CRISC Practice Test 9 — 10 Questions

Question 1

Order the steps for incident response handling.

Accepted Answer

Step 1: Preparation, Step 2: Detection, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting. Incident response follows preparation, detection, containment/eradication/recovery, lessons learned, and reporting.

Answer

Step 1: Detection, Step 2: Preparation, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting

Answer

Step 1: Reporting, Step 2: Preparation, Step 3: Detection, Step 4: Containment/Eradication/Recovery, Step 5: Lessons Learned

Answer

Step 1: Preparation, Step 2: Containment/Eradication/Recovery, Step 3: Detection, Step 4: Lessons Learned, Step 5: Reporting

Question 2

An organization is conducting a risk assessment and finds that the inherent risk for a critical asset is very high due to a high threat event frequency and high vulnerability. The current controls are assessed as adequate in design but not operating effectively. Which THREE of the following should be considered when calculating residual risk?

Accepted Answer

Inherent risk score. Inherent risk score (A) is correct because residual risk is calculated by considering the inherent risk level and the effectiveness of controls in reducing that risk. Since the inherent risk is very high due to high threat frequency and vulnerability, this baseline score must be factored into the residual risk calculation to determine the remaining risk after controls are applied.

Answer

Cost-benefit analysis of controls

Answer

Risk appetite statement

Question 3

An IT risk assessment team is using a 5×5 risk matrix with likelihood and impact ratings. A risk scenario is rated as likelihood = 4 (likely) and impact = 5 (catastrophic). According to the typical heat map, what would be the risk rating?

Accepted Answer

Critical. In a 5×5 matrix, likelihood 4 and impact 5 give a product of 20, which is typically in the 'critical' range. Common thresholds: 1-5 low, 6-10 medium, 11-15 high, 16-25 critical.

Answer

High

Answer

Medium

Answer

Low

Question 4

An organization is updating its IT risk universe to include emerging threats. The CISO wants to ensure the risk register captures realistic risk scenarios. Which THREE components are essential for constructing a complete risk scenario according to ISACA's risk scenario template?

Accepted Answer

Event. A complete risk scenario includes actor (who), threat type (what), event (how), and asset/resource (what is affected). Timing, detection, and response are additional elements but not part of the core template.

Answer

Timing

Answer

Detection

Question 5

Which THREE of the following should be included in a board-level risk report to effectively communicate the organization's risk profile?

Accepted Answer

Emerging risks and trend analysis of key risk indicators over the past quarter.. A board-level risk report must include forward-looking information such as emerging risks and trend analysis of key risk indicators (KRIs) over the past quarter. This enables the board to understand not only the current risk posture but also the direction and velocity of risk changes, which is essential for strategic oversight and proactive decision-making.

Answer

A list of the most recent security incidents with root cause analysis.

Answer

Detailed descriptions of all controls mitigating the top risks.

Question 6

During the risk identification process, an IT risk universe is defined. Which of the following BEST describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. The IT risk universe is a comprehensive inventory of all potential IT risks that could affect the organization, serving as the foundation for further risk assessment and treatment.

Answer

A list of all known vulnerabilities in the organization's IT systems

Answer

A database of past security incidents and their root causes

Answer

A framework for categorizing risks into strategic, operational, financial, and compliance

Question 7

A financial institution is redesigning its control monitoring program to comply with a new regulatory requirement that mandates near-real-time monitoring of high-risk transactions. The current system performs batch processing daily. Which approach BEST meets the requirement while minimizing operational impact?

Accepted Answer

Implement a real-time monitoring solution that only processes transactions flagged as high-risk based on predefined criteria.. It directly satisfies the near-real-time monitoring requirement by processing only high-risk transactions as they occur, using predefined criteria to minimize latency and operational overhead. This targeted approach avoids the cost and complexity of converting all transaction processing to real-time, while still meeting regulatory demands for immediate detection of high-risk activity.

Answer

Use manual reviews of high-risk transactions by compliance officers within 24 hours.

Answer

Replace batch processing with a fully real-time system for all transactions.

Answer

Increase batch processing frequency from daily to hourly.

Question 8

An organization is evaluating the impact of a potential data breach. Which THREE of the following are considered indirect financial impacts?

Accepted Answer

Legal fees from lawsuits. Indirect financial impacts include lost business, reputation damage, and opportunity costs.

Answer

Incident response costs

Answer

Notification costs to affected individuals

Question 9

A company's IT risk team is conducting a risk identification exercise for a new blockchain-based supply chain solution. Which THREE risks are MOST specific to this technology?

Accepted Answer

51% attack on the underlying consensus mechanism.. A 51% attack is a specific risk to blockchain consensus mechanisms where a single entity or group gains majority hashing power, allowing them to reverse transactions or prevent new blocks from being confirmed. This directly undermines the integrity and immutability that blockchain promises for the supply chain solution.

Answer

Incompatibility with legacy database systems.

Answer

High electricity consumption of mining nodes.

Question 10

During a vendor risk assessment, a prospective vendor for critical services cannot provide a SOC 2 Type II report. According to the organization's vendor risk appetite, which action should be taken?

Accepted Answer

Reject the vendor or request a formal risk acceptance. A SOC 2 Type II report provides independent assurance over a service organization's controls over a period of time. When a prospective vendor for critical services cannot provide this report, and the organization's risk appetite is defined, the appropriate action is to reject the vendor or require a formal risk acceptance from the risk owner. This ensures that any deviation from the required control evidence is explicitly acknowledged and approved, rather than bypassing the requirement.

Answer

Lower the vendor's tier to reduce requirements

Answer

Accept the vendor's self-assessment instead

Answer

Onboard the vendor with additional monitoring