CRISC Risk Response and Reporting Practice Test 6 — 15 Questions

Question 1

A risk practitioner is designing a risk report for the board of directors. Which TWO content elements are most appropriate for strategic risk reporting? (Select two.)

Accepted Answer

Trend analysis of top key risk indicators. Trend analysis of top key risk indicators (KRIs) is appropriate for strategic risk reporting because it provides the board with a high-level, forward-looking view of how key risks are evolving over time. This enables informed decision-making on risk appetite and strategic direction without overwhelming directors with operational details.

Answer

List of all control deficiencies

Answer

Names of employees who failed phishing tests

Answer

Detailed log analysis results

Question 2

An organization is implementing continuous monitoring for its critical systems. Which THREE of the following activities are examples of continuous monitoring? (Select three.)

Accepted Answer

Weekly vulnerability scanning of all servers. Weekly vulnerability scanning of all servers is a continuous monitoring activity because it occurs at a regular, frequent interval, enabling the organization to identify and remediate vulnerabilities in a timely manner. This aligns with the principle of ongoing risk response and reporting, as it provides recurring visibility into the security posture of critical systems.

Answer

Annual internal audit of access controls

Answer

Quarterly review of user access rights by managers

Question 3

A third-party vendor has been assessed as high risk due to its access to sensitive data. Which TWO ongoing monitoring activities are most appropriate for this vendor? (Select two.)

Accepted Answer

Monthly conference calls with vendor management. For high-risk vendors, ongoing monitoring must include regular communication and continuous threat intelligence. Monthly conference calls (B) ensure management engagement and oversight, while continuous monitoring via threat intelligence sharing platforms (D) provides real-time risk detection. Annual reassessment (C) is too infrequent for high-risk vendors.

Answer

Daily manual review of vendor logs

Answer

Annual reassessment of security controls

Answer

Single initial onboarding assessment

Question 4

An organization is implementing a control to prevent unauthorized access to its critical database. The control must be designed to block access attempts in real time. Which type of control should be selected?

Accepted Answer

Preventive control. A preventive control is designed to block unauthorized access attempts in real time before they reach the critical database. Technologies such as a database firewall or network access control list (ACL) evaluate each request against a policy and drop the packet or terminate the session immediately, preventing the access from occurring. This aligns with the requirement for real-time blocking, which is the defining characteristic of a preventive control.

Answer

Corrective control

Answer

Detective control

Answer

Compensating control

Question 5

A risk manager is evaluating the effectiveness of a control that requires dual authorization for high-value transactions. The Key Control Indicator (KCI) for this control is the rate of transactions processed without dual authorization (i.e., exception rate). If the acceptable exception rate is less than 1% and the observed rate is 2.5%, what is the most appropriate immediate action?

Accepted Answer

Investigate the root cause of the exceptions. The observed exception rate of 2.5% exceeds the acceptable threshold of 1%, indicating a control deficiency. The most appropriate immediate action is to investigate the root cause of the exceptions to determine whether the control is failing due to process gaps, user behavior, or system issues. Root cause analysis (RCA) is a foundational step before any remediation, as it prevents premature redesign or unjustified risk acceptance.

Answer

Redesign the control immediately

Answer

Accept the risk since the rate is still low

Answer

Increase the acceptable exception rate to 2.5%

Question 6

An organization is implementing a new access control system. Which of the following is the most important activity to ensure the control is effectively integrated into operations?

Accepted Answer

Updating relevant documentation. Updating relevant documentation ensures that the new access control system's configuration, operational procedures, and troubleshooting steps are formally recorded and accessible to the operations team. Without accurate documentation, the control cannot be consistently maintained, monitored, or recovered during incidents, making it ineffective in day-to-day operations. This activity directly integrates the control into the operational lifecycle by providing a single source of truth for administrators.

Answer

Assigning control ownership

Answer

Performing a cost-benefit analysis

Answer

Conducting a post-implementation review

Question 7

A Key Risk Indicator (KRI) for a critical system is the number of unpatched vulnerabilities older than 30 days. The threshold is set at 5. This KRI is best described as:

Accepted Answer

A leading indicator of vulnerability risk. This KRI measures the time lag in patching, which is a leading indicator of increasing vulnerability risk. It signals that the risk level is changing before an actual exploit occurs.

Answer

A Key Control Indicator (KCI)

Answer

A measure of residual risk

Answer

A lagging indicator of control effectiveness

Question 8

Which of the following is the most appropriate frequency for operational IT risk reporting to IT management?

Accepted Answer

Weekly or monthly. Operational risk reporting is typically provided on a weekly or monthly basis to IT management to support day-to-day decision-making.

Answer

Annually

Answer

Quarterly

Answer

Semi-annually

Question 9

An organization is integrating IT risk into its enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It ensures IT risks are viewed in the context of business objectives. Integrating IT risk into enterprise risk management (ERM) ensures that IT risks are evaluated in the context of business objectives, enabling prioritization of risk responses that align with strategic goals. This alignment prevents IT from operating in a silo and ensures that risk decisions support overall business value, not just technical compliance.

Answer

It allows IT to operate independently

Answer

It eliminates all IT risks

Answer

It reduces the need for IT controls

Question 10

A vendor risk manager is tiering vendors based on the criticality of services and data access. A vendor that processes sensitive customer data for a core business application should be classified as which tier?

Accepted Answer

Critical. A vendor processing sensitive customer data for a core business application poses the highest potential impact on confidentiality, integrity, and availability. This aligns with the definition of a Critical tier, where failure or breach would cause severe business disruption, regulatory penalties, and reputational damage. The classification is driven by the combination of sensitive data access and the application's essential role in business operations.

Answer

Low

Answer

Medium

Answer

High

Question 11

An organization wants to promote a risk-aware culture. Which of the following actions is most effective in encouraging employees to report incidents without fear?

Accepted Answer

Establishing a non-punitive incident reporting policy. A non-punitive incident reporting policy is the most effective action because it directly removes the fear of retaliation or blame, which is the primary psychological barrier to reporting security incidents. By guaranteeing that employees will not face disciplinary action for reporting their own mistakes or observed issues, the organization fosters psychological safety and encourages timely disclosure. This aligns with the CRISC principle that a risk-aware culture requires trust and openness, which cannot be achieved through training or metrics alone if fear persists.

Answer

Conducting annual security awareness training

Answer

Publishing risk metrics on the intranet

Answer

Providing incentives for risk identification

Question 12

During a quarterly control effectiveness test, internal audit discovers that a key automated control failed 15% of the time due to a software bug. The risk owner decides to accept the risk because the cost to fix the bug is high. What should the risk manager do next?

Accepted Answer

Document the risk acceptance and rationale in the risk register. The risk manager's primary responsibility is to formally document the risk acceptance decision, including the rationale provided by the risk owner, in the risk register. This ensures audit trail, transparency, and compliance with governance frameworks such as COBIT or ISO 31000. Since the risk owner has the authority to accept the risk, the risk manager must record it rather than challenge or escalate it without justification.

Answer

Implement a compensating control

Answer

Override the risk owner's decision

Answer

Report the issue to the board immediately

Question 13

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Accepted Answer

Continuous monitoring. This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Answer

Periodic control testing

Answer

Access review

Answer

Vulnerability scanning

Question 14

A risk manager is reviewing the risk report content for a quarterly IT risk committee meeting. Which TWO items are most important to include in the report?

Accepted Answer

Risk heat map. A risk heat map is a critical visual tool for risk reporting because it provides a concise, at-a-glance view of the likelihood and impact of identified risks, enabling the IT risk committee to quickly prioritize and make informed decisions. It directly supports the Risk Response and Reporting domain by summarizing complex risk data into actionable insights, which is essential for quarterly governance meetings.

Answer

Individual employee performance metrics

Answer

Detailed technical logs

Answer

List of all IT assets

Question 15

An organization is developing a vendor risk management program. Which THREE activities should be included in the initial onboarding assessment for a high-risk vendor?

Accepted Answer

Evaluating contract compliance requirements. Evaluating contract compliance requirements is a critical initial onboarding activity for a high-risk vendor because it ensures the vendor's service level agreements (SLAs), data protection clauses, and regulatory obligations (e.g., GDPR, PCI DSS) are formally documented and enforceable. This step establishes the legal and operational baseline for risk acceptance and ongoing monitoring, directly supporting the risk response strategy within the vendor risk management program.

Answer

Conducting an onsite physical security inspection

Answer

Analyzing the vendor's financial statements