CRISC Risk Response and Reporting Practice Test 11 — 15 Questions

Question 1

A risk owner is reviewing a control that has a deficiency rate of 15%. The target deficiency rate is less than 5%. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Investigate the root cause of the high deficiency rate. A deficiency rate of 15% against a target of less than 5% indicates a control failure that requires immediate remediation. Investigating the root cause is the first step in the risk response process to identify why the control is failing and to determine the appropriate corrective action, aligning with the Risk Response and Reporting domain's emphasis on addressing control deficiencies before considering acceptance or reporting.

Answer

Increase the target deficiency rate to 15%

Answer

Report the deficiency to the external auditor

Answer

Accept the risk and document the decision

Question 2

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

Accepted Answer

Provides real-time detection of security events. Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Answer

Reduces the need for security staff

Answer

Is less expensive than periodic testing

Answer

Eliminates all false positives

Question 3

In a risk-aware culture, which of the following behaviors is MOST encouraged?

Accepted Answer

Reporting security incidents without fear of blame. In a risk-aware culture, the primary goal is to encourage transparency and continuous improvement in risk management. Reporting security incidents without fear of blame (Option D) is most encouraged because it enables timely detection, analysis, and remediation of threats, directly supporting the Risk Response and Reporting domain by fostering an environment where incidents are escalated promptly rather than concealed.

Answer

Focusing only on compliance requirements

Answer

Assigning blame to individuals for security breaches

Answer

Hiding minor incidents to maintain performance metrics

Question 4

An organization uses a KRI that tracks the average time to patch critical vulnerabilities. The metric has been increasing over the past three months. What does this indicate from a risk perspective?

Accepted Answer

The risk of exploitation is increasing. An increasing average time to patch critical vulnerabilities indicates that the organization is taking longer to remediate known security weaknesses. From a risk perspective, this directly increases the window of exposure, making it more likely that an attacker will exploit a vulnerability before a patch is applied. Therefore, the risk of exploitation is increasing.

Answer

The control effectiveness is improving

Answer

The risk appetite has been reduced

Answer

The risk of exploitation is decreasing

Question 5

Which of the following is the PRIMARY purpose of integrating IT risk reporting into the enterprise risk management (ERM) program?

Accepted Answer

To provide a holistic view of risk across the organization. Integrating IT risk reporting into the ERM program provides a holistic view of risk across the organization by aligning IT-specific risks with strategic, operational, and compliance risks. This integration ensures that decision-makers can prioritize and respond to risks based on their aggregate impact, rather than treating IT risks in isolation. The primary purpose is to enable a unified risk posture that supports enterprise-wide governance and resource allocation.

Answer

To reduce the frequency of IT risk reporting

Answer

To eliminate the need for IT risk assessments

Answer

To replace IT risk management with ERM

Question 6

A risk manager is updating the risk report for the IT steering committee. Which THREE elements should be included to provide a comprehensive view of the risk posture?

Accepted Answer

Risk trend analysis. Risk trend analysis (B) is correct because tracking how risk exposure changes over time (e.g., increasing, decreasing, or stable risk levels across reporting periods) gives the steering committee insight into whether risk management efforts are effective and where emerging risks are developing. A risk heat map (C) is correct because it visually plots risks by likelihood and impact, enabling the committee to quickly identify and prioritize the highest-exposure areas across the organization's risk posture. Top risks and their status (E) is correct because summarizing the most significant risks along with their current mitigation status, owners, and progress provides the committee with actionable, decision-ready information for governance. Names of all IT employees (A) is not a risk posture element—it is personnel data with no bearing on risk likelihood, impact, or treatment. Detailed configuration of each firewall (D) is far too granular and technical for a steering-committee risk report; such operational detail belongs in technical security documentation, not executive risk reporting.

Answer

Names of all IT employees

Answer

Detailed configuration of each firewall

Question 7

An organization is implementing a third-party risk management program. Which TWO are essential components of the initial vendor risk assessment process?

Accepted Answer

Security questionnaires. Security questionnaires (A) are essential because they elicit the vendor's self-reported controls, data handling practices, and security posture directly from the vendor, forming the foundational data-gathering step of an initial risk assessment. Reviewing a SOC 2 Type II report (C) is also essential because it provides independent auditor attestation that the vendor's controls operated effectively over a period (typically 6–12 months), validating the claims made in questionnaires. Contract compliance review (B) is a legal/procurement activity that occurs around contracting rather than being a core initial risk-assessment component. Quarterly vulnerability scans of vendor networks (D) are not feasible or appropriate at the initial assessment stage and typically cannot be performed against third-party infrastructure without authorization. Annual reassessment (E) is a recurring post-onboarding activity, not part of the initial vendor risk assessment.

Answer

Contract compliance review

Answer

Quarterly vulnerability scans of vendor networks

Answer

Annual reassessment

Question 8

During a third-party risk management review, the organization is tiering its vendors based on risk. Which TWO of the following criteria are most relevant for determining vendor risk tier?

Accepted Answer

Criticality of service provided. The criticality of the service provided (A) directly determines the potential business impact if the vendor fails, making it a primary factor in risk tiering. Similarly, the level of data access (C) dictates the confidentiality and privacy risks, as vendors handling sensitive or regulated data (e.g., PII, PHI) pose higher inherent risk. Both criteria align with the ISACA risk management framework, which prioritizes impact and data sensitivity over financial or operational metrics.

Answer

Number of vendor employees

Answer

Annual contract value

Answer

Vendor geographic location

Question 9

An organization wants to promote a risk-aware culture. Which TWO of the following initiatives are most effective for achieving this?

Accepted Answer

Conducting regular security awareness training for all employees. Option A is correct because regular security awareness training for all employees builds the knowledge and vigilance needed for staff to recognize and respond to risks, which is the foundation of a risk-aware culture. Option B is correct because a 'tone from the top' that emphasizes risk management signals leadership commitment, sets expectations, and drives risk-conscious behavior throughout the organization. Option C, while valuable for encouraging reporting, addresses incident handling rather than directly cultivating organization-wide risk awareness. Option D can motivate specific behavior but risks incentivizing quantity over quality and does not by itself build a sustainable culture. Option E, increasing the IT risk team budget, strengthens resources but does not directly engage employees or shape organizational attitudes toward risk.

Answer

Implementing a blame-free incident reporting system

Answer

Offering financial incentives for risk identification

Answer

Increasing the IT risk team budget

Question 10

An organization is integrating its IT risk program with the enterprise risk management (ERM) framework. Which THREE of the following activities support this integration?

Accepted Answer

Using consistent risk metrics and terminology across IT and enterprise levels. Option A is correct because using consistent risk metrics and terminology across IT and enterprise levels enables IT risk data to be aggregated, compared, and communicated within the ERM framework rather than being siloed in IT-specific language. Option B is correct because aligning IT risk appetite with enterprise risk appetite ensures IT risk tolerances and thresholds are derived from and consistent with the organization's overall risk appetite, which is a core requirement of ERM integration. Option C is correct because reporting IT risk as a component of broader operational risk allows IT risk to be consolidated into enterprise risk reporting, giving leadership a holistic view of risk exposure. Option D does not belong because maintaining a separate IT risk register not shared with ERM perpetuates silos and prevents aggregation and enterprise-level visibility. Option E does not belong because reporting IT risks only to the CIO without board visibility excludes key governance stakeholders and contradicts the top-down, board-engaged nature of ERM integration.

Answer

Maintaining a separate IT risk register not shared with ERM

Answer

Reporting IT risks only to the CIO without board visibility

Question 11

A company's IT risk manager is evaluating Key Risk Indicators (KRIs) for the cybersecurity function. Which TWO of the following are valid examples of leading KRIs?

Accepted Answer

Patch lag metric for critical systems. Option B (Patch lag metric for critical systems) is a valid leading KRI because it measures the time between patch release and deployment, a predictive indicator of exposure to known vulnerabilities before an incident occurs. Option C (Failed authentication spike detection) is also a leading KRI because a sudden increase in failed logins can signal credential-stuffing, brute-force, or password-spraying attempts, providing an early warning of an imminent compromise. In contrast, Option A (System downtime due to security incidents) is a lagging indicator, as it records impact after an incident has already happened. Option D (Number of audit findings related to access controls) is a lagging compliance metric reflecting past control weaknesses rather than forward-looking risk. Option E (Number of successful cyber attacks in the past quarter) is likewise lagging, since it counts breaches that have already succeeded.

Answer

System downtime due to security incidents

Answer

Number of audit findings related to access controls

Answer

Number of successful cyber attacks in the past quarter

Question 12

An organization is designing a vendor risk assessment process for critical vendors. Which THREE of the following should be included in the initial onboarding assessment?

Accepted Answer

Security questionnaires. Security questionnaires (A) are a core onboarding artifact because they elicit the vendor's controls, data handling, and security posture directly from the vendor before any data or access is granted. Contract compliance review (C) is essential at onboarding to verify that the agreement contains required security, privacy, breach-notification, and data-return/retention clauses before the relationship begins. SOC 2 report review (E) is appropriate during initial assessment because it provides independent third-party attestation over the vendor's security, availability, confidentiality, or privacy controls under the Trust Services Criteria. Continuous monitoring via shared intelligence platforms (B) and annual reassessment (D) are ongoing or periodic post-onboarding activities, not initial onboarding assessment steps, so they do not belong in this phase.

Answer

Continuous monitoring via shared intelligence platforms

Answer

Annual reassessment

Question 13

A financial services firm's risk register shows that a legacy payment gateway has a high inherent risk of SQL injection. The security team proposes deploying a web application firewall (WAF) in front of the gateway. The risk owner must document how this action will be classified in the risk response plan. Which risk response strategy does deploying the WAF represent?

Accepted Answer

Risk mitigation. Applying a web application firewall reduces the likelihood and impact of SQL injection against the legacy payment gateway, which is the definition of risk mitigation. The organization continues to operate the asset and retains the residual risk, so avoidance, transfer, and acceptance do not describe the action. Correct classification matters because the risk register and reporting must reflect the true response strategy and its effect on residual risk.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 14

A financial services firm maintains a risk register that lists inherent risk ratings for its core banking platform. During an internal audit, the CIO notes that the register has not been updated to reflect the controls implemented over the past 18 months. Which of the following should the risk practitioner do FIRST to address this gap?

Accepted Answer

Reassess the residual risk for each entry by evaluating the effectiveness of the implemented controls.. The register captured inherent risk but never reflected the controls deployed over 18 months, so the residual risk position is stale. The practitioner must evaluate control effectiveness and recalculate residual risk for each affected entry. Escalation, deletion, or relabeling do not correct the data and would leave decision-makers with a misleading view of the firm's actual risk exposure.

Answer

Remove the affected entries from the register until a complete enterprise risk assessment can be scheduled.

Answer

Reclassify all entries from inherent to residual risk so the register aligns with the audit terminology.

Answer

Escalate the finding to the board risk committee and request additional budget for a full risk assessment.

Question 15

A multinational retailer operates in 14 countries and must report IT risk to its board quarterly. The CISO wants the reporting to drive decisions rather than merely satisfy auditors. Which of the following is the MOST important characteristic of the quarterly IT risk report?

Accepted Answer

It links IT risk exposure to business objectives and states the residual risk against the board-approved risk appetite.. Effective board reporting translates IT risk into business terms and states residual risk relative to the board-approved risk appetite, enabling directors to make informed decisions about resource allocation and tolerance. Technical inventories, compliance activity metrics, and peer benchmarks may supplement the report but do not by themselves show whether the organization is operating within acceptable risk limits, which is the primary purpose of quarterly risk reporting to the board.

Answer

It reports the percentage of controls tested and the number of audit findings closed during the quarter.

Answer

It includes a complete inventory of every vulnerability detected during the quarter, ranked by CVSS score.

Answer

It compares the organization's risk scores with those of industry peers using a published benchmark.