CRISC Risk Response and Reporting Practice Test 10 — 15 Questions

Question 1

Which TWO of the following are leading indicators that could be used as KRIs for information security risk? (Select TWO.)

Accepted Answer

Patch lag (average time to apply critical patches). Patch lag (average time to apply critical patches) is a leading indicator that measures the organization's vulnerability exposure window before an exploit occurs. A shorter patch lag indicates proactive risk mitigation, while a longer lag signals increased risk of compromise, making it a forward-looking KRI for information security risk.

Answer

Number of security incidents in the past quarter

Answer

Number of audit findings from the last audit

Answer

Percentage of employees who completed security awareness training

Question 2

An organization is selecting a control to reduce the risk of unauthorized data exfiltration. The annual loss expectancy (ALE) for this risk is currently $500,000. The proposed control costs $80,000 annually and is expected to reduce the ALE by 60%. What is the net benefit (reduction in risk exposure minus control cost) of implementing this control?

Accepted Answer

$220,000. The current ALE is $500,000. A 60% reduction lowers the ALE by $300,000 (0.60 × $500,000). The net benefit is the reduction in risk exposure ($300,000) minus the annual control cost ($80,000), resulting in $220,000. This calculation directly measures the residual risk reduction against the cost of the control, a key concept in cost-benefit analysis for risk response.

Answer

$420,000

Answer

$300,000

Answer

$120,000

Question 3

A risk manager is evaluating a control that addresses a high-risk finding from an internal audit. Which of the following is the MOST important factor in determining whether the control is effective?

Accepted Answer

Key control indicators (KCIs) such as control deficiency rate and test results. B is correct because the effectiveness of a control is determined by its ability to reduce risk to an acceptable level, which is directly measured by key control indicators (KCIs) such as the control deficiency rate and test results. These metrics provide empirical evidence of whether the control is operating as intended and mitigating the identified high-risk finding. Without such performance data, any assessment of effectiveness is speculative.

Answer

The vendor's reputation for providing reliable security solutions

Answer

The cost of the control relative to the asset value

Answer

The control's alignment with industry best practices

Question 4

An organization has implemented a new firewall rule to block malicious IP addresses. This is an example of which type of control?

Accepted Answer

Preventive control. A firewall rule that blocks malicious IP addresses is a preventive control because it proactively stops unauthorized traffic before it can reach the internal network. By filtering packets based on source IP addresses, the firewall enforces access control policies at the network layer, preventing potential attacks from ever being initiated. This aligns with the CRISC definition of preventive controls, which are designed to avoid or deter undesirable events.

Answer

Directive control

Answer

Corrective control

Answer

Detective control

Question 5

During a quarterly risk review, the CISO notes that the number of failed authentication attempts has increased by 300% over the last month. The IT team confirms no changes to authentication systems. This metric is BEST categorized as which of the following?

Accepted Answer

Key Risk Indicator (KRI). A Key Risk Indicator (KRI) is a metric used to signal a change in risk exposure. A 300% increase in failed authentication attempts, with no changes to the authentication system, strongly indicates a potential ongoing brute-force attack or credential stuffing campaign, directly elevating the risk of unauthorized access. This metric is not measuring performance (KPI), contractual service levels (SLA), or the effectiveness of a specific control (KCI), but rather a change in the risk landscape.

Answer

Key Performance Indicator (KPI)

Answer

Service Level Agreement (SLA) metric

Answer

Key Control Indicator (KCI)

Question 6

A company is implementing a new access control system. According to the project plan, user training will be delivered after the system goes live. What change management issue does this present?

Accepted Answer

Training after go-live may lead to user errors and security incidents. Training should ideally be delivered before go-live to ensure users can operate the system securely. Delaying training increases the risk of errors and security incidents.

Answer

Training after go-live ensures the system is fully operational

Answer

Training after go-live is more effective because users have context

Answer

Training after go-live reduces the project budget

Question 7

An IT risk report to the board of directors should primarily focus on which of the following?

Accepted Answer

Strategic risks and risk trends affecting the organization. The board of directors requires a high-level view of IT risk that aligns with business strategy and enterprise risk management. Strategic risks and risk trends provide the necessary context for informed decision-making, focusing on the aggregate impact of risk on organizational objectives rather than operational minutiae.

Answer

Specific control test results for each system

Answer

Vendor risk assessment scores for all third parties

Answer

Detailed weekly operational incidents

Question 8

A risk owner is reviewing a control that has a deficiency rate of 15%. The target deficiency rate is less than 5%. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Investigate the root cause of the high deficiency rate. A deficiency rate of 15% against a target of less than 5% indicates a control failure that requires immediate remediation. Investigating the root cause is the first step in the risk response process to identify why the control is failing and to determine the appropriate corrective action, aligning with the Risk Response and Reporting domain's emphasis on addressing control deficiencies before considering acceptance or reporting.

Answer

Increase the target deficiency rate to 15%

Answer

Report the deficiency to the external auditor

Answer

Accept the risk and document the decision

Question 9

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

Accepted Answer

Provides real-time detection of security events. Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Answer

Reduces the need for security staff

Answer

Is less expensive than periodic testing

Answer

Eliminates all false positives

Question 10

In a risk-aware culture, which of the following behaviors is MOST encouraged?

Accepted Answer

Reporting security incidents without fear of blame. In a risk-aware culture, the primary goal is to encourage transparency and continuous improvement in risk management. Reporting security incidents without fear of blame (Option D) is most encouraged because it enables timely detection, analysis, and remediation of threats, directly supporting the Risk Response and Reporting domain by fostering an environment where incidents are escalated promptly rather than concealed.

Answer

Focusing only on compliance requirements

Answer

Assigning blame to individuals for security breaches

Answer

Hiding minor incidents to maintain performance metrics

Question 11

A vendor risk tier is assigned based on data access and service criticality. A vendor that processes sensitive customer data and is critical to operations should be classified as which tier?

Accepted Answer

Critical tier. A vendor that processes sensitive customer data and is critical to operations poses the highest level of risk to the organization. Under the CRISC framework, such a vendor is classified as Critical tier because the combination of high data sensitivity and operational criticality requires the most stringent risk management controls, including enhanced due diligence, continuous monitoring, and contractual safeguards. This tier ensures that the highest priority vendors receive the most rigorous oversight to mitigate potential impacts on confidentiality, integrity, and availability.

Answer

High tier

Answer

Low tier

Answer

Medium tier

Question 12

An organization uses a KRI that tracks the average time to patch critical vulnerabilities. The metric has been increasing over the past three months. What does this indicate from a risk perspective?

Accepted Answer

The risk of exploitation is increasing. An increasing average time to patch critical vulnerabilities indicates that the organization is taking longer to remediate known security weaknesses. From a risk perspective, this directly increases the window of exposure, making it more likely that an attacker will exploit a vulnerability before a patch is applied. Therefore, the risk of exploitation is increasing.

Answer

The control effectiveness is improving

Answer

The risk appetite has been reduced

Answer

The risk of exploitation is decreasing

Question 13

Which of the following is the PRIMARY purpose of integrating IT risk reporting into the enterprise risk management (ERM) program?

Accepted Answer

To provide a holistic view of risk across the organization. Integrating IT risk reporting into the ERM program provides a holistic view of risk across the organization by aligning IT-specific risks with strategic, operational, and compliance risks. This integration ensures that decision-makers can prioritize and respond to risks based on their aggregate impact, rather than treating IT risks in isolation. The primary purpose is to enable a unified risk posture that supports enterprise-wide governance and resource allocation.

Answer

To reduce the frequency of IT risk reporting

Answer

To eliminate the need for IT risk assessments

Answer

To replace IT risk management with ERM

Question 14

An organization is conducting a post-implementation review of a new data loss prevention (DLP) control. Which TWO metrics are Key Control Indicators (KCIs) that would best measure the control's effectiveness?

Accepted Answer

Percentage of DLP policy violations that were not blocked. The percentage of DLP policy violations that were not blocked directly measures the control's failure rate—its inability to prevent unauthorized data exfiltration. A high percentage indicates ineffective policy configuration or insufficient detection coverage, making it a key control indicator (KCI) for effectiveness. Option E is correct because the number of authorized exceptions to DLP policies reflects how often the control is deliberately bypassed, which can indicate gaps in policy design or excessive risk acceptance, both of which undermine the control's intended effectiveness.

Answer

Cost of the DLP solution per year

Answer

Average time to respond to DLP incidents

Answer

Number of DLP alerts generated per day

Question 15

A risk manager is updating the risk report for the IT steering committee. Which THREE elements should be included to provide a comprehensive view of the risk posture?

Accepted Answer

Risk trend analysis. Risk trend analysis is essential for a comprehensive risk report because it shows how the organization's risk posture has changed over time, enabling the IT steering committee to identify emerging threats and assess the effectiveness of past risk responses. This aligns with CRISC's emphasis on continuous monitoring and reporting of risk indicators to support informed decision-making.

Answer

Names of all IT employees

Answer

Detailed configuration of each firewall