CRISC Risk Response and Reporting Practice Test 6 — 15 Questions

Question 1

An organization is evaluating a new security control that costs $50,000 annually to implement and maintain. The current annualized loss expectancy (ALE) for a related risk is $200,000. The control is expected to reduce the ALE by 85%. Using cost-benefit analysis, what is the net benefit of implementing this control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$120,000. The reduction in ALE is 85% of $200,000 = $170,000. The annual control cost is $50,000. Net benefit = $170,000 - $50,000 = $120,000.

Answer

$30,000

Answer

$170,000

Answer

$150,000

Question 2

A Key Control Indicator (KCI) for a critical firewall rule set shows an exception rate of 12% over the past month, exceeding the acceptable threshold of 5%. The control owner is responsible for remediation. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a root cause analysis of the exceptions. The first step in addressing an elevated KCI is to investigate the root cause of the exceptions to determine if they are due to rule misconfigurations, policy violations, or other issues before taking corrective action.

Answer

Temporarily disable the firewall rules causing exceptions

Answer

Implement an automated rule change management process

Answer

Update the KCI threshold to 12%

Question 3

An organization’s continuous monitoring program includes automated vulnerability scanning and log review. Which of the following is a Key Risk Indicator (KRI) that would BEST signal an increasing risk of a successful network breach?

Accepted Answer

Spike in failed authentication attempts from external IPs. A Key Risk Indicator (KRI) is a forward-looking metric that signals changes in risk exposure. A spike in failed authentication attempts from external IPs is a leading indicator of attempted unauthorized access — such as brute-force or credential-stuffing attacks — and directly signals increasing likelihood of a successful network breach. It is actionable and tied to a specific threat vector.

Answer

Average time to patch critical vulnerabilities

Answer

Number of firewall rule changes per month

Answer

Percentage of systems with up-to-date antivirus signatures

Question 4

During a quarterly control effectiveness test, internal audit finds that a detective control missed 15% of security incidents. The control owner claims this is within the acceptable error rate of 20%. However, the risk practitioner notes that the missed incidents were high-severity. What should the risk practitioner do?

Accepted Answer

Escalate the findings to senior management with a recommendation to enhance the control. The risk practitioner should escalate the findings to senior management with a recommendation to enhance the control because the detective control's failure to detect 15% of incidents, while within the 20% acceptable error rate, specifically missed high-severity incidents. High-severity incidents pose a disproportionate risk to the organization, and a control that fails to detect them is not effective in mitigating critical risks, regardless of meeting a generic threshold. Escalation ensures that management is aware of the residual risk and can authorize appropriate enhancements, such as tuning the control's detection logic or implementing additional monitoring for high-severity events.

Answer

Accept the control as effective since it is within the threshold

Answer

Implement a compensating control to cover high-severity incidents

Answer

Recommend revising the KCI threshold to include severity weighting

Question 5

Which risk reporting level is typically provided to the board of directors and focuses on strategic risk posture?

Accepted Answer

Strategic risk reporting. Strategic risk reporting is the correct level for the board of directors because it focuses on high-level, long-term risks that could affect the organization's strategic objectives and overall business posture. Unlike tactical or operational reports, strategic reports aggregate risk data into a format that supports governance, risk appetite decisions, and capital allocation at the executive level.

Answer

Tactical risk reporting

Answer

Compliance risk reporting

Answer

Operational risk reporting

Question 6

An organization is implementing a new access control system. The project manager is concerned about delays due to user training requirements. Which of the following should the risk practitioner prioritize to ensure effective control implementation?

Accepted Answer

Ensure user training is completed before go-live. User training is a critical success factor for access control systems because misconfigured or improperly used controls can lead to security gaps. Ensuring training is completed before go-live (Option D) aligns with the principle that a control is only effective if users understand how to operate it correctly, preventing human error that could bypass the control's intended protections.

Answer

Accelerate the deployment to meet the project deadline

Answer

Implement a compensating control to reduce training requirements

Answer

Delay the entire project until training can be completed

Question 7

Which of the following is an example of a leading Key Risk Indicator (KRI) for IT risk?

Accepted Answer

Percentage of systems with missing critical patches. A leading Key Risk Indicator (KRI) predicts future risk events by measuring conditions that precede incidents. Missing critical patches on systems directly indicate a higher likelihood of exploitation, making it a leading indicator. In contrast, lagging KRIs like incident counts or costs measure outcomes after the fact.

Answer

Number of audit findings resolved

Answer

Number of security incidents this quarter

Answer

Total cost of security incidents

Question 8

During a vendor risk assessment, an organization discovers that a critical vendor has not performed a security assessment in two years. The vendor is tiered as 'medium risk'. According to best practices, what should the risk practitioner recommend?

Accepted Answer

Request a current SOC 2 report or equivalent assessment. A SOC 2 report (or equivalent, such as an ISO 27001 certification or a SIG assessment) provides independent assurance over a vendor's controls, including security monitoring and assessment cadence. Since the vendor is tiered as 'medium risk' and has not performed a security assessment in two years, the risk practitioner should request current evidence of control effectiveness rather than accept, ignore, or escalate the risk prematurely. This aligns with the CRISC principle of verifying control status before making risk response decisions.

Answer

Downgrade the vendor to low risk to reduce monitoring frequency

Answer

Accept the risk because the vendor is only medium risk

Answer

Terminate the relationship immediately

Question 9

An organization has a risk culture where employees are hesitant to report security incidents due to fear of blame. Which of the following initiatives would MOST effectively promote a risk-aware culture?

Accepted Answer

Establish a confidential incident reporting system with a no-blame policy. Establishing a confidential incident reporting system with a no-blame policy directly addresses the root cause — fear of blame — by removing the deterrent to reporting. This creates psychological safety, which is a prerequisite for a healthy risk-aware culture where employees surface issues early.

Answer

Increase the frequency of security awareness training

Answer

Conduct more frequent audits to detect unreported incidents

Answer

Discipline employees who fail to report incidents

Question 10

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)

Accepted Answer

Contract compliance reviews. Option A (Contract compliance reviews) is correct because an effective vendor risk assessment process must verify that the vendor continuously meets the security, privacy, and service-level obligations defined in the contract, ensuring accountability and detecting drift from agreed controls. Option B (Ongoing monitoring via annual reassessments) is correct because vendor risk is not static; periodic reassessments (at least annually, or upon significant changes) are needed to re-evaluate the vendor's security posture, financial health, and compliance status over the life of the relationship. Option D (Initial onboarding assessment including security questionnaires) is correct because due diligence before engagement is a foundational step—standardized questionnaires (e.g., SIG, CAIQ) help evaluate the vendor's controls, data handling practices, and risk level before any data or access is granted. Option C is not among the marked correct answers because, while reviewing a vendor's cyber insurance policy can be a useful supplementary check, it is not one of the core components of the risk assessment process itself. Option E is not correct because a vendor self-assessment without independent validation is insufficient—it lacks verification and objectivity, which are essential to a credible risk assessment.

Answer

Review of vendor's cyber insurance policy

Answer

Vendor self-assessment without validation

Question 11

Which type of control is designed to stop an undesirable event from occurring?

Accepted Answer

Preventive control. Preventive control is designed to stop an undesirable event from occurring by enforcing policies or technical barriers before the event happens. For example, a firewall rule that blocks inbound traffic on port 23 (Telnet) prevents unauthorized remote access attempts, directly reducing the likelihood of a security incident.

Answer

Corrective control

Answer

Directive control

Answer

Detective control

Question 12

A risk practitioner is performing a cost-benefit analysis for a proposed control. The annualized loss expectancy (ALE) for a risk is currently $500,000. The proposed control will reduce the ALE by 80%, and the annual cost of the control is $150,000. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The control reduces the ALE by 80%, so the risk reduction benefit is 0.80 × $500,000 = $400,000. The net benefit is the benefit minus the control cost: $400,000 − $150,000 = $250,000. This represents the expected annual savings after implementing the control.

Answer

$100,000

Answer

$400,000

Answer

$350,000

Question 13

Which of the following is a Key Control Indicator (KCI) that measures the effectiveness of a control?

Accepted Answer

Control exception rate. A Key Control Indicator (KCI) measures how well a specific control is operating. Control exception rate — the frequency with which a control fails or is bypassed — directly measures control effectiveness, making it a textbook KCI. The other options measure risk events, audit timing, or training completion, which are KRIs or compliance metrics.

Answer

Number of risk events in the last quarter

Answer

Time since last audit

Answer

Percentage of employees who completed security awareness training

Question 14

An organization uses automated SIEM rules to continuously monitor for unauthorized access attempts. This is an example of which type of monitoring?

Accepted Answer

Continuous monitoring. Continuous monitoring involves the use of automated tools, such as Security Information and Event Management (SIEM) systems, to provide real-time or near-real-time oversight of security events. In this scenario, the SIEM rules are configured to detect unauthorized access attempts as they occur, which aligns directly with the definition of continuous monitoring rather than periodic or point-in-time assessments.

Answer

Periodic control testing

Answer

Vulnerability scanning

Answer

Access review

Question 15

A Key Risk Indicator (KRI) for vulnerability management is the "average patch lag time" (number of days between patch release and deployment). In the last month, this metric increased from 15 days to 45 days. How should the risk practitioner interpret this change?

Accepted Answer

The risk level has increased because exposure to known vulnerabilities has grown.. An increase in average patch lag from 15 to 45 days means critical vulnerabilities remain exploitable for a longer window, directly increasing exposure to known threats. Since KRIs are designed to signal changes in risk levels, a rising KRI indicates the risk level has increased and warrants attention. The correct interpretation is that the organization's exposure to known vulnerabilities has grown.

Answer

The KRI is not relevant because patch lag is a control indicator, not a risk indicator.

Answer

The risk level has decreased because patches are being evaluated more thoroughly.

Answer

The risk level remains unchanged because patch lag is a lagging indicator.