CRISC IT Risk Assessment Practice Test 12 — 15 Questions

Question 1

A risk practitioner is reviewing the risk register and notices that several risks have not been reassessed in over a year. The business environment has changed significantly due to a new regulation. What is the PRIMARY reason the practitioner should escalate this issue to the risk committee?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The risk register may no longer reflect the current risk landscape, leading to ineffective risk treatment decisions.. The core issue is that unreviewed risks may no longer be valid after a significant regulatory change. A stale risk register can lead to incorrect treatment priorities and resource allocation. Escalating to the risk committee ensures that reassessment is prioritized and that risk responses are realigned with the new environment, maintaining the effectiveness of risk management.

Answer

The risk owners have failed to perform their assigned duties, which is a performance management issue.

Answer

The risk committee is required by regulation to meet at least quarterly to review all risks.

Answer

The risk assessment methodology itself is flawed and must be replaced with a quantitative approach.

Question 2

A risk practitioner is assessing a new e-commerce platform. The business owner insists that the platform must be available 24/7. The practitioner identifies that a distributed denial-of-service (DDoS) attack could cause an outage. Which of the following BEST describes the risk scenario?

Accepted Answer

A threat event (DDoS attack) exploiting a vulnerability (inadequate DDoS protection) leading to an impact (loss of availability). A well-formed risk scenario describes a threat event exploiting a vulnerability to produce an impact on business objectives. The DDoS attack is the threat, inadequate DDoS protection is the vulnerability, and loss of availability is the impact. This structure supports consistent risk assessment and treatment planning, and it directly connects to the business owner's availability requirement.

Answer

A risk that is inherent to the e-commerce platform and cannot be mitigated, so it must be accepted

Answer

A control failure (lack of DDoS protection) that directly causes a financial loss without any threat event

Answer

A vulnerability (DDoS attack) causing a threat event (inadequate DDoS protection) resulting in a loss of confidentiality

Question 3

A hospital's IT risk register lists a risk that its medical imaging archive could become unavailable. The risk owner has documented the risk, set a review date, and decided to take no action because the potential impact is within the hospital's risk appetite. Which risk treatment option has the risk owner selected?

Accepted Answer

Risk acceptance. Formal risk acceptance occurs when an organization decides to retain a risk because it falls within the defined risk appetite, while documenting the decision, assigning an owner, and scheduling periodic review. The hospital's actions match this pattern precisely. Mitigation would add controls, avoidance would remove the activity, and transfer would shift the impact to a third party; none of those occurred, so acceptance is the correct characterization.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 4

A retail company is conducting a risk assessment for its point-of-sale (POS) systems. The risk team determines that the inherent risk of a malware attack is high. The company implements endpoint detection and response (EDR) tools and network segmentation. After these controls, the risk is re-evaluated. What is this re-evaluated risk called?

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls are implemented. In this scenario, the company applied EDR and network segmentation to reduce the high inherent risk of malware. The re-evaluated risk is the residual risk, which should be compared to the organization's risk appetite to determine if further action is needed.

Answer

Control risk

Answer

Detection risk

Answer

Inherent risk

Question 5

An IT risk manager is reviewing the risk register and finds that the same database server appears in three separate risk entries: one for unauthorized access, one for data corruption, and one for denial of service. What is the PRIMARY benefit of structuring the register this way rather than combining all three into a single entry?

Accepted Answer

It allows each risk to be assessed and treated based on its distinct threat, vulnerability, and impact.. Separate risk entries preserve the distinct threat, vulnerability, and impact characteristics of each scenario affecting the database server. This granularity enables accurate likelihood and impact ratings, targeted control selection, and clear ownership. Combining unrelated scenarios into one entry would obscure which threat drives which consequence and would make it difficult to measure whether a specific control reduced the risk it was meant to address.

Answer

It reduces the total number of controls that must be implemented.

Answer

It eliminates the need to reassess the risks during the next assessment cycle.

Answer

It guarantees that the risk register will align with the organization's risk appetite.

Question 6

A retail company is assessing the risk of a point-of-sale (POS) system compromise. The risk team estimates that a successful attack would cost $500,000 in fines, remediation, and lost sales. The likelihood of such an attack in the next year is estimated at 20%. What is the annualized loss expectancy (ALE) for this risk scenario?

Accepted Answer

$100,000. The annualized loss expectancy is computed by multiplying the single loss expectancy by the annualized rate of occurrence. With a $500,000 impact and a 20% annual likelihood, the expected annual loss is $100,000. This quantitative result allows the organization to compare the cost of potential controls against the expected loss and to prioritize the POS risk against other risks in the risk register.

Answer

$20,000

Answer

$500,000

Answer

$2,500,000

Question 7

An e-commerce company is conducting an IT risk assessment for its order management system. The risk team has identified a risk that the system could fail during peak holiday traffic, causing revenue loss. The team needs to estimate the potential financial impact of this event to inform treatment decisions. Which activity is the team performing?

Accepted Answer

Risk analysis. After a risk is identified, risk analysis evaluates its likelihood and potential impact. The team has already named the peak-traffic failure risk and is now estimating its financial consequence, which is impact analysis within the broader risk analysis step. This estimation supports informed risk response decisions, such as investing in capacity or redundancy for the order management system.

Answer

Risk identification

Answer

Risk response

Answer

Risk monitoring

Question 8

A multinational manufacturer is assessing the risk of a ransomware attack on its operational technology (OT) network. The risk team has identified that the OT network is segmented from the corporate IT network, but a shared jump server allows administrators to move between them. The team must determine the MOST significant factor that could increase the likelihood of ransomware spreading from IT to OT. Which factor should they prioritize?

Accepted Answer

The presence of the shared jump server. The shared jump server acts as a bridge between the segmented IT and OT networks. If ransomware compromises the IT environment, the jump server provides a direct path to the OT network, effectively negating the segmentation. This makes it the most significant factor increasing the likelihood of cross-network spread. Other factors like legacy systems and missing antivirus affect impact or vulnerability but do not create the initial pathway.

Answer

The lack of antivirus software on OT endpoints

Answer

The frequency of security awareness training for IT staff

Answer

The OT network's use of legacy operating systems

Question 9

A risk practitioner is reviewing the results of a risk assessment and needs to determine the risk level for a series of identified risks. The organization uses a risk matrix with likelihood and impact scales. Which of the following is the PRIMARY purpose of determining the risk level?

Accepted Answer

To prioritize risks for treatment and allocate resources effectively. Determining risk level via likelihood and impact allows the organization to rank risks and focus attention and resources on the most significant ones. This prioritization is essential for effective risk treatment and for aligning risk management with business objectives and risk appetite.

Answer

To document the risk register for audit purposes only

Answer

To eliminate all risks that are above the organization's risk appetite

Answer

To calculate the exact financial loss from each risk

Question 10

A retail company is conducting an IT risk assessment for its point-of-sale (POS) system. The risk team has identified several threats, including malware, insider theft, and denial-of-service (DoS) attacks. The company currently uses antivirus software, firewalls, and role-based access controls. Which TWO of the following are the MOST appropriate risk response actions to address the identified threats? (Choose two.)

Accepted Answer

Conduct regular security awareness training for employees handling POS transactions.. Network segmentation and security awareness training are the most appropriate risk response actions because they directly mitigate the identified threats. Segmentation reduces the attack surface and limits lateral movement, while training addresses human-related risks like insider theft and phishing. These are preventive controls that reduce likelihood and impact. The other options either transfer risk without reducing it or focus on recovery rather than addressing the threats themselves.

Answer

Outsource POS management to a third-party service provider.

Answer

Increase the backup frequency for POS transaction logs.

Answer

Purchase cyber insurance to transfer the financial impact of a data breach.

Question 11

A global investment firm maintains a central risk register. The CISO wants to reduce the number of entries by consolidating risks that share the same root cause. Which action BEST supports this goal while preserving the risk register's integrity?

Accepted Answer

Create a parent risk for each shared root cause and link the related risk entries as sub-risks, retaining their individual details.. Consolidating by shared root cause is best achieved with a parent-child hierarchy that preserves the details of each underlying risk. This keeps likelihood, impact, ownership, and treatment traceable while reducing clutter at the top level. Deleting, relocating, or asset-merging entries sacrifices granularity, auditability, or aggregation insight, none of which preserves the register's integrity.

Answer

Group risks by the asset they affect and merge them into a single risk statement per asset.

Answer

Move all low-rated risks to a separate spreadsheet outside the central register.

Answer

Delete duplicate entries and rely on the risk owner's memory to recall the original context.

Question 12

A multinational retailer operates point-of-sale terminals in 30 countries. During an IT risk assessment, the risk analyst notes that a single compromised terminal could expose payment card data across multiple jurisdictions, each with different breach notification laws. The CISO asks the analyst to determine the MOST appropriate risk metric to communicate this exposure to the board. Which of the following should the analyst use?

Accepted Answer

The annualized loss expectancy for a payment card data breach scenario. Board-level risk communication requires a metric that integrates likelihood and business impact. Annualized loss expectancy does this by multiplying event frequency by expected loss per event, capturing regulatory penalties, notification costs, and remediation expenses that vary across 30 jurisdictions. Technical indicators such as CVSS scores, patch counts, and unsupported-OS percentages describe control state or vulnerability severity but omit consequence and frequency, making them unsuitable for expressing enterprise exposure.

Answer

The CVSS base score of the vulnerability present on the point-of-sale terminals

Answer

The percentage of terminals running an unsupported operating system

Answer

The number of unpatched vulnerabilities on point-of-sale terminals

Question 13

A software development company is assessing risks related to its cloud infrastructure. The risk team uses a qualitative approach and creates a risk register. During a review, the team notices that a risk related to unauthorized access to customer data has a likelihood rating of 4 (on a 5-point scale) and an impact rating of 5. The risk owner decides to implement multi-factor authentication (MFA) and role-based access control (RBAC). After implementation, the likelihood rating is reduced to 2, while impact remains 5. What is the PRIMARY purpose of updating the risk register with these new ratings?

Accepted Answer

To reflect the current risk posture and support risk-based decision making. The risk register is a living document that should be updated to reflect changes in risk levels after controls are implemented. Updating the ratings provides an accurate view of residual risk, which supports prioritization, resource allocation, and risk-based decision making. While compliance and audit are important, they are not the primary purpose of the update.

Answer

To satisfy regulatory requirements for risk documentation

Answer

To document the cost of the controls implemented

Answer

To provide evidence for the internal audit team

Question 14

A healthcare provider is conducting a risk assessment for its electronic health record (EHR) system. The risk team has identified that a recent upgrade introduced a new vulnerability that could allow unauthorized access to patient data. The vulnerability has a known exploit but no patch is available yet. The team must decide on the BEST immediate risk response. What should they do FIRST?

Accepted Answer

Implement a compensating control such as enhanced monitoring and network isolation. When a vulnerability has a known exploit and no patch is available, the best immediate response is to implement compensating controls that reduce exposure. Enhanced monitoring can detect exploitation attempts, and network isolation can limit access. This approach allows the organization to continue operating while mitigating risk. Acceptance, transfer, or avoidance are either inappropriate or impractical in this context.

Answer

Accept the risk because the EHR system is critical to patient care

Answer

Avoid the risk by shutting down the EHR system

Answer

Transfer the risk by purchasing cyber insurance

Question 15

A risk practitioner is assessing a cloud-hosted payroll application. The vendor's SOC 2 report shows effective controls, but the report covers only the period ending eight months ago, and the vendor has since migrated to a new hosting region. The practitioner needs to determine whether the control environment can still be relied upon. Which of the following is the MOST appropriate next step?

Accepted Answer

Request the vendor's bridge letter and updated SOC 2 report covering the new region, and review the gap period.. Third-party attestation evidence must be current and must cover the environment actually in use. A bridge letter closes the gap between the report period and today, while an updated SOC 2 report covering the new hosting region addresses the changed infrastructure. Together they allow the practitioner to judge whether reliance remains justified, which is the essential next step before deciding on any treatment action.

Answer

Perform a full penetration test of the payroll application to validate the vendor's controls.

Answer

Accept the SOC 2 report as sufficient evidence because the controls were independently audited.

Answer

Terminate the vendor relationship and migrate payroll to an internally managed platform.