CRISC Risk Response and Reporting Practice Test 1 — 15 Questions

Question 1

An IT risk manager is preparing a quarterly risk report for the CISO. Which type of reporting structure does this represent?

Accepted Answer

Tactical risk reporting. Tactical risk reporting sits between operational (day-to-day) and strategic (long-term, board-level) reporting. A quarterly report to the CISO summarizing risk posture, treatment progress, and emerging issues is a tactical artifact — it supports medium-term decision-making by security leadership. This is the standard CRISC classification.

Answer

Executive risk reporting

Answer

Operational risk reporting

Answer

Strategic risk reporting

Question 2

A vendor is classified as 'critical' based on its access to sensitive data and the criticality of its service. According to best practices, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor because it provides independent attestation that controls operated effectively over a period (typically 6-12 months), covering security, availability, and confidentiality. For vendors with sensitive data access, Type II evidence of sustained control operation is essential.

Answer

Annual self-assessment questionnaire

Answer

Penetration test results from the vendor

Answer

ISO 27001 certificate

Question 3

Which risk reporting frequency is most appropriate for tactical risk reporting to the CISO/CIO?

Accepted Answer

Quarterly. Tactical risk reporting to senior executives like the CISO/CIO is typically done quarterly, aligning with governance cycles and providing enough time to aggregate meaningful trends without overwhelming leadership with operational detail. Quarterly reporting supports strategic oversight while monthly or weekly cadence is reserved for operational or management-level reporting.

Answer

Weekly

Answer

Monthly

Answer

Annually

Question 4

An organization is designing a vendor risk management program. Which TWO of the following are essential components of ongoing vendor monitoring? (Select TWO)

Accepted Answer

Continuous monitoring via shared threat intelligence platforms. Option D is correct because continuous monitoring through shared threat intelligence platforms enables real-time visibility into a vendor's security posture, allowing the organization to detect emerging vulnerabilities, breaches, or changes in the vendor's risk profile as they occur rather than waiting for periodic reviews. Option E is correct because annual reassessment of vendor risk ensures that the vendor's security controls, financial stability, and compliance status are re-evaluated on a recurring basis, which is a core requirement of ongoing monitoring programs such as those aligned with ISO 27001, NIST SP 800-161, or SOC 2 vendor management criteria. Option A is not an ongoing monitoring activity; contract terms are reviewed during procurement, renewal, or legal review cycles, not as part of continuous or periodic risk monitoring. Option B is incorrect because penetration testing performed by the vendor is a point-in-time assurance activity, not a monitoring component, and it does not provide the organization with ongoing visibility into the vendor's risk. Option C is incorrect because an initial onboarding security questionnaire is a one-time due diligence step performed before or at the start of the relationship, not an ongoing monitoring activity.

Answer

Review of contract terms

Answer

Penetration testing by the vendor

Answer

Initial onboarding security questionnaire

Question 5

Which THREE of the following are common elements of a periodic control effectiveness testing program? (Select THREE)

Accepted Answer

Quarterly control testing by the risk function. Option B is correct because a periodic control effectiveness testing program typically schedules recurring tests — such as quarterly — performed by the risk or compliance function to verify that controls operate as designed over time. Option D is correct because internal audit independently reviews and tests controls as part of its assurance role, providing objective evaluation of control design and operating effectiveness. Option E is correct because annual penetration testing is a recurring, scheduled assessment that validates the effectiveness of technical and preventive controls against real-world attack techniques. Option A does not belong because user training is a control-awareness or personnel control itself, not a method of testing whether controls are effective. Option C does not belong because continuous monitoring via SIEM is an ongoing detective control and monitoring capability, not a periodic control effectiveness testing activity.

Answer

User training on new controls

Answer

Continuous monitoring via SIEM

Question 6

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). An Intrusion Detection System (IDS) is a classic detective control because it monitors network or host activity and alerts on suspicious or malicious behavior after it occurs. It does not prevent the activity—it detects and reports it, which is the defining characteristic of a detective control.

Answer

Backup and recovery plan

Answer

Firewall

Answer

Data encryption

Question 7

Which of the following is a leading indicator that the risk of a credential-based attack may be increasing?

Accepted Answer

Failed authentication spike. A failed authentication spike is a leading indicator because it directly signals an increase in attempted unauthorized access, often from credential stuffing or brute-force attacks. Unlike lagging indicators that measure past incidents, this metric provides early warning that the risk of a credential-based attack is rising, allowing proactive controls like account lockout policies or CAPTCHA challenges to be implemented before a breach occurs.

Answer

Increased number of successful logins

Answer

Low patch compliance

Answer

High mean time to resolve incidents

Question 8

An organization is implementing a new control to address a high-risk vulnerability. Which TWO factors are MOST important to consider during the control implementation planning phase?

Accepted Answer

Resource requirements. Option C (Resource requirements) is correct because during control implementation planning you must determine the budget, staffing, time, and technology needed to deploy the control effectively; without adequate resources the control cannot be implemented as designed. Option D (Control implementation plan) is correct because a formal plan defines the scope, steps, responsibilities, timeline, and success criteria for rolling out the control, ensuring the high-risk vulnerability is actually mitigated. Vendor reputation (A) is a procurement consideration but not a core planning factor for implementation itself. Industry best practices (B) inform control selection and design rather than the implementation planning phase. The number of previous incidents (E) is a risk-assessment input, not a primary factor in planning how to implement the chosen control.

Answer

Vendor reputation

Answer

Industry best practices

Answer

Number of previous incidents

Question 9

A third-party vendor has been tiered as 'high risk' due to access to sensitive customer data. The vendor's SOC 2 Type II report has a qualified opinion on security controls. The vendor risk appetite requires unqualified SOC 2 Type II for critical vendors. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to remediate the issues and provide an updated report within a defined timeframe. If a vendor does not meet the minimum security requirements for its tier, and the organization cannot accept the risk, the appropriate response is to remediate by requiring the vendor to address the qualification or find an alternative vendor that meets the requirements.

Answer

Accept the qualified report and continue monitoring

Answer

Implement additional compensating controls on the organization's side

Answer

Downgrade the vendor to medium risk tier

Question 10

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). Detective controls identify incidents after they occur. An intrusion detection system (IDS) monitors network traffic and alerts on suspicious activity, making it a detective control.

Answer

Firewall

Answer

Backup and recovery procedure

Answer

Data encryption

Question 11

A risk practitioner is developing a tactical risk report for the CISO. Which TWO of the following elements should be included in the report? (Select TWO)

Accepted Answer

Control performance metrics. A tactical risk report is short-term and operational, so it should include control performance metrics (D), because these show how effectively current controls are functioning and whether remediation is on track, which the CISO needs for near-term decisions. It should also include top risks and their status (E), since a tactical report prioritizes the most significant current exposures and tracks their treatment progress. Long-term risk trend analysis (A) is strategic rather than tactical, as it looks at multi-period patterns to inform long-range planning. Detailed log analysis from SIEM (C) is far too granular and technical for a CISO-level report, and a risk heat map (B) is typically a strategic or board-level visualization rather than a tactical reporting element.

Answer

Long-term risk trend analysis

Answer

Risk heat map

Answer

Detailed log analysis from SIEM

Question 12

Which TWO of the following are examples of continuous monitoring techniques for IT controls? (Select TWO)

Accepted Answer

Continuous SIEM monitoring for security alerts. Option B is correct because continuous SIEM monitoring for security alerts provides real-time, automated collection and correlation of event data, enabling ongoing detection of control failures or security incidents as they occur. Option C is correct because weekly vulnerability scanning of critical systems is a recurring, automated technique that continuously identifies new weaknesses and verifies that remediation controls remain effective over time. By contrast, option A (quarterly internal audit reviews) and option D (annual penetration testing) are periodic point-in-time assessments rather than continuous monitoring. Option E (monthly manual log review) is also periodic and manual, so it lacks the automated, ongoing nature required for continuous monitoring.

Answer

Quarterly internal audit reviews

Answer

Annual penetration testing

Answer

Monthly manual log review

Question 13

A third-party vendor has been assessed as high risk due to its access to sensitive data. Which TWO ongoing monitoring activities are most appropriate for this vendor? (Select two.)

Accepted Answer

Monthly conference calls with vendor management. Option B (Monthly conference calls with vendor management) is correct because recurring governance touchpoints provide an ongoing, relationship-based mechanism to review the vendor's risk posture, discuss incidents, and verify that contractual security obligations are still being met for a high-risk vendor. Option D (Continuous monitoring via threat intelligence sharing platforms) is correct because automated, real-time feeds of threat and vulnerability intelligence allow the organization to detect emerging risks affecting the vendor's environment as they arise, which is proportionate to a high-risk designation. Option A is not appropriate as a primary control because daily manual log review is operationally unsustainable and does not scale to third-party environments the organization does not own. Option C is insufficient on its own since an annual reassessment is periodic rather than ongoing and would leave long blind spots for a high-risk vendor. Option E is incorrect because a single onboarding assessment is a point-in-time activity and provides no ongoing monitoring at all.

Answer

Daily manual review of vendor logs

Answer

Annual reassessment of security controls

Answer

Single initial onboarding assessment

Question 14

During a cost-benefit analysis for a proposed control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce the ALE to $100,000. The control implementation cost is $150,000, and the annual operating cost is $30,000. What is the net annual benefit of the control?

Accepted Answer

$220,000. The net annual benefit is calculated as the reduction in ALE minus the annual operating cost and the implementation cost (treated as an annual cost for this calculation). The reduction in ALE is $500,000 - $100,000 = $400,000. Subtracting the annual operating cost of $30,000 gives $370,000, then subtracting the implementation cost of $150,000 yields $220,000.

Answer

$400,000

Answer

$370,000

Answer

$250,000

Question 15

An organization is implementing a new access control system. Which of the following is the most important activity to ensure the control is effectively integrated into operations?

Accepted Answer

Updating relevant documentation. Updating relevant documentation ensures that the new access control system's configuration, operational procedures, and troubleshooting steps are formally recorded and accessible to the operations team. Without accurate documentation, the control cannot be consistently maintained, monitored, or recovered during incidents, making it ineffective in day-to-day operations. This activity directly integrates the control into the operational lifecycle by providing a single source of truth for administrators.

Answer

Assigning control ownership

Answer

Performing a cost-benefit analysis

Answer

Conducting a post-implementation review