CRISC Practice Test 8 — 10 Questions

Question 1

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Accepted Answer

Risk transfer. Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Answer

Risk reduction

Answer

Risk acceptance

Answer

Risk avoidance

Question 2

An organization is designing a risk and control monitoring program for a new cloud-based application. Which of the following is the MOST important factor to consider when selecting Key Risk Indicators (KRIs)?

Accepted Answer

Alignment with strategic objectives.. Alignment with strategic objectives is the most important factor because KRIs must directly measure risks that could impede the organization's business goals and strategic initiatives. For a new cloud-based application, KRIs tied to strategic objectives ensure monitoring focuses on risks that matter most to the business, such as data breaches affecting customer trust or service downtime impacting revenue, rather than irrelevant metrics.

Answer

Historical loss data availability.

Answer

Ease of automated data collection.

Answer

Industry best practices.

Question 3

During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?

Accepted Answer

It is tailored for use in agile and DevOps environments. VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.

Answer

It requires detailed system architecture upfront

Answer

It replaces the need for vulnerability scanning

Answer

It focuses on compliance requirements only

Question 4

An organization is implementing a new data loss prevention (DLP) solution. The risk manager is identifying potential risks related to the DLP solution itself. Which of the following is a risk that should be considered?

Accepted Answer

The DLP solution may generate a high volume of false positives, causing alert fatigue and missed real incidents.. A DLP solution may generate false positives, leading to alert fatigue and missed detections. Option B is a benefit, not a risk. Option C is a control. Option D is a desired outcome.

Answer

The DLP solution will reduce the risk of data exfiltration.

Answer

The DLP solution will block all unauthorized data transfers.

Answer

The DLP solution will automatically encrypt sensitive data in transit.

Question 5

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Accepted Answer

Data architecture layer. Data classification and data sovereignty are concerns about how data is categorized, where it resides, and which legal/regulatory jurisdictions govern it — all of which are addressed in the data architecture layer. This layer defines data models, ownership, retention, classification schemes, and cross-border data flow rules. Risk related to sovereignty (e.g., GDPR data residency) is fundamentally a data architecture design issue.

Answer

Application architecture layer

Answer

Business architecture layer

Answer

Infrastructure/Technology architecture layer

Question 6

An organization is planning for post-quantum cryptography migration. Which THREE of the following are key considerations for this migration?

Accepted Answer

Inventory of all cryptographic assets and dependencies. A comprehensive inventory of cryptographic assets and dependencies is essential to identify all systems, applications, and data that rely on current cryptographic algorithms (e.g., RSA, ECDSA, Diffie-Hellman). Without this inventory, the organization cannot prioritize migration efforts, assess impact, or ensure that no legacy cryptographic dependency is overlooked during the transition to post-quantum algorithms.

Answer

Replacing all existing hardware immediately

Answer

Eliminating cloud services to reduce risk

Question 7

After a control self-assessment (CSA) workshop, business units reported that 80% of controls are operating effectively. However, internal audit's recent testing indicates a 30% control failure rate. What is the BEST explanation for this discrepancy?

Accepted Answer

CSA participants may have a biased perception of control effectiveness, while audit uses objective evidence.. The most likely explanation for the gap between CSA self-reported effectiveness (80%) and audit-observed failure (30%) is that CSA participants assess controls subjectively and may overestimate effectiveness due to familiarity, optimism, or lack of objectivity, whereas internal audit tests controls using independent, evidence-based procedures. This perception bias is a well-documented limitation of self-assessment. The other options introduce speculative factors (timing, training, scope) that are not supported by the scenario.

Answer

The audit was conducted three months after the CSA, and controls may have degraded.

Answer

CSA participants lacked adequate training on what constitutes a control failure.

Answer

The CSA covered a different scope of controls than the audit.

Question 8

During a merger and acquisition (M&A) due diligence, the acquiring company's IT risk manager is tasked with identifying risks in the target's IT environment. Which of the following would be the MOST effective technique to uncover hidden risks?

Accepted Answer

Perform an on-site technical assessment and interview key IT staff. An on-site technical assessment combined with interviews of key IT staff is the most effective technique because it uncovers undocumented risks, shadow IT, cultural issues, and technical debt that documents and scans alone cannot reveal. Interviews provide context about how systems are actually used versus how they are documented, and on-site observation can expose physical and operational risks.

Answer

Analyze the target's existing risk register

Answer

Review the target's IT policies and procedures

Answer

Conduct a network vulnerability scan

Question 9

A global organization is consolidating risk data from multiple business units into a single enterprise risk management (ERM) system. The risk practitioner notices that KRIs for the same risk type (e.g., cybersecurity) are calculated differently across units. What is the BEST approach to ensure consistent and reliable risk monitoring and reporting?

Accepted Answer

Establish a common definition and calculation methodology for each KRI across all business units.. Consistent risk monitoring and reporting requires a standardized definition and calculation methodology for each KRI across all business units. Without this common baseline, the aggregated risk data in the ERM system will be incomparable and unreliable, leading to flawed decision-making. Establishing common definitions ensures that the same risk type (e.g., cybersecurity) is measured uniformly, enabling accurate trend analysis and risk aggregation.

Answer

Require all units to adopt a common set of key performance indicators for their control environment.

Answer

Allow each business unit to maintain its own KRI definitions but report explanations for variances.

Answer

Implement automated data feeds from each unit's system to the ERM system without changing the KRI definitions.

Question 10

An organization is implementing a new access control system. The project manager is concerned about delays due to user training requirements. Which of the following should the risk practitioner prioritize to ensure effective control implementation?

Accepted Answer

Ensure user training is completed before go-live. User training is a critical success factor for access control systems because misconfigured or improperly used controls can lead to security gaps. Ensuring training is completed before go-live (Option D) aligns with the principle that a control is only effective if users understand how to operate it correctly, preventing human error that could bypass the control's intended protections.

Answer

Accelerate the deployment to meet the project deadline

Answer

Implement a compensating control to reduce training requirements

Answer

Delay the entire project until training can be completed