CRISC IT Risk Assessment Practice Test 11 — 15 Questions

Question 1

A financial services firm is completing its annual IT risk assessment. The CISO wants to compare the relative severity of 40 identified risks across different business units and prioritize which ones to treat first. The risk team has limited quantitative data and needs a consistent, repeatable method that reflects both likelihood and impact. Which approach BEST meets this need?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Score each risk on defined likelihood and impact scales and plot them on a risk matrix.. When quantitative data is scarce but consistent comparison across many risks is required, a risk matrix with defined likelihood and impact scales is the appropriate tool. It normalizes judgments, reflects both dimensions of risk, and yields repeatable severity ratings that support prioritization across business units. This aligns with standard IT risk assessment practice for relative risk ranking.

Answer

Calculate the annualized loss expectancy for each risk using historical loss data.

Answer

Rank the risks by the total number of identified vulnerabilities associated with each.

Answer

Assign each risk to the business unit that owns the affected asset and treat them independently.

Question 2

A risk analyst is building a control assessment for a payment processing environment. She needs to determine whether a new control objective is adequately addressed. She has identified the control objective, the associated risk, and the control activity. Which of the following should she do NEXT to complete the control assessment?

Accepted Answer

Test the operating effectiveness of the control activity and document the results.. After defining the control objective, risk, and control activity, the assessor must test the control's operating effectiveness to determine whether the objective is actually met. Design alone does not prove effectiveness. Testing produces evidence that supports a conclusion, which is the purpose of a control assessment in IT risk management.

Answer

Identify additional risks that could affect the same control objective and add them to the assessment scope.

Answer

Perform a business impact analysis to quantify the potential loss from the risk.

Answer

Revisit the risk register to confirm the risk rating and update the risk appetite statement.

Question 3

A financial services firm is conducting an IT risk assessment for its customer-facing mobile banking application. The risk team has identified that the application's authentication mechanism relies on a third-party single sign-on (SSO) provider. During a workshop, the risk owner states that the likelihood of a breach is low because the SSO provider has a strong security reputation. However, the risk team notes that no service-level agreement (SLA) exists with the provider. Which risk factor is MOST directly affected by the absence of an SLA, and how should the risk practitioner proceed?

Accepted Answer

The third-party dependency risk is elevated, and the risk practitioner should recommend negotiating an SLA with the SSO provider.. The absence of an SLA with a critical SSO provider introduces third-party dependency risk because there are no contractual guarantees for security, availability, or incident response. The risk practitioner should recognize this as an elevated risk and recommend negotiating an SLA to establish obligations and controls. This is a key part of IT risk assessment, where third-party relationships must be evaluated and managed. The correct answer focuses on the specific risk factor and the appropriate next step.

Answer

The residual risk of the mobile application is unchanged, so the risk practitioner should focus on internal controls only.

Answer

The inherent risk of the SSO provider is reduced, so the risk practitioner should document the risk as acceptable.

Answer

The risk appetite for the mobile application is exceeded, so the risk practitioner should immediately terminate the SSO contract.

Question 4

A retail company is assessing risk for a legacy point-of-sale system that cannot be patched. The risk team wants to identify controls that would reduce the likelihood of a successful exploitation of known vulnerabilities on these terminals. Which TWO of the following are preventive controls that would BEST reduce the likelihood of exploitation? (Choose two.)

Accepted Answer

Segment the point-of-sale terminals onto a dedicated network with strict firewall rules limiting outbound and inbound traffic. Preventive controls reduce the likelihood of a successful attack. Network segmentation with restrictive firewall rules and application allowlisting both stop exploitation attempts from succeeding on unpatched terminals by limiting reachability and blocking unauthorized code execution. Logging, backups, and vulnerability scanning are valuable but are detective or corrective in nature and do not lower the probability of exploitation.

Answer

Conduct quarterly vulnerability scans of the point-of-sale network

Answer

Enable detailed logging and forward terminal logs to a centralized SIEM for monitoring

Answer

Perform daily backups of terminal configuration and transaction data

Question 5

A risk analyst is evaluating a critical customer database. The asset value is $2,000,000; the exposure factor if the database is compromised is 40%. The annualized rate of occurrence (ARO) for a successful breach is estimated at 0.25. What is the annualized loss expectancy (ALE)?

Accepted Answer

$200,000. ALE is calculated as SLE × ARO. Here SLE = $2,000,000 × 0.40 = $800,000, and ARO = 0.25, so ALE = $800,000 × 0.25 = $200,000. This quantitative metric helps the risk practitioner compare the expected annual loss of this risk against other risks and against the cost of potential controls.

Answer

$800,000

Answer

$2,000,000

Answer

$500,000

Question 6

A retail company is assessing risk for a new customer loyalty application. The risk team determines that the inherent risk is high, then evaluates existing controls and finds that the residual risk is within the organization's risk appetite. The CIO asks what the residual risk rating represents. Which statement BEST describes residual risk in this context?

Accepted Answer

The risk that remains after existing controls are applied and their effectiveness is considered.. Residual risk is the exposure that remains once existing controls are applied and their effectiveness is factored in. Because the loyalty application's controls reduce the high inherent risk to a level inside the stated appetite, the residual rating is what the organization actually carries. It drives the decision to accept, mitigate further, transfer, or avoid the risk.

Answer

The risk that the implemented controls themselves will fail to operate as designed.

Answer

The total risk exposure before any controls are implemented.

Answer

The maximum plausible loss the organization could suffer from a single risk event.

Question 7

A financial services firm is performing an IT risk assessment on a legacy trading platform. The risk team has identified several weaknesses in the platform's patch management process. Which TWO of the following are examples of vulnerabilities that should be recorded in the risk register? (Choose two.)

Accepted Answer

Patch deployment requires manual approval by a single administrator.. Vulnerabilities are internal weaknesses in people, processes, or technology that a threat can exploit. An unsupported operating system and a manual single-administrator patch approval process both qualify because they exist inside the environment and degrade the firm's ability to prevent exploitation. The hacker announcement is a threat source, the revenue figure is business criticality, and the insurance exclusion is a risk financing condition, so none belong in the vulnerability field of the register.

Answer

The firm's cyber insurance policy excludes losses from unpatched systems.

Answer

The trading platform processes approximately 40 percent of the firm's revenue.

Answer

A hacker collective has publicly announced targeting of trading firms.

Question 8

A multinational bank is assessing risk for a new mobile banking feature that stores limited customer data on devices. The risk team must decide whether to use a qualitative or quantitative approach. Which of the following is the MOST important factor in making this decision?

Accepted Answer

The availability of reliable historical loss data and the need to express risk in financial terms.. Selecting a qualitative or quantitative risk assessment method depends primarily on whether reliable data exists to support quantification and whether decisions require financial expression. When loss data is credible and cost-benefit analysis is needed, quantitative methods add value. When data is sparse or decisions are strategic, qualitative methods are more practical and defensible.

Answer

The number of risks identified in the risk register and the size of the assessment team.

Answer

The preference of the business unit sponsor and the timeline for the product launch.

Answer

The regulatory requirement to perform an annual risk assessment and the audit committee's reporting schedule.

Question 9

A financial services firm is performing an IT risk assessment on its legacy 3270-based transaction processing system. The system has no vendor support, no documentation, and only two remaining staff members who understand its internals. The risk committee asks the risk analyst to determine the MOST appropriate way to characterize the risk associated with this asset. Which of the following should the analyst do FIRST?

Accepted Answer

Identify and document the threats, vulnerabilities, and business impact specific to the legacy environment.. Characterizing risk requires first identifying the threats, vulnerabilities, and business impacts associated with the asset, because likelihood and impact assessment depend on those inputs. Legacy platforms with no vendor support and concentrated tribal knowledge present availability and knowledge-loss exposures that must be articulated before any treatment decision. Quantifying value, migrating, or buying insurance are downstream activities that presume the risk has already been understood and documented.

Answer

Immediately migrate the workload to a modern platform to eliminate the unsupported technology exposure.

Answer

Quantify the asset's replacement cost and depreciated book value to express risk in monetary terms.

Answer

Purchase cyber insurance covering business interruption losses from system outages.

Question 10

An insurance company is assessing the risk of a distributed denial-of-service (DDoS) attack against its customer portal. The risk team estimates that a threat actor group has both the capability and the intent to launch such an attack, and that the portal has an unpatched vulnerability that could be exploited to amplify the attack. Which factor does the unpatched vulnerability PRIMARILY represent in this risk scenario?

Accepted Answer

Vulnerability. In risk assessment, vulnerability is the internal weakness or gap that a threat can exploit. The threat actor group provides capability and intent, while impact describes the resulting harm. The unpatched portal flaw is the vulnerability that enables the DDoS amplification, so it is the factor the risk team should prioritize for remediation.

Answer

Impact

Answer

Threat

Answer

Risk appetite

Question 11

A healthcare organization is assessing risks to its electronic health record (EHR) system. The risk team is evaluating the likelihood of a threat event. Which TWO factors are MOST relevant when estimating the likelihood of a threat exploiting a vulnerability? (Choose two.)

Accepted Answer

The skill level and motivation of the threat actor. Likelihood estimation in risk assessment focuses on factors that influence the probability of a threat exploiting a vulnerability. The skill and motivation of the threat actor and the ease of discovery and exploitability of the vulnerability are direct determinants of that probability. Regulatory fines, user count, and control costs are related to impact or treatment, not likelihood.

Answer

The number of users with access to the EHR system

Answer

The regulatory fines associated with a data breach

Answer

The cost of implementing additional security controls

Question 12

A healthcare organization is performing a risk assessment on its electronic health record (EHR) system. The risk team has identified that a legacy interface engine transmits unencrypted patient data between two internal segments. The organization's risk appetite for data confidentiality breaches is low. The IT team proposes to accept the risk because the segments are internal and firewalls separate them from the internet. Which risk response should the risk practitioner recommend FIRST?

Accepted Answer

Mitigate the risk by implementing encryption for the data in transit between the segments.. Mitigation through encryption is the recommended first response because it directly addresses the unencrypted transmission of patient data and aligns with the organization's low risk appetite for confidentiality breaches. Encryption reduces both the likelihood of successful interception and the impact if interception occurs, providing a proportionate and technically feasible control. Acceptance, transfer, and avoidance are either misaligned with appetite or unnecessarily disruptive given the availability of a targeted preventive control.

Answer

Avoid the risk by decommissioning the legacy interface engine immediately.

Answer

Transfer the risk by purchasing cyber insurance covering data breach costs.

Answer

Accept the risk and document it in the risk register with a review date.

Question 13

A healthcare organization is assessing the risk of a ransomware attack on its electronic health record (EHR) system. The risk team has identified that the organization performs daily incremental backups and weekly full backups, but the backups are stored on the same network share as the EHR data. The risk owner argues that the backup strategy reduces the impact of a ransomware attack. Which statement BEST describes the residual risk after considering this control?

Accepted Answer

The residual risk is high because the backups are not isolated and could be encrypted along with the primary data.. The backup strategy is ineffective against ransomware because the backups reside on the same network share as the primary EHR data. Ransomware can encrypt both, so the organization may lose both primary and backup data. Therefore, the residual risk remains high. The risk practitioner should recognize this control weakness and recommend isolating backups, such as using offline or immutable storage. This is a critical aspect of IT risk assessment: evaluating control effectiveness, not just existence.

Answer

The residual risk is unchanged from the inherent risk because backups are a preventive control.

Answer

The residual risk is medium because the weekly full backup provides a fallback if incremental backups fail.

Answer

The residual risk is low because daily backups ensure data can be restored with minimal loss.

Question 14

A risk analyst at a regional bank is assessing the risk to its core banking platform. The analyst finds that the platform has a known vulnerability with a high exploitability score, but the platform is isolated on a segmented network with no external connectivity and strict change control. The analyst must determine the PRIMARY factor that reduces the likelihood of exploitation. Which factor should the analyst emphasize?

Accepted Answer

The network segmentation and lack of external connectivity. The likelihood of exploitation depends on both the vulnerability's characteristics and the threat actor's ability to reach the asset. Network segmentation and lack of external connectivity create a barrier that prevents or severely limits access, making exploitation unlikely even if the vulnerability is severe. The other factors either increase concern or provide indirect governance benefits but do not directly reduce the likelihood of a successful attack.

Answer

The bank's risk appetite statement

Answer

The strict change control process

Answer

The vulnerability's high exploitability score

Question 15

A global manufacturer is performing an IT risk assessment for its industrial control systems (ICS). The risk team is evaluating threat sources and wants to identify factors that INCREASE the likelihood of a threat event occurring. Which TWO of the following factors increase the likelihood of a threat event? (Choose two.)

Accepted Answer

A well-funded, motivated threat actor targeting the manufacturer's sector.. Likelihood of a threat event rises when exposure and adversary pressure increase. Numerous unpatched, internet-facing ICS components create exploitable pathways, and a well-funded, motivated actor targeting the sector raises both attempt frequency and success probability. Response planning, segmentation, and backup capability are controls that reduce impact or exposure, not factors that increase the chance of an event.

Answer

A mature backup and recovery capability with regularly tested restores.

Answer

A documented and tested incident response plan for OT environments.

Answer

Segmentation that isolates the ICS network from the corporate network.