CRISC IT Risk Assessment Practice Test 13 — 15 Questions

Question 1

A financial services firm is conducting an IT risk assessment on a legacy trading application. The assessment team wants to prioritize risks based on the combination of the likelihood of a threat event and the magnitude of its impact. The firm has limited resources and needs to focus on the most significant risks first. Which of the following BEST describes the purpose of using a risk map (heat map) in this context?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To provide a visual representation of risks based on their likelihood and impact, helping to prioritize risk response efforts.. A risk map (heat map) is a qualitative tool that plots risks on a matrix of likelihood and impact, enabling the firm to visually identify and prioritize the most significant risks. This is particularly useful when resources are limited, as it helps focus attention on high-priority areas. It does not calculate exact losses, replace detailed assessment, or directly measure control effectiveness, but it supports communication and prioritization.

Answer

To calculate the exact annualized loss expectancy (ALE) for each identified risk.

Answer

To eliminate the need for a detailed risk assessment by providing a quick overview.

Answer

To determine the effectiveness of existing controls by comparing inherent and residual risk.

Question 2

A risk practitioner is reviewing the risk register for a cloud-based customer relationship management (CRM) system. The register contains several entries, and the practitioner must identify which entries represent inherent risk rather than residual risk. Which two of the following entries are examples of inherent risk? (Choose two.)

Accepted Answer

The CRM system stores customer personally identifiable information, and a breach could result in regulatory fines.. Inherent risk is the level of risk before any controls are applied. The entry about the hurricane-prone data center with no redundancy and the entry about storing personally identifiable information with potential regulatory fines both describe raw exposures without reference to mitigating controls. The other entries mention implemented controls, control effectiveness reports, or recovery plans, which relate to residual risk after treatment.

Answer

The vendor's SOC 2 report shows no exceptions, and the risk is considered acceptable.

Answer

The organization has a disaster recovery plan that is tested annually and meets recovery objectives.

Answer

After implementing multi-factor authentication and encryption, the likelihood of unauthorized access is rated low.

Question 3

A hospital's risk team is assessing a new telehealth platform. The vendor reports that its encryption module was certified two years ago. The team wants to determine whether the residual risk of relying on that module is acceptable. Which action should the team take FIRST?

Accepted Answer

Request the vendor's current vulnerability scan results and patch history for the module.. Residual risk must be judged from current evidence about control effectiveness. An older certification says little about whether the encryption module still blocks today's exploits. Obtaining up-to-date scan results and patch records gives the team the factual basis to determine whether the remaining exposure is tolerable, which is the necessary first step before any treatment decision.

Answer

Immediately terminate the vendor contract because the certification is expired.

Answer

Accept the vendor's certification as sufficient evidence and close the risk.

Answer

Re-rate the inherent risk to zero because encryption is in place.

Question 4

A risk practitioner is facilitating a risk assessment workshop for a new cloud-based HR system. The team is identifying threats. Which TWO of the following are examples of threat events that should be considered? (Choose two.)

Accepted Answer

A natural disaster causing a cloud data center outage. Threat events are occurrences or actions that can cause harm, such as a malicious insider exfiltrating data or a natural disaster causing an outage. Vulnerabilities like unpatched software, lack of encryption, or inadequate training are conditions that threats may exploit. Distinguishing between threats and vulnerabilities is essential for accurate risk scenarios.

Answer

An unpatched web server software vulnerability

Answer

Lack of encryption for data at rest

Answer

Inadequate security awareness training for employees

Question 5

An enterprise risk analyst is aggregating risk data from three business units that each used a different likelihood scale: Unit A used a 1-3 scale, Unit B used a 1-5 scale, and Unit C used a 1-10 scale. Before consolidating results into the enterprise risk register, which action BEST ensures the aggregated risk ratings remain meaningful for management reporting?

Accepted Answer

Recalculate each unit's ratings into a single common likelihood scale and document the normalization criteria used.. Aggregating risk across business units requires a common measurement basis; otherwise, comparisons and totals are artifacts of differing scales. Mapping each unit's likelihood onto one defined enterprise scale, with documented conversion criteria, produces ratings that are comparable, auditable, and defensible to management and auditors. Averaging or weighting raw incompatible scores does not fix the underlying scale mismatch.

Answer

Multiply each unit's likelihood score by its asset count to weight the ratings before consolidation.

Answer

Discard the two units using narrower scales and report only the unit using the 1-10 scale.

Answer

Average the raw numeric scores from all three units and report the mean as the enterprise likelihood value.

Question 6

A risk analyst is evaluating the effectiveness of the organization's existing control environment for a newly identified risk involving unauthorized access to a human resources database. Which TWO of the following activities would BEST help the analyst determine whether the current controls reduce the risk to an acceptable level? (Choose two.)

Accepted Answer

Analyzing security incident logs and access monitoring reports for the HR database over the past year.. Determining whether existing controls reduce risk to an acceptable level requires evidence of both design and operating effectiveness. Audit and penetration test results demonstrate whether safeguards withstand realistic threats, while incident logs and access monitoring reveal how detective and responsive controls perform against actual events over time. Perceptions, financial calculations, and register mapping do not test control performance, so they cannot support a defensible residual risk conclusion.

Answer

Interviewing the HR database administrator about the perceived strength of the database password policy.

Answer

Mapping the HR database to the organization's risk register and confirming the assigned risk owner.

Answer

Calculating the annualized loss expectancy of a hypothetical breach of the HR database.

Question 7

A risk practitioner is facilitating a risk assessment workshop for a new cloud-based customer relationship management (CRM) system. The business owner is eager to launch the system and states that the risk assessment is unnecessary because the cloud provider is ISO 27001 certified. Which of the following is the MOST appropriate response from the risk practitioner?

Accepted Answer

Explain that certification reduces some third-party risks but the organization must still assess its own risks and controls.. ISO 27001 certification provides assurance that the cloud provider has a robust security management system, but it does not eliminate the customer's responsibility to assess its own risks. The organization must still evaluate risks related to data integration, user access, configuration, and compliance. The risk practitioner should explain this shared responsibility model. Skipping the assessment or substituting it with a penetration test would be inappropriate.

Answer

Perform a penetration test instead of a risk assessment to satisfy security requirements.

Answer

Agree with the business owner and skip the risk assessment since the provider is certified.

Answer

Escalate the matter to senior management because the business owner is refusing to comply with policy.

Question 8

A healthcare organization is assessing the risk of a ransomware attack on its electronic health record (EHR) system. The risk assessment team has identified that the likelihood of an attack is high due to recent industry trends, and the impact would be severe, including patient safety risks and regulatory fines. The organization has a limited budget and wants to implement controls that provide the greatest risk reduction. Which of the following risk response strategies is MOST appropriate in this scenario?

Accepted Answer

Risk mitigation by implementing layered controls such as regular backups, employee training, and endpoint detection and response.. Risk mitigation is the most appropriate strategy because it reduces both the likelihood and impact of a ransomware attack through layered controls. Given the criticality of the EHR system and the severe consequences, simply transferring or accepting the risk would leave the organization vulnerable. Avoidance is impractical. Mitigation aligns with the need to protect patient safety and comply with regulations while operating within budget constraints.

Answer

Risk acceptance by documenting the risk and taking no action due to budget constraints.

Answer

Risk transfer by purchasing cyber insurance to cover all potential losses.

Answer

Risk avoidance by discontinuing the use of the EHR system.

Question 9

A multinational corporation is conducting a risk assessment for its third-party vendors. The risk team has assigned a high inherent risk rating to a vendor that provides critical payroll processing. The vendor has recently provided a SOC 2 Type II report with no exceptions, and the contract includes a right-to-audit clause. The risk practitioner must determine the residual risk rating. Which factor is MOST important in making this determination?

Accepted Answer

The scope of the SOC 2 Type II report relative to the payroll processing services.. The scope of the SOC 2 Type II report is the most important factor because it determines whether the independent assurance covers the systems, processes, and trust services criteria relevant to payroll processing. If the report's scope excludes critical controls or infrastructure, the high inherent risk remains largely unaddressed. The right-to-audit clause and vendor characteristics are secondary to understanding whether the controls that matter are actually tested and effective.

Answer

The presence of a right-to-audit clause in the contract.

Answer

The vendor's financial stability and length of time in business.

Answer

The number of other clients the vendor serves in the same industry.

Question 10

A risk practitioner is assessing the risk of a legacy application that supports a critical business process. The application vendor no longer provides security patches. The business cannot replace the application within the next 12 months due to budget constraints. Which of the following is the MOST appropriate risk treatment?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring, and document the risk with a time-bound acceptance. When a legacy application cannot be replaced immediately, the best treatment is to apply compensating controls to reduce risk while formally accepting the residual risk with a defined review period. This approach addresses the risk pragmatically and maintains alignment with business constraints and risk appetite.

Answer

Transfer the risk by purchasing cyber insurance and take no other action

Answer

Accept the risk without any additional controls because the business cannot afford to replace the application

Answer

Avoid the risk by immediately shutting down the legacy application

Question 11

A retail company is prioritizing risks for the coming year. Management wants to focus resources where the potential financial loss is greatest, but the risk team has only ordinal likelihood and impact ratings. Which approach BEST supports this prioritization?

Accepted Answer

Estimate a monetary loss range and annual frequency for each risk, then calculate expected annual loss.. To prioritize by greatest potential financial loss, the team needs a monetary measure. Estimating loss ranges and annual frequencies yields expected annual loss, which can be compared across risks and aggregated. Ordinal multiplication, alphabetical ordering, and subjective voting do not produce a reliable financial ranking, so they cannot guide resource allocation as effectively.

Answer

Ask each department head to vote on which risks feel most urgent.

Answer

Convert the ordinal ratings into a single composite score by multiplying likelihood rank by impact rank.

Answer

Rank risks alphabetically by asset name to ensure consistent ordering.

Question 12

A risk analyst is prioritizing remediation efforts across four identified risks. The analyst has likelihood and impact ratings but must also account for the speed at which each risk could materialize and the organization's ability to respond. Which concept is the analyst applying to adjust the prioritization?

Accepted Answer

Risk velocity. Risk velocity captures how fast a risk can produce impact, and it changes prioritization because a fast-moving risk leaves little time for detection and response. Two risks with identical likelihood and impact scores can require very different urgency when one unfolds over months and the other over minutes. Folding velocity and response capability into prioritization directs attention to the exposures where delay is most costly.

Answer

Risk appetite

Answer

Control maturity

Answer

Inherent risk

Question 13

A financial services firm is evaluating the risk of insider threat in its trading department. The risk team has identified that a small number of traders have elevated privileges that allow them to execute trades and access sensitive market data. The team must determine the MOST effective control to reduce the likelihood of unauthorized trading activity. Which control should they prioritize?

Accepted Answer

Enforcing separation of duties between trade execution and trade confirmation. Unauthorized trading often involves a single individual exploiting their privileges to execute and conceal trades. Separation of duties between trade execution and confirmation ensures that at least two people are involved in the process, making it much harder for one person to conduct unauthorized activity without detection. This preventive control directly reduces the likelihood of the risk. Other controls may help but are less direct or timely.

Answer

Increasing the number of security cameras in the trading floor

Answer

Conducting regular background checks on all traders

Answer

Implementing mandatory vacation and job rotation policies

Question 14

A risk practitioner is assessing a customer-facing API that processes payment tokens. The team has documented the threat community, the vulnerability, and the potential loss magnitude, but the assessment stalls because no one can agree on how often the threat would realistically attempt exploitation. Which factor is the practitioner attempting to establish to complete this scenario-based risk analysis?

Accepted Answer

Threat event frequency, describing how often the threat community is expected to act against the asset.. Scenario-based analysis needs a frequency dimension to convert an identified vulnerability and loss magnitude into a risk estimate. The team has the threat community, the vulnerability, and the loss exposure; the unresolved question of how often exploitation would be attempted is the threat event frequency. Without it, no defensible risk calculation or prioritization can be completed.

Answer

Control effectiveness rating for the compensating controls already deployed around the API.

Answer

Asset criticality tier assigned by the business owner based on revenue dependency.

Answer

Residual risk level remaining after the current control set is applied to the API.

Question 15

A risk manager is documenting the results of an IT risk assessment. She has identified the risk, analyzed its likelihood and impact, and evaluated existing controls. Which of the following should she do NEXT?

Accepted Answer

Determine the residual risk and compare it to the risk appetite.. The risk assessment process moves from identification to analysis to evaluation. After evaluating controls, the risk manager must calculate residual risk and compare it to risk appetite. This comparison determines whether the risk is acceptable or requires further treatment. It is the basis for risk response decisions and communication to governance bodies.

Answer

Report the inherent risk to the board of directors for acceptance.

Answer

Conduct a new threat modeling exercise to identify additional threats.

Answer

Implement additional controls to reduce the risk to zero.