CRISC Risk Response and Reporting Practice Test 13 — 15 Questions

Question 1

A healthcare payer's risk committee is deciding how to respond to a risk that its cloud-hosted claims processing platform could become unavailable for more than 24 hours. The platform is critical, the provider offers a financially backed 99.95% availability commitment, and the organization lacks the internal capability to run a secondary environment. Which risk response is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transfer the financial consequence through contract terms and insurance while implementing a tested recovery capability with the provider.. For a critical platform with no internal recovery capability, the realistic response is layered: contractual remedies and insurance transfer the financial loss, while provider-supported recovery arrangements mitigate the operational outage. Pure acceptance leaves patients and regulators exposed, avoidance is disproportionate, and a stronger SLA alone changes expectations without building the capability to restore service.

Answer

Avoid the risk entirely by terminating the cloud contract and rebuilding the claims platform in an internally managed data center.

Answer

Accept the risk and document the decision, relying on the provider's service level agreement as the sole safeguard.

Answer

Reduce the risk by negotiating a higher availability percentage in the service level agreement without adding recovery arrangements.

Question 2

A financial services firm's IT risk register shows that a legacy payment gateway has a high inherent risk of data breach. Management decides to purchase a cyber insurance policy that covers up to $5 million per incident, while keeping the gateway in production unchanged. Which risk response option has management chosen?

Accepted Answer

Risk transfer. The scenario describes management choosing to keep the high-risk payment gateway in production while purchasing an insurance policy to cover financial losses. This is risk transfer because the financial impact of a potential breach is shifted to the insurer. Risk mitigation would require implementing controls to reduce likelihood or impact, avoidance would require eliminating the gateway, and acceptance would mean bearing the loss without transferring it.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 3

A hospital's IT risk manager is preparing a quarterly risk report for the executive committee. The report currently lists 240 technical vulnerabilities with CVSS scores but no business context. The CIO asks for a report that helps executives decide where to allocate limited remediation funding. Which change best aligns the report with risk response and reporting objectives?

Accepted Answer

Group vulnerabilities by the business processes and assets they affect, and express exposure in terms of potential impact and likelihood.. Risk reporting to executives must translate technical findings into business language. Grouping vulnerabilities by affected processes and assets and expressing exposure through impact and likelihood gives leaders the context needed to prioritize remediation spending against organizational objectives. Raw counts, technical artifacts, or alphabetical ordering do not support funding decisions because they omit the business consequences that drive risk-based prioritization.

Answer

Report only the total count of vulnerabilities and the percentage remediated within the past quarter.

Answer

Sort the vulnerabilities alphabetically by vendor name so the report is easier to navigate.

Answer

Increase the report's technical depth by including exploit code snippets and packet captures for each vulnerability.

Question 4

A software company has a risk appetite statement allowing no more than two hours of downtime per quarter for its customer-facing API. During a quarterly review, the risk practitioner discovers that a single unplanned database failover event caused 90 minutes of downtime, and a separate configuration error caused 45 minutes. Both events were resolved, but no root cause analysis was completed for either. Which of the following should the risk practitioner recommend FIRST?

Accepted Answer

Initiate a root cause analysis for both incidents to determine whether the downtime events share an underlying control weakness.. The downtime exceeded the stated appetite, and the lack of root cause analysis leaves the reason for the breach unknown. The practitioner's first step should be to investigate both incidents and determine whether a shared control weakness exists. Only with that understanding can a proportionate response be selected, reported accurately, or escalated to governance with meaningful options rather than an unexplained breach.

Answer

Report to the board that the downtime appetite has been breached and await direction on a response.

Answer

Revise the risk appetite statement to allow three hours of quarterly downtime, reflecting actual operational reality.

Answer

Recommend immediate investment in a redundant database cluster to prevent future failover downtime.

Question 5

A multinational retailer's IT risk manager must define key risk indicators (KRIs) for its third-party payment processing relationships. Which TWO characteristics must the selected KRIs exhibit to be effective for ongoing risk monitoring? (Choose two.)

Accepted Answer

They are tied to a specific risk statement and have defined thresholds that trigger escalation.. Effective KRIs are quantifiable on a reliable schedule and explicitly tied to a risk with thresholds that drive escalation. Those two properties turn measurement into monitoring. Restricting indicators to monetary units, refreshing them only annually, or hiding them from the vendor all break the feedback loop that makes an indicator actionable for third-party payment risk.

Answer

They are kept confidential from the vendor so the vendor cannot influence the reported results.

Answer

They are reviewed and updated only during the annual enterprise risk assessment cycle.

Answer

They are expressed exclusively as monetary values so executives can compare them to budget.

Question 6

A multinational retailer's risk committee is reviewing its risk register. The CISO argues that a newly identified vulnerability in the point-of-sale system should be escalated immediately to the board. The risk manager notes that the vulnerability has a low likelihood of exploitation and existing compensating controls reduce the impact to a tolerable level. Which of the following is the MOST appropriate action for the risk manager to take?

Accepted Answer

Document the vulnerability in the risk register with its assessed likelihood, impact, and compensating controls, and report it through the normal risk reporting process.. The risk manager should follow the organization's established risk assessment and reporting criteria. Since the vulnerability has low likelihood and compensating controls keep residual risk within tolerance, it does not meet the threshold for board escalation. Documenting it in the risk register with supporting rationale and reporting through normal channels ensures accurate risk visibility while avoiding unnecessary escalation.

Answer

Override the CISO's assessment and remove the vulnerability from the risk register to avoid unnecessary alarm.

Answer

Escalate the vulnerability to the board because all identified vulnerabilities must be reported to the highest governance body.

Answer

Close the vulnerability without documentation because the compensating controls already reduce the risk to an acceptable level.

Question 7

A software company is defining key risk indicators (KRIs) for its cloud service availability risk. The risk owner wants indicators that provide early warning of deteriorating conditions rather than after-the-fact outcomes. Which TWO of the following are the most appropriate leading KRIs for this risk? (Choose two.)

Accepted Answer

Percentage of critical cloud components operating above 80% capacity utilization.. Leading KRIs detect conditions that precede an adverse event, giving the risk owner time to act. Capacity utilization thresholds and single points of failure both signal latent availability weaknesses before an outage occurs. Outage counts, mean time to restore, and patch currency either describe past events or relate to a different risk category, so they do not satisfy the requirement for early warning indicators specific to cloud service availability.

Answer

Average time to restore service after a cloud availability incident.

Answer

Percentage of virtual machines running without current security patches.

Answer

Number of unplanned availability outages experienced in the past quarter.

Question 8

A risk analyst has completed a control self-assessment and found that a key preventive control failed testing in two consecutive quarters. The risk owner asks the analyst to update the risk register. Which action BEST reflects an appropriate risk response?

Accepted Answer

Record the control failure, reassess the inherent and residual risk ratings, and initiate a remediation plan with a target date.. A repeat control failure invalidates prior residual risk assumptions, so the correct response is to record the failure, re-rate inherent and residual risk, and launch a dated remediation plan. Closing the finding, maximizing the rating without analysis, or overwriting the record all distort the risk picture and remove the accountability that drives correction.

Answer

Close the finding because the control is preventive and failures are expected to occur occasionally in any environment.

Answer

Increase the residual risk rating to the maximum and immediately report the organization as non-compliant to regulators.

Answer

Delete the original control from the register and replace it with a new control entry showing a passing test result.

Question 9

A risk practitioner has completed a quantitative risk analysis for a customer-facing payment platform. The analysis shows an inherent annualized loss expectancy (ALE) of $2.4 million. Management wants to fund a tokenization control that reduces the ALE to $600,000, but the control costs $1.9 million per year to operate. Which action should the risk practitioner recommend?

Accepted Answer

Reject the tokenization control because its annual cost exceeds the reduction in ALE, and document the accepted residual risk.. Cost-benefit analysis compares the control's annual cost against the reduction in expected loss it produces. Here the $1.9 million cost exceeds the $1.8 million ALE reduction, so the control is not economically justified. The correct response is to advise against funding it while ensuring the remaining $600,000 residual risk is explicitly accepted and documented by the accountable risk owner.

Answer

Defer the decision indefinitely until the inherent ALE increases enough to justify the control cost.

Answer

Implement the tokenization control because it reduces the ALE by $1.8 million.

Answer

Implement the tokenization control and offset the shortfall by reducing the scope of the annual penetration test.

Question 10

A logistics firm relies on a third-party cloud provider to host its shipment tracking system. The provider's latest SOC 2 report includes a qualified opinion noting that access review controls were not operating effectively during part of the audit period. The firm's risk practitioner must determine the appropriate risk response. Which of the following is the MOST appropriate action?

Accepted Answer

Assess the impact of the access review exception on the firm's data and implement compensating controls while the provider remediates.. A qualified SOC 2 opinion identifies a real control failure at the provider, so the firm cannot simply accept the risk or wait a year for the next report. The practitioner should assess how the access review weakness affects the shipment tracking data and deploy compensating controls during remediation. This protects the firm while preserving the vendor relationship and allows for a proportionate, evidence-based response.

Answer

Terminate the contract immediately and migrate the shipment tracking system to a different provider.

Answer

Request the provider's remediation plan and take no further action until the next annual SOC 2 report is issued.

Answer

Accept the risk because the provider holds a SOC 2 report, which demonstrates an adequate control environment.

Question 11

A financial services firm's risk committee has approved a risk response plan for its core payment platform. The plan requires monthly tracking of key risk indicators (KRIs) and quarterly reporting of control test results to the board. Six months later, the CIO asks the risk manager to confirm that the approved response is still appropriate given new regulatory guidance. Which of the following should the risk manager do FIRST?

Accepted Answer

Reassess the risk and control environment against the new regulatory guidance to determine whether the approved response remains within tolerance.. When the external environment changes, the risk practitioner must first determine whether the previously approved risk response still keeps the risk within the organization's tolerance. That means reassessing the risk, the effectiveness of existing controls, and the alignment of the response with new regulatory expectations before recommending any change. This maintains evidence-based governance and gives the risk committee a defensible basis for deciding whether to accept, modify, or escalate the response.

Answer

Immediately escalate to the board that the existing risk response plan is invalid and must be replaced.

Answer

Commission a penetration test of the payment platform to produce fresh technical evidence for the committee.

Answer

Suspend the quarterly board reporting until the regulatory guidance has been fully interpreted by legal counsel.

Question 12

An organization's risk register lists a risk with an annualized loss expectancy (ALE) of $200,000. A proposed control would reduce the ALE to $50,000, and the control costs $40,000 per year to operate. What is the value of the control's risk reduction?

Accepted Answer

$150,000. The value of the risk reduction is the difference between the original ALE and the residual ALE after the control is applied. Here, $200,000 minus $50,000 equals $150,000. This figure represents the expected annual loss avoided. Comparing it to the $40,000 annual control cost yields a net benefit of $110,000, indicating the control is cost-effective.

Answer

$10,000

Answer

$200,000

Answer

$40,000

Question 13

A bank's risk committee is reviewing a proposal to increase the risk appetite threshold for third-party data processing failures from 2 to 5 incidents per year. The head of internal audit objects, noting that three such failures occurred in the last 12 months and one caused a regulatory finding. Which action should the risk committee take FIRST?

Accepted Answer

Evaluate whether existing third-party controls and remediation plans can bring incident frequency within the current threshold before changing the appetite.. Risk appetite defines the level of risk the organization is willing to accept and should guide performance, not be retrofitted to justify it. Before raising the threshold, the committee must determine whether improved third-party controls can reduce failures to within the existing limit. Adjusting appetite to match poor results would normalize the exposure, conflict with the regulatory finding, and weaken governance oversight.

Answer

Immediately approve the new threshold to align reporting with actual performance and close the audit finding.

Answer

Reject the proposal and take no further action because the current threshold already reflects the board's intent.

Answer

Delegate the decision to the third-party management team since they own the vendor relationships.

Question 14

An energy utility's board risk committee receives a quarterly IT risk report showing that overall risk exposure is within appetite, yet a recent regulatory audit identified unpatched internet-facing systems. The risk manager must improve the report so the committee is not misled in the future. Which change is MOST effective?

Accepted Answer

Add a section that reconciles reported risk ratings against independent audit and assessment findings.. When a board dashboard shows acceptable exposure while an independent audit finds real gaps, the reporting process lacks validation. Reconciling reported ratings with audit and assessment findings surfaces divergence, drives root-cause analysis, and ensures independent evidence updates the register. Changing frequency or format, or shifting authorship to audit, leaves the underlying data integrity problem intact.

Answer

Delegate preparation of the IT risk report entirely to the internal audit function going forward.

Answer

Increase the reporting frequency from quarterly to monthly without changing the content or data sources.

Answer

Replace quantitative risk ratings with a purely qualitative red, amber, and green status for each risk.

Question 15

An organization's risk register lists a ransomware exposure against its primary order-processing system. The chief information security officer decides to purchase cyber insurance that covers ransomware losses up to $10 million. Which risk response has been selected?

Accepted Answer

Risk transfer. Risk transfer shifts the financial impact of a risk to another party, most commonly through insurance or contractual indemnification. Purchasing a cyber insurance policy leaves the ransomware threat and the system unchanged while moving the monetary consequence to the insurer. Because deductibles, exclusions, and coverage caps remain the organization's burden, the residual risk must still be recorded and accepted.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation