CRISC Risk Response and Reporting Practice Test 5 — 15 Questions

Question 1

A risk practitioner is developing a tactical risk report for the CISO. Which TWO of the following elements should be included in the report? (Select TWO)

Accepted Answer

Control performance metrics. Tactical risk reporting typically includes control performance metrics and top risks with status. Risk heat maps and trend analyses are more strategic, and detailed logs are operational.

Answer

Long-term risk trend analysis

Answer

Risk heat map

Answer

Detailed log analysis from SIEM

Question 2

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)

Accepted Answer

Contract compliance reviews. Contract compliance reviews (A) are a key component because they verify that vendors are meeting agreed-upon service level agreements (SLAs), security clauses, and regulatory requirements. This ensures that contractual obligations, such as data protection standards and incident response timelines, are being enforced and that any deviations are identified and remediated. Without this review, the organization cannot confirm that the vendor's actual practices align with the risk posture agreed upon during onboarding.

Answer

Review of vendor's cyber insurance policy

Answer

Vendor self-assessment without validation

Question 3

Which TWO of the following are examples of continuous monitoring techniques for IT controls? (Select TWO)

Accepted Answer

Continuous SIEM monitoring for security alerts. Continuous monitoring involves automated, ongoing processes. SIEM monitoring for security alerts and automated vulnerability scanning are continuous. Quarterly audits and annual penetration tests are periodic, not continuous.

Answer

Quarterly internal audit reviews

Answer

Annual penetration testing

Answer

Monthly manual log review

Question 4

Which type of control is designed to stop an undesirable event from occurring?

Accepted Answer

Preventive control. Preventive control is designed to stop an undesirable event from occurring by enforcing policies or technical barriers before the event happens. For example, a firewall rule that blocks inbound traffic on port 23 (Telnet) prevents unauthorized remote access attempts, directly reducing the likelihood of a security incident.

Answer

Corrective control

Answer

Directive control

Answer

Detective control

Question 5

A risk practitioner is performing a cost-benefit analysis for a proposed control. The annualized loss expectancy (ALE) for a risk is currently $500,000. The proposed control will reduce the ALE by 80%, and the annual cost of the control is $150,000. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The reduction in ALE is $500,000 × 0.80 = $400,000. The annual control cost is $150,000, so net benefit = $400,000 - $150,000 = $250,000.

Answer

$100,000

Answer

$400,000

Answer

$350,000

Question 6

Which of the following is a Key Control Indicator (KCI) that measures the effectiveness of a control?

Accepted Answer

Control exception rate. A KCI measures how well a control is performing. The exception rate for a control (e.g., percentage of transactions that bypass a required approval) directly indicates control deficiencies.

Answer

Number of risk events in the last quarter

Answer

Time since last audit

Answer

Percentage of employees who completed security awareness training

Question 7

An organization uses automated SIEM rules to continuously monitor for unauthorized access attempts. This is an example of which type of monitoring?

Accepted Answer

Continuous monitoring. Continuous monitoring involves the use of automated tools, such as Security Information and Event Management (SIEM) systems, to provide real-time or near-real-time oversight of security events. In this scenario, the SIEM rules are configured to detect unauthorized access attempts as they occur, which aligns directly with the definition of continuous monitoring rather than periodic or point-in-time assessments.

Answer

Periodic control testing

Answer

Vulnerability scanning

Answer

Access review

Question 8

A Key Risk Indicator (KRI) for vulnerability management is the "average patch lag time" (number of days between patch release and deployment). In the last month, this metric increased from 15 days to 45 days. How should the risk practitioner interpret this change?

Accepted Answer

The risk level has increased because exposure to known vulnerabilities has grown.. An increase in patch lag indicates that vulnerabilities remain unpatched longer, increasing the likelihood of exploitation. This is a leading indicator of rising risk.

Answer

The KRI is not relevant because patch lag is a control indicator, not a risk indicator.

Answer

The risk level has decreased because patches are being evaluated more thoroughly.

Answer

The risk level remains unchanged because patch lag is a lagging indicator.

Question 9

Which of the following best describes the purpose of tactical risk reporting?

Accepted Answer

To enable the CISO to make informed decisions about risk mitigation priorities. Tactical risk reporting is designed to provide mid-level management, such as the CISO, with actionable insights to prioritize risk mitigation activities. It focuses on operational risk decisions, not strategic oversight or daily metrics, enabling informed choices about resource allocation and remediation timelines.

Answer

To satisfy regulatory compliance requirements

Answer

To inform the board of directors about strategic risk exposure

Answer

To provide daily operational metrics to system administrators

Question 10

An organization is implementing a new access control system. Which of the following should be included in the control implementation plan?

Accepted Answer

Project milestones, training schedule, and documentation updates. A control implementation plan should cover all aspects of deployment, including project management, change management, user training, and documentation updates.

Answer

Annual cost of the control only

Answer

Key Risk Indicators (KRIs) for the control

Answer

Risk assessment results

Question 11

During a vendor risk assessment, a third-party vendor is classified as "critical" because it has access to sensitive customer data. According to the organization's risk appetite, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor with access to sensitive customer data because it provides an independent, audited assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. This aligns with the organization's risk appetite by ensuring that the vendor has demonstrated effective controls in place to protect sensitive data, rather than relying on a point-in-time test or self-reported information.

Answer

General liability insurance certificate

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 12

An organization's risk committee reviews a risk heat map showing that a key IT risk has moved from the "high" to "medium" category. However, the associated control's effectiveness has decreased from 95% to 85%. What is the most likely explanation?

Accepted Answer

The inherent risk has decreased due to external factors.. The risk heat map shows a reduction in residual risk from high to medium, yet the control effectiveness dropped from 95% to 85%. This apparent contradiction is best explained by a decrease in inherent risk—the risk before controls are applied. If inherent risk falls (e.g., due to external factors like new regulations or reduced threat activity), the residual risk can decrease even if the control becomes less effective, because the starting risk level is lower.

Answer

The control testing frequency was increased.

Answer

The risk assessment methodology was changed.

Answer

The control owner has implemented additional compensating controls.

Question 13

Which of the following is a key element of promoting a risk-aware culture within an IT department?

Accepted Answer

Establishing an anonymous incident reporting system. A risk-aware culture encourages employees to report incidents and near-misses without fear of blame, fostering learning and improvement.

Answer

Outsourcing risk management to a third party

Answer

Conducting annual performance reviews

Answer

Requiring employees to sign non-disclosure agreements

Question 14

A company is integrating its IT risk management program with the enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It provides a holistic view of risk across the organization.. Integration ensures that IT risks are considered in the context of overall organizational objectives and that risk responses are aligned across the enterprise.

Answer

It allows IT to operate independently from business units.

Answer

It eliminates the requirement for a separate IT risk register.

Answer

It reduces the need for IT-specific risk assessments.

Question 15

Which control implementation activity involves updating system configurations and user access rights when a new security tool is deployed?

Accepted Answer

Change management. Deploying a new security tool requires updating system configurations and user access rights, which directly impacts the operational environment. Change management (Option D) is the formal process that governs these modifications to ensure they are authorized, tested, and documented, minimizing risk of disruption or security gaps. This aligns with the CRISC domain of Risk Response and Reporting, where controlled changes are a key risk mitigation activity.

Answer

User training

Answer

Project management

Answer

Documentation update