CRISC Risk Response and Reporting Practice Test 2 — 15 Questions

Question 1

An organization is integrating IT risk into its enterprise risk management (ERM) program. Which TWO of the following are key benefits of this integration?

Accepted Answer

Ensures IT risk is considered in strategic decisions. Integrating IT risk into ERM allows for a holistic view of risk and ensures IT risk is considered alongside other operational risks.

Answer

Reduces the overall risk appetite of the organization

Answer

Eliminates the need for separate IT risk reporting

Answer

Guarantees that all IT risks are mitigated

Question 2

A risk manager is designing a third-party risk management program. Which THREE factors should be considered when determining the risk tier of a vendor?

Accepted Answer

The type of data the vendor will access. Data access, service criticality, and the vendor's security posture are key factors in risk tiering.

Answer

The vendor's physical location

Answer

The vendor's annual revenue

Question 3

Which TWO of the following are examples of detective controls?

Accepted Answer

Log monitoring and analysis. Detective controls identify incidents that have already occurred. Intrusion detection systems and log monitoring are classic examples.

Answer

Encryption of data at rest

Answer

Firewall rules

Answer

Data backup process

Question 4

An organization is implementing a new access control system to protect sensitive data. Which type of control is most appropriate for preventing unauthorized access?

Accepted Answer

Preventive control. Preventive controls are designed to deter or prevent undesirable events from occurring. Access control systems are a classic example of preventive controls as they block unauthorized access before it happens.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 5

A risk manager is evaluating the cost-effectiveness of a proposed control. The control costs $50,000 annually to implement and maintain. The current annual loss expectancy (ALE) for the risk is $200,000, and the control is expected to reduce the ALE by 70%. What is the net benefit (or loss) of implementing the control?

Accepted Answer

Net benefit of $90,000. The ALE reduction is $200,000 * 70% = $140,000. The annual cost of control is $50,000. Net benefit = $140,000 - $50,000 = $90,000.

Answer

Net loss of $10,000

Answer

Net benefit of $140,000

Answer

Net loss of $50,000

Question 6

Which of the following is a Key Control Indicator (KCI) that measures the effectiveness of a firewall?

Accepted Answer

Number of blocked intrusion attempts. A KCI measures the performance or effectiveness of a control. The number of blocked intrusion attempts is a direct measure of the firewall's preventive effectiveness.

Answer

Number of security incidents reported

Answer

Average time to patch vulnerabilities

Answer

Percentage of employees who completed security training

Question 7

An organization is planning to implement a new security control. The project manager must ensure changes to existing systems are properly managed. Which process is most critical to include in the implementation plan?

Accepted Answer

Change management. Change management ensures that changes to systems are controlled, tested, and approved to prevent unintended disruptions or security gaps. It is essential during control implementation.

Answer

User training

Answer

Vulnerability scanning

Answer

Access review

Question 8

Which type of control testing is typically performed on a continuous basis using automated tools?

Accepted Answer

Continuous monitoring. Continuous monitoring uses automated tools like SIEM rules, log monitoring, and vulnerability scanning to provide ongoing assurance over control effectiveness.

Answer

Annual penetration test

Answer

Manual control walkthrough

Answer

Quarterly internal audit review

Question 9

A Key Risk Indicator (KRI) that shows a rising trend in the average time to apply critical security patches suggests:

Accepted Answer

Increasing risk of exploitation. Patch lag is a leading indicator that vulnerability risk is increasing because unpatched systems are more exposed to exploits.

Answer

Decreasing risk of exploitation

Answer

Stable risk level

Answer

Improved control effectiveness

Question 10

An IT risk report for the board of directors should primarily focus on:

Accepted Answer

Top risks, trends, and control performance metrics. Strategic risk reporting to the board should highlight top risks, trends, and high-level metrics in business terms, avoiding excessive technical detail.

Answer

Specific control failures with root cause analysis

Answer

Detailed technical vulnerability scan results

Answer

Operational incident counts

Question 11

When integrating IT risk into the enterprise risk management (ERM) program, the most important consideration is:

Accepted Answer

Mapping IT risks to enterprise risk categories. IT risk should be treated as a component of broader operational risk to ensure alignment with enterprise-level risk appetite and reporting.

Answer

Reporting IT risks only to the CIO

Answer

Eliminating IT risk reporting to the board

Answer

Using separate risk scoring for IT risks

Question 12

A vendor is classified as 'critical' based on its access to sensitive data and the criticality of its service. According to best practices, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. For critical vendors, the risk appetite typically requires a SOC 2 Type II report, which provides assurance over controls related to security, availability, processing integrity, confidentiality, and privacy.

Answer

Annual self-assessment questionnaire

Answer

Penetration test results from the vendor

Answer

ISO 27001 certificate

Question 13

An organization wants to promote a risk-aware culture. Which initiative is most effective in encouraging employees to report security incidents without fear?

Accepted Answer

Implementing a no-blame incident reporting policy. A 'no-blame' culture encourages reporting by removing fear of punishment for unintentional errors, leading to better risk identification and learning.

Answer

Conducting annual security awareness training

Answer

Increasing penalties for policy violations

Answer

Publishing names of employees who caused incidents

Question 14

Which risk reporting frequency is most appropriate for tactical risk reporting to the CISO/CIO?

Accepted Answer

Quarterly. Tactical risk reporting typically occurs quarterly to provide a balance between timeliness and stability for management decision-making.

Answer

Weekly

Answer

Monthly

Answer

Annually

Question 15

An organization's risk report shows a risk heat map with several risks in the high-likelihood, high-impact quadrant. What is the most appropriate action for the risk owner?

Accepted Answer

Evaluate current controls and consider additional treatment. Controls should be evaluated for effectiveness, and if inadequate, additional risk treatment options should be considered to reduce risk to an acceptable level.

Answer

Report to the board without any analysis

Answer

Ignore the risks as they are inherent

Answer

Accept the risk without further action