CRISC Risk Response and Reporting Practice Test 12 — 15 Questions

Question 1

A multinational manufacturer has completed a quantitative risk analysis for a ransomware scenario affecting its primary ERP system. The analysis shows an annualized loss expectancy (ALE) of $2.4 million. A proposed endpoint detection and response (EDR) solution would cost $600,000 annually and is projected to reduce the ALE by 60%. The CFO asks the risk practitioner to justify the investment. Which of the following is the BEST response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EDR solution delivers a net risk reduction benefit of $840,000 annually, so it should be approved.. The control reduces the $2.4 million ALE by 60%, avoiding $1.44 million in expected annual loss, and costs $600,000 per year. The net benefit of $840,000 is positive, so the investment is economically justified. The other responses either invoke unsupported benchmarks, assume an unstated appetite threshold, or rely on the percentage reduction without considering cost.

Answer

The EDR solution should be approved because any control that reduces risk by more than half automatically satisfies the cost-benefit test.

Answer

The EDR solution costs 25% of the ALE, which is within the accepted industry benchmark for control spending.

Answer

The EDR solution should be rejected because the residual ALE of $960,000 remains above the organization's risk appetite.

Question 2

A hospital network is selecting key risk indicators (KRIs) for its electronic health record (EHR) availability risk. The risk committee wants indicators that will provide early warning before an outage affects patient care. Which TWO of the following are the most appropriate KRIs for this purpose? (Choose two.)

Accepted Answer

Percentage of critical EHR servers whose monitoring alerts were unacknowledged beyond the response threshold. Replication lag exceeding threshold and unacknowledged critical alerts are leading indicators that measure current degradation of resilience and response capability, giving the risk committee time to intervene before patients are affected. Downtime minutes, long-term MTBF, and raw change volume describe past events or activity levels without predictive value for imminent EHR availability risk, so they do not serve as early-warning KRIs.

Answer

Total number of change requests submitted for the EHR environment during the past quarter

Answer

Mean time between failures (MTBF) of the EHR application servers over the trailing twelve months

Answer

Number of EHR downtime minutes recorded during the previous quarter

Question 3

A healthcare provider has determined that a new telehealth platform introduces risks that exceed its defined risk tolerance. Senior management decides to purchase cyber insurance to cover potential breach costs rather than modify the platform. Which risk response is management applying?

Accepted Answer

Risk transfer. Insurance shifts the financial burden of a potential breach to the insurer, which is the defining characteristic of risk transfer. The telehealth platform continues to operate, so the risk is not avoided, and no technical control was added, so it is not mitigated. Because management acted rather than simply tolerating the exposure, acceptance does not apply.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 4

A risk practitioner is preparing an IT risk report for the board risk committee. The committee has limited technical background and meets quarterly. Which of the following is the MOST appropriate way to present the aggregated IT risk exposure?

Accepted Answer

A heat map showing inherent and residual risk ratings mapped to the enterprise risk taxonomy. Board-level risk reporting must translate technical detail into business-relevant exposure that can be compared, aggregated, and tracked over time. Mapping inherent and residual ratings to the enterprise risk taxonomy lets the committee see IT risk alongside other risk categories and judge whether responses are proportionate. Raw findings, individual control tests, and single operational metrics all require interpretation the committee should not have to perform.

Answer

A raw export of the vulnerability scanner console showing every open finding with its CVSS score

Answer

The mean time to remediate critical incidents compared with the prior four quarters

Answer

A list of every control test performed during the quarter with pass or fail results

Question 5

An e-commerce company discovers that a third-party payment processor suffered a breach exposing customer card data. The processor contract includes a clause requiring the vendor to indemnify the company for breach-related costs. The risk owner updates the register to show that financial loss from this vendor risk is now borne by the processor. Which risk response strategy has been applied?

Accepted Answer

Risk transfer. An indemnification clause that makes the payment processor bear breach-related costs shifts the financial consequence of the risk to a third party, which is risk transfer. The breach risk itself and reputational exposure remain with the company, but the monetary loss is contractually reassigned. Mitigation, avoidance, and acceptance do not describe a contractual shifting of financial responsibility, so transfer is the correct classification.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation

Question 6

A risk practitioner is designing a key risk indicator (KRI) program for a cloud-hosted customer portal. The CISO wants indicators that provide early warning of deteriorating risk conditions rather than reporting losses that have already occurred. Which TWO of the following are the MOST appropriate KRIs for this objective? (Choose two.)

Accepted Answer

Percentage of critical portal servers with missing high-severity patches older than 30 days. Leading indicators measure conditions that precede loss, such as unpatched high-severity vulnerabilities and privileged accounts without multifactor authentication. Both can be tracked continuously and remediated before an attacker exploits them. Breach counts, insurance premiums, and incident closure times all describe outcomes or costs that appear only after risk has already materialized.

Answer

Number of confirmed data breaches reported to regulators in the last quarter

Answer

Total annual cost of cyber insurance premiums for the customer portal

Answer

Average time to close security incidents after they have been detected

Question 7

A financial services firm has completed a risk assessment and determined that the residual risk for its online banking platform exceeds the board-approved risk appetite. The CISO must recommend risk response options to the risk committee. Which TWO of the following are appropriate risk response actions? (Choose two.)

Accepted Answer

Implement additional compensating controls to reduce the residual risk to within appetite. When residual risk exceeds appetite, the risk owner must choose from the recognized response set: mitigate, transfer, avoid, or accept with proper authority. Applying compensating controls reduces the exposure, and transferring part of the financial consequence through insurance addresses what remains. Accepting without authority, recalculating assumptions to change the rating, and deleting the risk from the register are not legitimate responses because they alter the record rather than the risk.

Answer

Remove the platform from the risk register so it no longer appears as an exception in committee reporting

Answer

Recalculate the annualized loss expectancy using a lower single loss expectancy to bring the rating within tolerance

Answer

Accept the residual risk without further action because the platform generates significant revenue

Question 8

A software company has completed a risk assessment showing that a critical SaaS platform has a residual risk above appetite due to weak vendor access controls. Budget is limited and the remediation will take six months. The CISO must decide how to proceed while the risk remains elevated. Which action BEST aligns with CRISC risk response principles?

Accepted Answer

Document an interim compensating control, set a remediation timeline, and obtain formal risk acceptance from the accountable business owner until closure.. With residual risk above appetite and remediation requiring six months, the sound approach is to implement interim compensating controls, establish a remediation timeline, and obtain formal acceptance from the accountable business owner. This keeps exposure transparent and owned while respecting business continuity. Suspending service, manipulating ratings, or merely notifying the vendor do not appropriately manage the risk or satisfy governance and reporting expectations.

Answer

Transfer the risk to the SaaS vendor by sending a notification letter describing the control weaknesses.

Answer

Lower the inherent risk rating in the register so that residual risk falls within the approved appetite.

Answer

Suspend all access to the SaaS platform until the vendor access controls are fully remediated.

Question 9

A credit union's risk committee has approved a risk response for its core banking platform: purchase an insurance policy against ransomware losses and keep the current backup process unchanged. Six months later, a ransomware event encrypts production data and the backup restoration takes four days, breaching regulatory reporting deadlines. Which risk response did the risk committee most likely select, and why did it fail to address the operational impact?

Accepted Answer

Risk transfer, because insurance shifted the financial loss but did not reduce the likelihood or duration of the service outage.. The committee chose a risk transfer response by buying insurance, which addresses only the financial consequence of a ransomware loss. Because backups and recovery capabilities were left unchanged, the operational and regulatory impacts remained fully exposed, and the four-day restoration breached reporting deadlines. Effective risk response selection must consider whether the chosen treatment addresses the specific impact categories the organization cares about, not just the monetary loss.

Answer

Risk mitigation, because the insurance policy reduced the likelihood of a ransomware attack.

Answer

Risk avoidance, because the committee decided not to invest in additional backup controls.

Answer

Risk acceptance, because the committee acknowledged the residual risk without purchasing insurance.

Question 10

A financial services firm has completed its annual IT risk assessment. The chief risk officer asks the IT risk analyst to classify each identified risk according to the organization's risk taxonomy before any response decisions are made. Which activity should the analyst perform FIRST?

Accepted Answer

Map each risk to the relevant business process and asset owner, and assign a consistent risk category and owner.. Classification and ownership assignment come first because every downstream activity, including quantification, treatment selection, transfer, and governance reporting, depends on knowing what each risk is, who owns it, and how it maps to business processes. Establishing a consistent taxonomy and accountable owner creates the structure required for aggregation and defensible risk acceptance at the enterprise level.

Answer

Recalculate the annualized loss expectancy for every risk using the latest asset valuation data.

Answer

Immediately transfer the highest-rated risks to the cyber insurance carrier to cap the firm's exposure.

Answer

Publish the complete risk register to the board risk committee for formal acceptance of all identified risks.

Question 11

A healthcare insurer's risk committee is reviewing key risk indicators (KRIs) for its claims processing platform. The committee wants to ensure the KRIs are actionable and tied to risk appetite. Which TWO of the following characteristics are MOST important for these KRIs to meet that objective? (Choose two.)

Accepted Answer

Each KRI is directly linked to one or more identified risks and the corresponding risk appetite statement.. Actionable KRIs tied to risk appetite must connect to specific risks and appetite statements and must have thresholds that trigger defined responses. These two characteristics ensure the committee can interpret the indicator and act before the claims platform exposure exceeds tolerance. Measurement frequency and format are secondary considerations, and assurance review is not a substitute for management ownership of the indicators.

Answer

Each KRI is reviewed annually by internal audit to confirm it remains relevant to the business.

Answer

Each KRI is measured using data that is manually collected once per quarter to ensure accuracy.

Answer

Each KRI is expressed as a monetary value so it can be aggregated with financial risk metrics.

Question 12

A risk practitioner has completed a risk assessment and documented the findings. Management must now decide how to address each identified risk. Which of the following BEST describes the purpose of the risk response process?

Accepted Answer

To select and implement actions that bring residual risk within the organization's risk appetite. Risk response is the decision and action phase that follows assessment. Its purpose is to bring residual risk into alignment with the organization's risk appetite through mitigation, transfer, avoidance, or authorized acceptance. It is not about eliminating all risk, merely documenting ratings, or centralizing ownership in one team; it is about taking proportionate, accountable action on the exposures that matter.

Answer

To document the inherent risk rating for each asset so it can be reported to regulators

Answer

To transfer ownership of every risk to the information security team for remediation

Answer

To eliminate all identified risks regardless of the cost of the controls required

Question 13

An organization's risk committee is reviewing a consolidated IT risk report before a board meeting. The report shows that a critical payment system has a residual risk rating above tolerance, but the remediation project is not scheduled to complete for nine months due to vendor dependencies. The committee must decide how to report this to the board. Which of the following is the MOST appropriate action?

Accepted Answer

Recommend that the board formally accept the risk above tolerance until remediation completes, documenting the rationale and interim compensating controls.. Residual risk above tolerance that cannot be remediated promptly requires formal acceptance by the governing body. The committee should present the timeline, the vendor dependency, and any compensating controls so the board can make an informed decision. Concealing the timeline, relabeling the risk, or delaying the report all deprive the board of information it needs and violate reporting integrity.

Answer

Delay the board report until the remediation project completes so the report shows only risks within tolerance.

Answer

Report the risk as being addressed by the remediation project and omit the completion timeline to avoid alarming the board.

Answer

Reclassify the residual risk as inherent risk so the rating falls within the board-approved tolerance threshold.

Question 14

A multinational retailer's risk register shows a high inherent risk for its point-of-sale (POS) payment environment. After implementing tokenization, the risk owner records a residual risk rating of low. During the next quarterly review, the internal audit team finds that several legacy POS terminals still transmit clear-text card data. Which risk response principle was violated?

Accepted Answer

Risk response must be validated against actual control coverage before residual risk is reported.. Residual risk is only meaningful when it reflects validated control effectiveness across the full scope of the risk. The risk owner lowered the rating based on tokenization without confirming that legacy terminals were included, so the reported low residual risk was inaccurate. Risk response and reporting require evidence that controls operate as designed before risk ratings are adjusted downward, and audit findings should trigger reassessment of the affected register entries.

Answer

Risk response must transfer residual risk to a third party whenever inherent risk is rated high.

Answer

Risk response must be approved by the board before any residual risk rating can be lowered.

Answer

Risk response must always prioritize risk avoidance over risk mitigation for payment environments.

Question 15

A retail company's IT risk manager is preparing a report for the board's audit committee. The report must summarize the current status of the top ten IT risks, the effectiveness of related controls, and any changes since the last quarter. Which of the following is the MOST important quality for this report to possess?

Accepted Answer

It provides a balanced view of risk exposure and control effectiveness, including areas where remediation is behind schedule.. The report's primary purpose is to enable the audit committee to oversee IT risk effectively. That requires a balanced presentation of exposures and control effectiveness, including unfavorable information such as overdue remediation. Reports skewed toward technical detail, only positive trends, or exhaustive risk lists fail to support informed governance and can hide material exposures from those accountable for oversight.

Answer

It includes every identified IT risk in the register to ensure completeness of disclosure.

Answer

It focuses exclusively on risks that have decreased since the prior reporting period to show progress.

Answer

It uses detailed technical terminology to demonstrate the depth of the IT risk team's analysis.