risk avoidance?

Accepted Answer

Migrating to a different technology platform. Migrating to a different technology platform (Option D) is a risk avoidance strategy because it eliminates the risk entirely by moving away from the vulnerable or high-risk technology. For example, if an organization uses an outdated operating system with known unpatched vulnerabilities, migrating to a modern, supported platform removes the attack surface, avoiding the risk rather than mitigating or transferring it.

Answer

Implementing a firewall

Answer

Purchasing cyber insurance

Answer

Accepting the risk