CRISC Risk Response and Reporting Practice Test 4 — 15 Questions

Question 1

An organization is implementing a new control to address a high-risk vulnerability. Which TWO factors are MOST important to consider during the control implementation planning phase?

Accepted Answer

Resource requirements. Resource requirements (budget, personnel) and a clear implementation plan are critical to successful deployment.

Answer

Vendor reputation

Answer

Industry best practices

Answer

Number of previous incidents

Question 2

In the context of IT risk reporting to the board, which THREE elements should be included to effectively communicate risk?

Accepted Answer

Top risks and status. A risk heat map, top risks and status, and risk trend analysis help the board understand the current and evolving risk landscape.

Answer

Detailed technical logs

Answer

Employee performance reviews

Question 3

Which TWO methods are commonly used for continuous monitoring of IT controls?

Accepted Answer

SIEM rules for automated testing. Automated SIEM rules and vulnerability scanning are typical continuous monitoring techniques.

Answer

Board risk review

Answer

Annual control self-assessment

Answer

Quarterly internal audit

Question 4

Which type of control is designed to operate before an event to prevent an undesirable outcome?

Accepted Answer

Preventive control. A preventive control is designed to operate before an event to stop an undesirable outcome from occurring. In risk management, this includes measures such as firewalls blocking unauthorized traffic before it reaches the internal network, or access control lists (ACLs) preventing unauthorized users from reading sensitive files. These controls proactively enforce security policies to reduce the likelihood of a risk event.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 5

An organization is evaluating a new security control that costs $50,000 annually to implement and maintain. The current annualized loss expectancy (ALE) for a related risk is $200,000. The control is expected to reduce the ALE by 85%. Using cost-benefit analysis, what is the net benefit of implementing this control?

Accepted Answer

$120,000. The reduction in ALE is 85% of $200,000 = $170,000. The annual control cost is $50,000. Net benefit = $170,000 - $50,000 = $120,000.

Answer

$30,000

Answer

$170,000

Answer

$150,000

Question 6

A Key Control Indicator (KCI) for a critical firewall rule set shows an exception rate of 12% over the past month, exceeding the acceptable threshold of 5%. The control owner is responsible for remediation. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a root cause analysis of the exceptions. The first step in addressing an elevated KCI is to investigate the root cause of the exceptions to determine if they are due to rule misconfigurations, policy violations, or other issues before taking corrective action.

Answer

Temporarily disable the firewall rules causing exceptions

Answer

Implement an automated rule change management process

Answer

Update the KCI threshold to 12%

Question 7

An organization’s continuous monitoring program includes automated vulnerability scanning and log review. Which of the following is a Key Risk Indicator (KRI) that would BEST signal an increasing risk of a successful network breach?

Accepted Answer

Spike in failed authentication attempts from external IPs. A KRI should be leading, indicating a change in risk level. A spike in failed authentication attempts often precedes a brute force attack or credential compromise, signaling increased risk of breach.

Answer

Average time to patch critical vulnerabilities

Answer

Number of firewall rule changes per month

Answer

Percentage of systems with up-to-date antivirus signatures

Question 8

During a quarterly control effectiveness test, internal audit finds that a detective control missed 15% of security incidents. The control owner claims this is within the acceptable error rate of 20%. However, the risk practitioner notes that the missed incidents were high-severity. What should the risk practitioner do?

Accepted Answer

Escalate the findings to senior management with a recommendation to enhance the control. The risk practitioner should escalate the findings to senior management with a recommendation to enhance the control because the detective control's failure to detect 15% of incidents, while within the 20% acceptable error rate, specifically missed high-severity incidents. High-severity incidents pose a disproportionate risk to the organization, and a control that fails to detect them is not effective in mitigating critical risks, regardless of meeting a generic threshold. Escalation ensures that management is aware of the residual risk and can authorize appropriate enhancements, such as tuning the control's detection logic or implementing additional monitoring for high-severity events.

Answer

Accept the control as effective since it is within the threshold

Answer

Implement a compensating control to cover high-severity incidents

Answer

Recommend revising the KCI threshold to include severity weighting

Question 9

Which risk reporting level is typically provided to the board of directors and focuses on strategic risk posture?

Accepted Answer

Strategic risk reporting. Strategic risk reporting is the correct level for the board of directors because it focuses on high-level, long-term risks that could affect the organization's strategic objectives and overall business posture. Unlike tactical or operational reports, strategic reports aggregate risk data into a format that supports governance, risk appetite decisions, and capital allocation at the executive level.

Answer

Tactical risk reporting

Answer

Compliance risk reporting

Answer

Operational risk reporting

Question 10

An organization is implementing a new access control system. The project manager is concerned about delays due to user training requirements. Which of the following should the risk practitioner prioritize to ensure effective control implementation?

Accepted Answer

Ensure user training is completed before go-live. User training is a critical success factor for access control systems because misconfigured or improperly used controls can lead to security gaps. Ensuring training is completed before go-live (Option D) aligns with the principle that a control is only effective if users understand how to operate it correctly, preventing human error that could bypass the control's intended protections.

Answer

Accelerate the deployment to meet the project deadline

Answer

Implement a compensating control to reduce training requirements

Answer

Delay the entire project until training can be completed

Question 11

A third-party vendor has been tiered as 'high risk' due to access to sensitive customer data. The vendor's SOC 2 Type II report has a qualified opinion on security controls. The vendor risk appetite requires unqualified SOC 2 Type II for critical vendors. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to remediate the issues and provide an updated report within a defined timeframe. If a vendor does not meet the minimum security requirements for its tier, and the organization cannot accept the risk, the appropriate response is to remediate by requiring the vendor to address the qualification or find an alternative vendor that meets the requirements.

Answer

Accept the qualified report and continue monitoring

Answer

Implement additional compensating controls on the organization's side

Answer

Downgrade the vendor to medium risk tier

Question 12

Which of the following is an example of a leading Key Risk Indicator (KRI) for IT risk?

Accepted Answer

Percentage of systems with missing critical patches. A leading Key Risk Indicator (KRI) predicts future risk events by measuring conditions that precede incidents. Missing critical patches on systems directly indicate a higher likelihood of exploitation, making it a leading indicator. In contrast, lagging KRIs like incident counts or costs measure outcomes after the fact.

Answer

Number of audit findings resolved

Answer

Number of security incidents this quarter

Answer

Total cost of security incidents

Question 13

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). Detective controls identify incidents after they occur. An intrusion detection system (IDS) monitors network traffic and alerts on suspicious activity, making it a detective control.

Answer

Firewall

Answer

Backup and recovery procedure

Answer

Data encryption

Question 14

During a vendor risk assessment, an organization discovers that a critical vendor has not performed a security assessment in two years. The vendor is tiered as 'medium risk'. According to best practices, what should the risk practitioner recommend?

Accepted Answer

Request a current SOC 2 report or equivalent assessment. A SOC 2 report (or equivalent, such as an ISO 27001 certification or a SIG assessment) provides independent assurance over a vendor's controls, including security monitoring and assessment cadence. Since the vendor is tiered as 'medium risk' and has not performed a security assessment in two years, the risk practitioner should request current evidence of control effectiveness rather than accept, ignore, or escalate the risk prematurely. This aligns with the CRISC principle of verifying control status before making risk response decisions.

Answer

Downgrade the vendor to low risk to reduce monitoring frequency

Answer

Accept the risk because the vendor is only medium risk

Answer

Terminate the relationship immediately

Question 15

An organization has a risk culture where employees are hesitant to report security incidents due to fear of blame. Which of the following initiatives would MOST effectively promote a risk-aware culture?

Accepted Answer

Establish a confidential incident reporting system with a no-blame policy. To encourage incident reporting, the organization should foster a no-blame culture. Implementing an anonymous reporting mechanism removes fear of reprisal and encourages employees to report incidents without fear of blame.

Answer

Increase the frequency of security awareness training

Answer

Conduct more frequent audits to detect unreported incidents

Answer

Discipline employees who fail to report incidents