CRISC Risk Response and Reporting Practice Test 5 — 15 Questions

Question 1

An organization's risk report shows a risk heat map with several risks in the high-likelihood, high-impact quadrant. What is the most appropriate action for the risk owner?

Accepted Answer

Evaluate current controls and consider additional treatment. Risks in the high-likelihood, high-impact quadrant exceed the organization's risk appetite and require active treatment. The risk owner should first evaluate the effectiveness of existing controls, then consider additional treatment options (mitigate, transfer, avoid, or accept with justification). Simply accepting or ignoring high-exposure risks is not defensible risk management.

Answer

Report to the board without any analysis

Answer

Ignore the risks as they are inherent

Answer

Accept the risk without further action

Question 2

An IT risk manager is developing KRIs for a critical application. Which TWO of the following are leading indicators that the risk level may be increasing? (Select TWO)

Accepted Answer

Average patch lag time increasing. Option A (Average patch lag time increasing) is correct because a growing delay between patch release and deployment is a leading indicator: it signals accumulating unpatched vulnerabilities and weakening patch management before any exploit or incident occurs. Option B (Failed authentication spike) is correct because a sudden rise in failed logons is a leading indicator of credential-stuffing, brute-force, or password-spraying activity, which precedes a potential account compromise. Option C is a lagging indicator because audit findings document control deficiencies that already exist, reflecting past state rather than predicting future risk increase. Option D is a lagging indicator since successful intrusions are realized events that have already occurred. Option E is also lagging because counting past security incidents measures historical impact, not forward-looking risk trajectory.

Answer

Audit findings of control deficiencies

Answer

Number of successful intrusions

Answer

Number of security incidents in the past month

Question 3

Which type of control is primarily designed to prevent an unwanted event from occurring?

Accepted Answer

Preventive control. A preventive control is designed to stop an unwanted event from occurring in the first place, such as a firewall blocking malicious traffic or a lock preventing unauthorized access. It acts before the event, unlike detective or corrective controls that act after.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 4

During a cost-benefit analysis for a new control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce risk by 80% and will cost $150,000 annually to operate. What is the net benefit of implementing the control?

Accepted Answer

$250,000. ALE reduction is 80% of $500,000 = $400,000. Net benefit = ALE reduction - annual control cost = $400,000 - $150,000 = $250,000.

Answer

$400,000

Answer

$100,000

Answer

$350,000

Question 5

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

Accepted Answer

Conduct a root cause analysis of the deficiencies. A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Answer

Report the deficiency to the board for oversight

Answer

Increase the frequency of control testing to monthly

Answer

Immediately replace the control with a more robust one

Question 6

Which of the following is a Key Risk Indicator (KRI) that provides leading indication of increasing vulnerability risk?

Accepted Answer

Patch lag metric. Patch lag metric is a leading KRI because it measures the time between patch availability and deployment, directly indicating how exposed systems are to known vulnerabilities before exploitation occurs. A growing patch lag signals increasing vulnerability risk before incidents materialize.

Answer

Control deficiency rate

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 7

In IT risk reporting, which level of management typically receives operational risk reporting on a weekly or monthly basis?

Accepted Answer

IT management. IT management is the level that typically receives operational risk reporting on a weekly or monthly cadence because they own the day-to-day operation of systems and controls. Operational risk reports at this frequency give IT managers the detail needed to act on incidents, vulnerabilities, and control gaps. Higher-level audiences receive more aggregated and less frequent reporting.

Answer

External auditors

Answer

Board of directors

Answer

CISO/CIO

Question 8

A company is implementing a new access control system. During the project, the IT team updates the system configuration without notifying the risk team. This leads to a temporary misconfiguration that exposes sensitive data. Which process should have been followed to prevent this issue?

Accepted Answer

Change management process. The change management process is the correct answer because it is the formal ITIL/COBIT-aligned control that ensures all configuration changes to production systems are requested, assessed for risk impact, approved by relevant stakeholders (including the risk team), tested, and documented before implementation. In this scenario, the IT team bypassed this process by updating the access control system configuration without notifying the risk team, which is precisely the failure mode change management is designed to prevent. A properly executed change management workflow would have triggered a risk assessment and impact analysis, flagging the sensitive data exposure before the misconfiguration reached production.

Answer

Control design approval

Answer

Continuous monitoring

Answer

Vendor risk assessment

Question 9

In third-party risk management, which of the following is typically used for initial onboarding assessment of a vendor?

Accepted Answer

Security questionnaire. Security questionnaires are commonly used during initial vendor assessment to gather information about the vendor's security posture.

Answer

Contract compliance review

Answer

SOC 2 Type II report

Answer

Shared intelligence platform feed

Question 10

An organization wants to promote a risk-aware culture. Which of the following actions is MOST effective for encouraging employees to report incidents without fear?

Accepted Answer

Establish a non-punitive incident reporting policy. A non-punitive incident reporting policy directly removes the fear of retaliation or blame, which is the primary barrier to reporting. By guaranteeing that employees will not be punished for reporting incidents (including their own mistakes), the organization encourages transparency and timely disclosure. This aligns with CRISC principles of fostering a risk-aware culture where risk information flows freely. Other options do not address the fear factor; rewards for zero incidents can actually discourage reporting, automated tools don't change human behavior, and annual training is insufficient to build trust.

Answer

Reward employees for zero incidents

Answer

Implement automated monitoring tools

Answer

Conduct security awareness training annually

Question 11

During a vendor risk tiering exercise, a vendor that stores the organization's customer PII and is critical for daily operations should be classified as which tier?

Accepted Answer

Critical. Vendors with access to sensitive data and high service criticality are typically classified as critical (highest tier).

Answer

Medium

Answer

High

Answer

Low

Question 12

What is the primary purpose of a risk heat map in IT risk reporting?

Accepted Answer

Provide a visual representation of risk levels. A risk heat map visualizes risks based on likelihood and impact, helping prioritize attention.

Answer

Show control performance metrics

Answer

Display risk trends over time

Answer

List upcoming risk events

Question 13

In the context of IT risk reporting to the board, which THREE elements should be included to effectively communicate risk?

Accepted Answer

Top risks and status. Option B (Top risks and status) is correct because board-level reporting must prioritize the most significant risks and their current mitigation status, giving directors a concise view of what threatens organizational objectives and how management is responding. Option C (Risk heat map) is correct because a heat map visually plots risks by likelihood and impact, enabling the board to quickly grasp relative exposure and prioritize attention without wading through technical detail. Option E (Risk trend analysis) is correct because showing how risk levels change over time (e.g., increasing, stable, or decreasing) demonstrates whether risk management is effective and supports forward-looking governance decisions. Option A (Detailed technical logs) does not belong because raw logs are operational artifacts for IT staff, not strategic governance information, and would overwhelm the board with irrelevant granularity. Option D (Employee performance reviews) does not belong because individual HR performance data is unrelated to enterprise risk communication and would be inappropriate to present in a board risk report.

Answer

Detailed technical logs

Answer

Employee performance reviews

Question 14

Which TWO methods are commonly used for continuous monitoring of IT controls?

Accepted Answer

SIEM rules for automated testing. SIEM rules for automated testing (A) are correct because SIEM platforms continuously correlate and analyze log and event data against detection rules, providing real-time, automated monitoring of IT controls such as access violations, configuration changes, and policy breaches. Vulnerability scanning (D) is correct because it is run on a recurring, often automated schedule to continuously identify weaknesses in systems and applications, feeding ongoing control-monitoring and remediation processes. Board risk review (B) is not continuous monitoring; it is a periodic governance activity conducted at scheduled intervals. Annual control self-assessment (C) is a point-in-time, yearly exercise and therefore not continuous. Quarterly internal audit (E) is a periodic assurance activity performed at defined intervals, not real-time or continuous monitoring.

Answer

Board risk review

Answer

Annual control self-assessment

Answer

Quarterly internal audit

Question 15

Which type of control is designed to operate before an event to prevent an undesirable outcome?

Accepted Answer

Preventive control. A preventive control is designed to operate before an event to stop an undesirable outcome from occurring. In risk management, this includes measures such as firewalls blocking unauthorized traffic before it reaches the internal network, or access control lists (ACLs) preventing unauthorized users from reading sensitive files. These controls proactively enforce security policies to reduce the likelihood of a risk event.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control