CRISC Risk Response and Reporting Practice Test 6 — 15 Questions

Question 1

An organization is implementing a control to prevent unauthorized access to its critical database. The control must be designed to block access attempts in real time. Which type of control should be selected?

Accepted Answer

Preventive control. A preventive control is designed to block unauthorized access attempts in real time before they reach the critical database. Technologies such as a database firewall or network access control list (ACL) evaluate each request against a policy and drop the packet or terminate the session immediately, preventing the access from occurring. This aligns with the requirement for real-time blocking, which is the defining characteristic of a preventive control.

Answer

Corrective control

Answer

Detective control

Answer

Compensating control

Question 2

During a cost-benefit analysis for a proposed control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce the ALE to $100,000. The control implementation cost is $150,000, and the annual operating cost is $30,000. What is the net annual benefit of the control?

Accepted Answer

$220,000. The net annual benefit is calculated as the reduction in ALE minus the annual operating cost. The ALE reduction is $500,000 - $100,000 = $400,000. Subtracting the annual operating cost of $30,000 gives $370,000, but the implementation cost of $150,000 is a one-time cost that must be amortized or considered separately; in this context, the net annual benefit is the annual savings after operating costs, which is $400,000 - $30,000 = $370,000, then subtracting the annualized implementation cost (e.g., over a typical 3-year horizon) yields $370,000 - $50,000 = $320,000, but the question's expected answer uses a simpler interpretation: net annual benefit = (ALE without control - ALE with control) - (annual operating cost + annualized implementation cost). With a 1-year horizon, that is ($500,000 - $100,000) - ($30,000 + $150,000) = $400,000 - $180,000 = $220,000.

Answer

$400,000

Answer

$370,000

Answer

$250,000

Question 3

A risk manager is evaluating the effectiveness of a control that requires dual authorization for high-value transactions. The Key Control Indicator (KCI) for this control is the rate of transactions processed without dual authorization (i.e., exception rate). If the acceptable exception rate is less than 1% and the observed rate is 2.5%, what is the most appropriate immediate action?

Accepted Answer

Investigate the root cause of the exceptions. The observed exception rate of 2.5% exceeds the acceptable threshold of 1%, indicating a control deficiency. The most appropriate immediate action is to investigate the root cause of the exceptions to determine whether the control is failing due to process gaps, user behavior, or system issues. Root cause analysis (RCA) is a foundational step before any remediation, as it prevents premature redesign or unjustified risk acceptance.

Answer

Redesign the control immediately

Answer

Accept the risk since the rate is still low

Answer

Increase the acceptable exception rate to 2.5%

Question 4

An organization is implementing a new access control system. Which of the following is the most important activity to ensure the control is effectively integrated into operations?

Accepted Answer

Updating relevant documentation. Updating relevant documentation ensures that the new access control system's configuration, operational procedures, and troubleshooting steps are formally recorded and accessible to the operations team. Without accurate documentation, the control cannot be consistently maintained, monitored, or recovered during incidents, making it ineffective in day-to-day operations. This activity directly integrates the control into the operational lifecycle by providing a single source of truth for administrators.

Answer

Assigning control ownership

Answer

Performing a cost-benefit analysis

Answer

Conducting a post-implementation review

Question 5

A Key Risk Indicator (KRI) for a critical system is the number of unpatched vulnerabilities older than 30 days. The threshold is set at 5. This KRI is best described as:

Accepted Answer

A leading indicator of vulnerability risk. This KRI measures the time lag in patching, which is a leading indicator of increasing vulnerability risk. It signals that the risk level is changing before an actual exploit occurs.

Answer

A Key Control Indicator (KCI)

Answer

A measure of residual risk

Answer

A lagging indicator of control effectiveness

Question 6

Which of the following is the most appropriate frequency for operational IT risk reporting to IT management?

Accepted Answer

Weekly or monthly. Operational risk reporting is typically provided on a weekly or monthly basis to IT management to support day-to-day decision-making.

Answer

Annually

Answer

Quarterly

Answer

Semi-annually

Question 7

An organization is integrating IT risk into its enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It ensures IT risks are viewed in the context of business objectives. Integrating IT risk into enterprise risk management (ERM) ensures that IT risks are evaluated in the context of business objectives, enabling prioritization of risk responses that align with strategic goals. This alignment prevents IT from operating in a silo and ensures that risk decisions support overall business value, not just technical compliance.

Answer

It allows IT to operate independently

Answer

It eliminates all IT risks

Answer

It reduces the need for IT controls

Question 8

A vendor risk manager is tiering vendors based on the criticality of services and data access. A vendor that processes sensitive customer data for a core business application should be classified as which tier?

Accepted Answer

Critical. A vendor processing sensitive customer data for a core business application poses the highest potential impact on confidentiality, integrity, and availability. This aligns with the definition of a Critical tier, where failure or breach would cause severe business disruption, regulatory penalties, and reputational damage. The classification is driven by the combination of sensitive data access and the application's essential role in business operations.

Answer

Low

Answer

Medium

Answer

High

Question 9

An organization wants to promote a risk-aware culture. Which of the following actions is most effective in encouraging employees to report incidents without fear?

Accepted Answer

Establishing a non-punitive incident reporting policy. A non-punitive incident reporting policy is the most effective action because it directly removes the fear of retaliation or blame, which is the primary psychological barrier to reporting security incidents. By guaranteeing that employees will not face disciplinary action for reporting their own mistakes or observed issues, the organization fosters psychological safety and encourages timely disclosure. This aligns with the CRISC principle that a risk-aware culture requires trust and openness, which cannot be achieved through training or metrics alone if fear persists.

Answer

Conducting annual security awareness training

Answer

Publishing risk metrics on the intranet

Answer

Providing incentives for risk identification

Question 10

During a quarterly control effectiveness test, internal audit discovers that a key automated control failed 15% of the time due to a software bug. The risk owner decides to accept the risk because the cost to fix the bug is high. What should the risk manager do next?

Accepted Answer

Document the risk acceptance and rationale in the risk register. Option A is correct because the risk manager's primary responsibility is to formally document the risk acceptance decision, including the rationale provided by the risk owner, in the risk register. This ensures audit trail, transparency, and compliance with governance frameworks such as COBIT or ISO 31000. Since the risk owner has the authority to accept the risk, the risk manager must record it rather than challenge or escalate it without justification.

Answer

Implement a compensating control

Answer

Override the risk owner's decision

Answer

Report the issue to the board immediately

Question 11

Which of the following is the best example of a Key Control Indicator (KCI) for a firewall rule review process?

Accepted Answer

Percentage of firewall rules reviewed within the defined period. A Key Control Indicator (KCI) measures the effectiveness of a control by tracking its operational performance. For a firewall rule review process, the percentage of rules reviewed within the defined period directly indicates whether the control (periodic review) is being executed as intended, ensuring that stale or overly permissive rules are identified and remediated on schedule.

Answer

Number of firewall breaches per quarter

Answer

Number of firewall administrators

Answer

Time since last firewall software update

Question 12

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Accepted Answer

Continuous monitoring. This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Answer

Periodic control testing

Answer

Access review

Answer

Vulnerability scanning

Question 13

A risk manager is reviewing the risk report content for a quarterly IT risk committee meeting. Which TWO items are most important to include in the report?

Accepted Answer

Risk heat map. A risk heat map is a critical visual tool for risk reporting because it provides a concise, at-a-glance view of the likelihood and impact of identified risks, enabling the IT risk committee to quickly prioritize and make informed decisions. It directly supports the Risk Response and Reporting domain by summarizing complex risk data into actionable insights, which is essential for quarterly governance meetings.

Answer

Individual employee performance metrics

Answer

Detailed technical logs

Answer

List of all IT assets

Question 14

An organization is developing a vendor risk management program. Which THREE activities should be included in the initial onboarding assessment for a high-risk vendor?

Accepted Answer

Evaluating contract compliance requirements. Evaluating contract compliance requirements is a critical initial onboarding activity for a high-risk vendor because it ensures the vendor's service level agreements (SLAs), data protection clauses, and regulatory obligations (e.g., GDPR, PCI DSS) are formally documented and enforceable. This step establishes the legal and operational baseline for risk acceptance and ongoing monitoring, directly supporting the risk response strategy within the vendor risk management program.

Answer

Conducting an onsite physical security inspection

Answer

Analyzing the vendor's financial statements

Question 15

A security awareness program is being designed to promote a risk-aware culture. Which TWO elements are most critical for the program's success?

Accepted Answer

Tone from the top. Tone from the top demonstrates management commitment, and communicating risk in business terms ensures that employees understand the relevance to their roles. These are key to fostering a risk-aware culture.

Answer

Establishing a risk committee

Answer

Mandatory annual testing with pass/fail

Answer

Detailed technical training for all staff