CRISC Risk Response and Reporting Practice Test 10 — 15 Questions

Question 1

A quarterly risk report for the IT steering committee shows a key risk indicator (KRI) called 'patch lag' has increased from 15 days to 45 days. What does this trend most likely indicate?

Accepted Answer

Increased vulnerability risk. The patch lag KRI measures the time between a patch's release and its deployment. An increase from 15 to 45 days means systems are exposed to known vulnerabilities for a longer period, directly increasing the window of opportunity for exploitation. This trend indicates a worsening security posture and higher vulnerability risk.

Answer

No change in risk level

Answer

Improved security posture

Answer

Decreased vulnerability risk

Question 2

An organization is implementing a new control to address a high-risk finding. The project manager has scheduled a user training session and updated the relevant policies. Which implementation phase is being addressed?

Accepted Answer

Control implementation. These activities (training and documentation updates) are part of the control implementation phase, specifically after the control is designed and before going live.

Answer

Control monitoring

Answer

Risk assessment

Answer

Control design

Question 3

In a risk report presented to the board of directors, which of the following elements is most appropriate to include?

Accepted Answer

Risk heat map with top risks and status. A risk report to the board of directors should be strategic and concise, focusing on top risks and their status. A risk heat map with top risks and status provides an executive-level view that supports governance and decision-making without overwhelming the board with operational detail. This is the most appropriate element for a board audience.

Answer

Vendor security assessment scores for all vendors

Answer

Detailed weekly firewall log analysis

Answer

List of all IT incidents from the past month

Question 4

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

Provide early warning of changing risk levels. The primary purpose of a Key Risk Indicator (KRI) is to provide an early warning of changing risk levels, enabling proactive risk management before an adverse event occurs. KRIs track specific metrics that signal shifts in risk exposure, such as the number of unpatched critical vulnerabilities or failed login attempts, allowing organizations to adjust controls or resources in advance. This forward-looking function distinguishes KRIs from lagging indicators like control effectiveness metrics or incident logs.

Answer

Measure the effectiveness of controls

Answer

Document historical incidents

Answer

Comply with regulatory requirements

Question 5

An organization wants to promote a risk-aware culture. Which initiative best supports this goal?

Accepted Answer

Encouraging incident reporting without blame. Encouraging incident reporting without blame directly supports a risk-aware culture by removing the fear of punishment, which motivates employees to report issues promptly. This allows the organization to identify and respond to risks early, rather than hiding them, and aligns with the risk response principle of learning from incidents to improve controls.

Answer

Focusing only on technical controls

Answer

Limiting risk awareness training to IT staff

Answer

Punishing employees who cause security incidents

Question 6

In the context of ERM integration, IT risk is typically considered a subset of which broader risk category?

Accepted Answer

Operational risk. In Enterprise Risk Management (ERM) integration, IT risk is typically categorized as a subset of operational risk because it directly impacts the availability, integrity, and confidentiality of information systems and data, which are core operational assets. Operational risk encompasses failures in internal processes, people, and systems, and IT risk—such as system outages, data breaches, or software defects—falls squarely within this domain. This alignment is reinforced by frameworks like COSO and ISO 31000, which treat technology-related failures as operational risk events.

Answer

Strategic risk

Answer

Financial risk

Answer

Compliance risk

Question 7

Which TWO of the following are examples of continuous monitoring activities? (Select TWO.)

Accepted Answer

Continuous vulnerability scanning. Continuous vulnerability scanning (A) is correct because it runs on an ongoing, automated schedule to detect new weaknesses as they emerge, which is the defining characteristic of a continuous monitoring activity. Automated SIEM rule-based alerts for suspicious activity (D) is also correct because SIEM correlation rules evaluate event streams in real time and generate alerts continuously, providing ongoing detection rather than point-in-time assessment. By contrast, annual penetration testing (B) and quarterly user access reviews (C) are periodic, scheduled point-in-time activities, and monthly review of audit logs (E) is a recurring but interval-based manual review, so none of these qualify as continuous monitoring.

Answer

Annual penetration testing

Answer

Quarterly user access reviews

Answer

Monthly review of audit logs

Question 8

Which THREE of the following are essential components of an effective IT risk report to senior management? (Select THREE.)

Accepted Answer

Risk trend analysis over time. Option A (Risk trend analysis over time) is essential because senior management needs to see whether the organization's risk posture is improving, worsening, or stable across reporting periods, which supports strategic decisions rather than a single point-in-time snapshot. Option B (Risk heat map showing current risk levels) is correct because a heat map visually prioritizes risks by likelihood and impact, enabling executives to quickly grasp the current risk landscape and focus attention on the highest-exposure areas. Option D (List of top risks and their mitigation status) is correct because it tells leadership which risks matter most and whether remediation efforts are on track, directly supporting accountability and resource allocation. Option C is not essential because listing every third-party vendor with contract details is a procurement or vendor-management artifact, not a concise risk-reporting element for senior management. Option E is not essential because detailed control deficiency descriptions are operational-level detail better suited to audit or control-owner reports, whereas senior management needs aggregated, decision-oriented risk information.

Answer

Names of all third-party vendors with contracts

Answer

Detailed control deficiency descriptions

Question 9

Which TWO of the following are leading indicators that could be used as KRIs for information security risk? (Select TWO.)

Accepted Answer

Patch lag (average time to apply critical patches). Option C (patch lag, the average time to apply critical patches) is a leading indicator because it measures an exposure window that predicts future compromise likelihood — the longer critical patches remain unapplied, the greater the chance an attacker exploits a known CVE — so it signals risk before incidents occur. Option D (a spike in failed authentication attempts) is a leading indicator because it reflects anomalous activity such as brute-force or credential-stuffing attempts that typically precede a breach, giving early warning of an imminent attack. The unmarked options are lagging or outcome metrics: A (number of security incidents in the past quarter) and B (number of audit findings from the last audit) both report events that have already happened, and E (percentage of employees who completed security awareness training) is a compliance/training completion metric rather than a predictive signal of attack activity.

Answer

Number of security incidents in the past quarter

Answer

Number of audit findings from the last audit

Answer

Percentage of employees who completed security awareness training

Question 10

An organization is selecting a control to reduce the risk of unauthorized data exfiltration. The annual loss expectancy (ALE) for this risk is currently $500,000. The proposed control costs $80,000 annually and is expected to reduce the ALE by 60%. What is the net benefit (reduction in risk exposure minus control cost) of implementing this control?

Accepted Answer

$220,000. The current ALE is $500,000. A 60% reduction lowers the ALE by $300,000 (0.60 × $500,000). The net benefit is the reduction in risk exposure ($300,000) minus the annual control cost ($80,000), resulting in $220,000. This calculation directly measures the residual risk reduction against the cost of the control, a key concept in cost-benefit analysis for risk response.

Answer

$420,000

Answer

$300,000

Answer

$120,000

Question 11

A risk manager is evaluating a control that addresses a high-risk finding from an internal audit. Which of the following is the MOST important factor in determining whether the control is effective?

Accepted Answer

Key control indicators (KCIs) such as control deficiency rate and test results. B is correct because the effectiveness of a control is determined by its ability to reduce risk to an acceptable level, which is directly measured by key control indicators (KCIs) such as the control deficiency rate and test results. These metrics provide empirical evidence of whether the control is operating as intended and mitigating the identified high-risk finding. Without such performance data, any assessment of effectiveness is speculative.

Answer

The vendor's reputation for providing reliable security solutions

Answer

The cost of the control relative to the asset value

Answer

The control's alignment with industry best practices

Question 12

An organization has implemented a new firewall rule to block malicious IP addresses. This is an example of which type of control?

Accepted Answer

Preventive control. A firewall rule that blocks malicious IP addresses is a preventive control because it proactively stops unauthorized traffic before it can reach the internal network. By filtering packets based on source IP addresses, the firewall enforces access control policies at the network layer, preventing potential attacks from ever being initiated. This aligns with the CRISC definition of preventive controls, which are designed to avoid or deter undesirable events.

Answer

Directive control

Answer

Corrective control

Answer

Detective control

Question 13

During a quarterly risk review, the CISO notes that the number of failed authentication attempts has increased by 300% over the last month. The IT team confirms no changes to authentication systems. This metric is BEST categorized as which of the following?

Accepted Answer

Key Risk Indicator (KRI). A Key Risk Indicator (KRI) is a metric used to signal a change in risk exposure. A 300% increase in failed authentication attempts, with no changes to the authentication system, strongly indicates a potential ongoing brute-force attack or credential stuffing campaign, directly elevating the risk of unauthorized access. This metric is not measuring performance (KPI), contractual service levels (SLA), or the effectiveness of a specific control (KCI), but rather a change in the risk landscape.

Answer

Key Performance Indicator (KPI)

Answer

Service Level Agreement (SLA) metric

Answer

Key Control Indicator (KCI)

Question 14

A company is implementing a new access control system. According to the project plan, user training will be delivered after the system goes live. What change management issue does this present?

Accepted Answer

Training after go-live may lead to user errors and security incidents. Training should ideally be delivered before go-live to ensure users can operate the system securely. Delaying training increases the risk of errors and security incidents.

Answer

Training after go-live ensures the system is fully operational

Answer

Training after go-live is more effective because users have context

Answer

Training after go-live reduces the project budget

Question 15

An IT risk report to the board of directors should primarily focus on which of the following?

Accepted Answer

Strategic risks and risk trends affecting the organization. The board of directors requires a high-level view of IT risk that aligns with business strategy and enterprise risk management. Strategic risks and risk trends provide the necessary context for informed decision-making, focusing on the aggregate impact of risk on organizational objectives rather than operational minutiae.

Answer

Specific control test results for each system

Answer

Vendor risk assessment scores for all third parties

Answer

Detailed weekly operational incidents