CRISC Risk Response and Reporting Practice Test 2 — 15 Questions

Question 1

A Key Risk Indicator (KRI) for a critical system is the number of unpatched vulnerabilities older than 30 days. The threshold is set at 5. This KRI is best described as:

Accepted Answer

A leading indicator of vulnerability risk. The KRI measures the number of unpatched vulnerabilities older than 30 days, which is a forward-looking metric indicating the potential for future exploitation. Because it signals increasing exposure before a breach occurs, it is a leading indicator of vulnerability risk. Thresholds on such indicators allow proactive management before incidents happen.

Answer

A Key Control Indicator (KCI)

Answer

A measure of residual risk

Answer

A lagging indicator of control effectiveness

Question 2

During a quarterly control effectiveness test, internal audit discovers that a key automated control failed 15% of the time due to a software bug. The risk owner decides to accept the risk because the cost to fix the bug is high. What should the risk manager do next?

Accepted Answer

Document the risk acceptance and rationale in the risk register. The risk manager's primary responsibility is to formally document the risk acceptance decision, including the rationale provided by the risk owner, in the risk register. This ensures audit trail, transparency, and compliance with governance frameworks such as COBIT or ISO 31000. Since the risk owner has the authority to accept the risk, the risk manager must record it rather than challenge or escalate it without justification.

Answer

Implement a compensating control

Answer

Override the risk owner's decision

Answer

Report the issue to the board immediately

Question 3

An organization is developing a vendor risk management program. Which THREE activities should be included in the initial onboarding assessment for a high-risk vendor?

Accepted Answer

Evaluating contract compliance requirements. Option A (Evaluating contract compliance requirements) is correct because the onboarding assessment must verify that the vendor's contractual obligations—such as SLAs, data protection clauses, breach notification terms, and right-to-audit provisions—are defined and enforceable before the relationship begins. Option B (Reviewing SOC 2 Type II report) is correct because a Type II report provides independent auditor attestation that the vendor's controls (e.g., security, availability, confidentiality) operated effectively over a defined period, which is essential evidence for a high-risk vendor. Option E (Reviewing completed security questionnaires) is correct because standardized questionnaires (e.g., SIG, CAIQ) elicit vendor-specific details on controls, data handling, and gaps that may not be fully covered by a SOC 2 report. Option C is not included because an onsite physical security inspection is typically reserved for the highest-risk or critical vendors and is not a standard initial onboarding activity for every high-risk vendor. Option D is not included because analyzing financial statements addresses vendor viability and solvency, which is a business continuity/financial risk concern rather than a core security onboarding assessment activity.

Answer

Conducting an onsite physical security inspection

Answer

Analyzing the vendor's financial statements

Question 4

A risk practitioner is designing a quarterly IT risk report for the CISO. Which of the following elements is MOST critical for tactical decision-making?

Accepted Answer

Control performance metrics. Control performance metrics (D) are most critical for tactical decision-making because they provide quantifiable, real-time data on how well existing security controls are operating. Tactical decisions require immediate, actionable insights—such as whether a firewall rule is blocking 95% of malicious traffic or if a patch management process is meeting its 30-day SLA—rather than high-level summaries or future projections. Without control metrics, the CISO cannot assess the effectiveness of current defenses or prioritize remediation efforts.

Answer

Top risks and status

Answer

Risk heat map

Answer

Upcoming risk events

Question 5

Which of the following is the BEST Key Control Indicator (KCI) for measuring the effectiveness of a firewall?

Accepted Answer

Percentage of blocked intrusion attempts. The percentage of blocked intrusion attempts directly measures how effectively the firewall is enforcing its security policies to prevent unauthorized access. A high block rate indicates the firewall is correctly identifying and stopping threats, making it the most direct KCI for firewall effectiveness.

Answer

Time since last firewall firmware update

Answer

Number of firewall rule changes per month

Answer

Number of firewall alerts generated

Question 6

During a quarterly control effectiveness test, an internal auditor discovers that a key preventive control has a 10% exception rate. The control is designed to prevent unauthorized transactions. Which Key Control Indicator (KCI) is being measured?

Accepted Answer

Exception rate. KCIs measure control performance. The exception rate is a KCI that indicates how often the control fails to operate as intended.

Answer

Key Risk Indicator (KRI)

Answer

Test result pass rate

Answer

Control deficiency rate

Question 7

The Chief Information Security Officer (CISO) receives a quarterly report that includes a risk heat map and trend analysis of top risks. This type of reporting is best described as:

Accepted Answer

Tactical risk reporting. Tactical risk reporting focuses on the medium-term, business-unit or program-level view of risk — heat maps and trend analyses of top risks delivered quarterly to senior management (like a CISO) fit this cadence and scope. It bridges the strategic (board-level, long-horizon) and operational (day-to-day, transaction-level) layers by translating risk data into actionable priorities for management. The quarterly frequency and top-risk trend focus are hallmarks of tactical reporting.

Answer

Operational risk reporting

Answer

Strategic risk reporting

Answer

Compliance reporting

Question 8

When implementing a new control, which of the following is the most important factor in ensuring its long-term effectiveness?

Accepted Answer

Updating documentation. Updating documentation is the most critical factor for long-term control effectiveness because it ensures the control's design, operation, and maintenance are formally recorded and can be consistently understood, audited, and repeated over time. Without current documentation, the control may degrade as personnel change, processes evolve, or audits fail due to lack of evidence. Documentation provides the baseline for monitoring, training, and continuous improvement, making it foundational to sustainability.

Answer

Selecting a control owner

Answer

Conducting user training

Answer

Performing cost-benefit analysis

Question 9

An organization has implemented a new control that requires manual approval for all high-value transactions. The control owner is responsible for ensuring approvals are obtained. Which control ownership aspect is demonstrated?

Accepted Answer

Control ownership. The scenario explicitly states that the control owner is responsible for ensuring approvals are obtained, which directly demonstrates the concept of control ownership. Control ownership refers to the assignment of accountability for the implementation, operation, and maintenance of a specific control, such as manual approval for high-value transactions. This is a core principle in risk response, where a named individual is accountable for the control's effectiveness, not just its implementation or cost.

Answer

Control implementation plan

Answer

Cost-benefit analysis

Answer

Resource requirements

Question 10

An organization is implementing a risk-aware culture. Which TWO of the following are effective practices?

Accepted Answer

Encourage incident reporting without fear of blame.. Option B is correct because a blame-free (non-punitive) incident reporting culture encourages employees to report errors, near misses, and security events promptly, which increases visibility of risks and enables faster containment and remediation. Option D is correct because 'tone from the top' means executive leadership visibly sponsors and models risk management through policies, resources, governance, and decisions, which is essential for embedding a risk-aware culture across the organization. Option A is not sufficient because annual training alone is a compliance-oriented, point-in-time activity and does not by itself create continuous risk awareness or change behavior. Option C, while helpful, is not one of the marked correct answers here and incentives alone can be gamed or misaligned without leadership commitment and open reporting. Option E is wrong because blaming individuals suppresses reporting, drives problems underground, and directly undermines a risk-aware culture.

Answer

Conduct annual security awareness training only.

Answer

Provide incentives for risk identification.

Answer

Blame individuals for incidents to deter future occurrences.

Question 11

Which TWO of the following are examples of continuous monitoring techniques?

Accepted Answer

Automated SIEM rules for intrusion detection.. Option B is correct because automated SIEM rules for intrusion detection provide ongoing, real-time collection and correlation of security events, which is the essence of continuous monitoring. Option E is correct because vulnerability scanning performed weekly is a recurring, automated technical assessment that continuously tracks the exposure of systems over time. In contrast, option A is incorrect because ad-hoc access reviews are event-driven and sporadic rather than continuous. Option C is incorrect because an annual risk assessment is a point-in-time, low-frequency activity. Option D is incorrect because quarterly control testing by internal audit is periodic and not continuous monitoring.

Answer

Ad-hoc access reviews requested by management.

Answer

Annual risk assessment.

Answer

Quarterly control testing by internal audit.

Question 12

Which of the following is an example of a corrective control?

Accepted Answer

Restoring data from backup after a ransomware attack. Corrective controls are designed to remediate or reverse the effects of an incident after it has occurred. Restoring data from backup after a ransomware attack directly addresses the damage by recovering lost or encrypted data, making it a classic corrective control. In contrast, preventive controls (like firewalls) block incidents before they happen, and detective controls (like IDS alerts or log monitoring) identify incidents after they occur but do not fix the damage.

Answer

Firewall blocking unauthorized traffic

Answer

Intrusion detection system alerting on suspicious activity

Answer

Log monitoring to identify unauthorized access

Question 13

During a third-party risk assessment, a vendor is classified as 'critical' due to its access to sensitive customer data. According to the organization's vendor risk appetite, what is the minimum security requirement for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor because it provides an independent audit of controls over security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6–12 months). This aligns with the organization's risk appetite for sensitive customer data, as it offers more assurance than a point-in-time assessment or self-report.

Answer

Annual compliance attestation

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 14

A vendor risk tier is assigned based on data access and service criticality. A vendor that processes sensitive customer data and is critical to operations should be classified as which tier?

Accepted Answer

Critical tier. A vendor that processes sensitive customer data and is critical to operations poses the highest level of risk to the organization. Under the CRISC framework, such a vendor is classified as Critical tier because the combination of high data sensitivity and operational criticality requires the most stringent risk management controls, including enhanced due diligence, continuous monitoring, and contractual safeguards. This tier ensures that the highest priority vendors receive the most rigorous oversight to mitigate potential impacts on confidentiality, integrity, and availability.

Answer

High tier

Answer

Low tier

Answer

Medium tier

Question 15

An organization is conducting a post-implementation review of a new data loss prevention (DLP) control. Which TWO metrics are Key Control Indicators (KCIs) that would best measure the control's effectiveness?

Accepted Answer

Percentage of DLP policy violations that were not blocked. The percentage of DLP policy violations that were not blocked directly measures the control's failure rate—its inability to prevent unauthorized data exfiltration. A high percentage indicates ineffective policy configuration or insufficient detection coverage, making it a key control indicator (KCI) for effectiveness. Option E is correct because the number of authorized exceptions to DLP policies reflects how often the control is deliberately bypassed, which can indicate gaps in policy design or excessive risk acceptance, both of which undermine the control's intended effectiveness.

Answer

Cost of the DLP solution per year

Answer

Average time to respond to DLP incidents

Answer

Number of DLP alerts generated per day