CRISC Risk Response and Reporting Practice Test 3 — 15 Questions

Question 1

An organization is designing a vendor risk management program. Which TWO of the following are essential components of ongoing vendor monitoring? (Select TWO)

Accepted Answer

Continuous monitoring via shared threat intelligence platforms. Continuous monitoring via shared threat intelligence platforms (Option D) is essential because it provides real-time visibility into emerging threats and vulnerabilities that may affect the vendor's environment. This allows the organization to proactively adjust risk posture without waiting for periodic reviews, aligning with the CRISC principle of ongoing risk response.

Answer

Review of contract terms

Answer

Penetration testing by the vendor

Answer

Initial onboarding security questionnaire

Question 2

An IT risk manager is developing KRIs for a critical application. Which TWO of the following are leading indicators that the risk level may be increasing? (Select TWO)

Accepted Answer

Average patch lag time increasing. Leading indicators predict future risk. A rising number of failed login attempts and an increase in average patch lag are leading indicators that signal potential attacks or increased vulnerability.

Answer

Audit findings of control deficiencies

Answer

Number of successful intrusions

Answer

Number of security incidents in the past month

Question 3

Which THREE of the following are common elements of a periodic control effectiveness testing program? (Select THREE)

Accepted Answer

Quarterly control testing by the risk function. Periodic testing includes internal audit reviews, quarterly testing by the risk function, and annual penetration tests. Continuous monitoring is not periodic, and user training is not a testing activity.

Answer

User training on new controls

Answer

Continuous monitoring via SIEM

Question 4

Which type of control is primarily designed to prevent an unwanted event from occurring?

Accepted Answer

Preventive control. Preventive controls are implemented to deter or avoid potential risks before they materialize.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 5

During a cost-benefit analysis for a new control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce risk by 80% and will cost $150,000 annually to operate. What is the net benefit of implementing the control?

Accepted Answer

$250,000. ALE reduction is 80% of $500,000 = $400,000. Net benefit = ALE reduction - annual control cost = $400,000 - $150,000 = $250,000.

Answer

$400,000

Answer

$100,000

Answer

$350,000

Question 6

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

Accepted Answer

Conduct a root cause analysis of the deficiencies. A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Answer

Report the deficiency to the board for oversight

Answer

Increase the frequency of control testing to monthly

Answer

Immediately replace the control with a more robust one

Question 7

Which of the following is a Key Risk Indicator (KRI) that provides leading indication of increasing vulnerability risk?

Accepted Answer

Patch lag metric. Patch lag (time since last patch) is a leading indicator that systems are exposed to known vulnerabilities.

Answer

Control deficiency rate

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 8

In IT risk reporting, which level of management typically receives operational risk reporting on a weekly or monthly basis?

Accepted Answer

IT management. Operational risk reporting is detailed and frequent, intended for IT management who oversee day-to-day operations.

Answer

External auditors

Answer

Board of directors

Answer

CISO/CIO

Question 9

A company is implementing a new access control system. During the project, the IT team updates the system configuration without notifying the risk team. This leads to a temporary misconfiguration that exposes sensitive data. Which process should have been followed to prevent this issue?

Accepted Answer

Change management process. Change management ensures that modifications to systems are authorized, reviewed, and communicated to relevant stakeholders to avoid unintended consequences.

Answer

Control design approval

Answer

Continuous monitoring

Answer

Vendor risk assessment

Question 10

In third-party risk management, which of the following is typically used for initial onboarding assessment of a vendor?

Accepted Answer

Security questionnaire. Security questionnaires are commonly used during initial vendor assessment to gather information about the vendor's security posture.

Answer

Contract compliance review

Answer

SOC 2 Type II report

Answer

Shared intelligence platform feed

Question 11

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). Intrusion detection systems (IDS) monitor network traffic and alert on suspicious activity after it occurs.

Answer

Backup and recovery plan

Answer

Firewall

Answer

Data encryption

Question 12

An organization wants to promote a risk-aware culture. Which of the following actions is MOST effective for encouraging employees to report incidents without fear?

Accepted Answer

Establish a non-punitive incident reporting policy. A blame-free environment encourages reporting by reducing fear of punishment.

Answer

Reward employees for zero incidents

Answer

Implement automated monitoring tools

Answer

Conduct security awareness training annually

Question 13

During a vendor risk tiering exercise, a vendor that stores the organization's customer PII and is critical for daily operations should be classified as which tier?

Accepted Answer

Critical. Vendors with access to sensitive data and high service criticality are typically classified as critical (highest tier).

Answer

Medium

Answer

High

Answer

Low

Question 14

Which of the following is a leading indicator that the risk of a credential-based attack may be increasing?

Accepted Answer

Failed authentication spike. A failed authentication spike is a leading indicator because it directly signals an increase in attempted unauthorized access, often from credential stuffing or brute-force attacks. Unlike lagging indicators that measure past incidents, this metric provides early warning that the risk of a credential-based attack is rising, allowing proactive controls like account lockout policies or CAPTCHA challenges to be implemented before a breach occurs.

Answer

Increased number of successful logins

Answer

Low patch compliance

Answer

High mean time to resolve incidents

Question 15

What is the primary purpose of a risk heat map in IT risk reporting?

Accepted Answer

Provide a visual representation of risk levels. A risk heat map visualizes risks based on likelihood and impact, helping prioritize attention.

Answer

Show control performance metrics

Answer

Display risk trends over time

Answer

List upcoming risk events