CRISC Risk Response and Reporting Practice Test 7 — 15 Questions

Question 1

A security awareness program is being designed to promote a risk-aware culture. Which TWO elements are most critical for the program's success?

Accepted Answer

Tone from the top. Tone from the top demonstrates management commitment, and communicating risk in business terms ensures that employees understand the relevance to their roles. These are key to fostering a risk-aware culture.

Answer

Establishing a risk committee

Answer

Mandatory annual testing with pass/fail

Answer

Detailed technical training for all staff

Question 2

An organization is selecting a control to prevent unauthorized access to a critical database. Which control type is most appropriate?

Accepted Answer

Preventive control. Preventive control is the most appropriate because it directly stops unauthorized access before it occurs. For a critical database, this includes mechanisms like database firewalls, access control lists (ACLs), or mandatory access control (MAC) policies that enforce authentication and authorization at the point of entry, such as requiring valid credentials and role-based permissions before any query is processed.

Answer

Detective control

Answer

Corrective control

Answer

Directive control

Question 3

During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control will cost $100,000 annually and is expected to reduce the ALE by 80%. What is the net benefit of implementing this control?

Accepted Answer

$300,000. The current annual loss expectancy (ALE) is $500,000. An 80% reduction lowers the ALE by $400,000, resulting in a new ALE of $100,000. The annual control cost is $100,000, so the net benefit is the reduction in ALE ($400,000) minus the control cost ($100,000), which equals $300,000.

Answer

$100,000

Answer

$400,000

Answer

$500,000

Question 4

A key control indicator (KCI) for a critical access control shows a deficiency rate of 12% for the quarter, exceeding the target of 5%. Which of the following should be the risk practitioner's PRIMARY action?

Accepted Answer

Investigate root causes of the high deficiency rate. The primary action is to investigate root causes because a KCI deficiency rate of 12% against a 5% target indicates a systemic control failure. Without understanding why the access control is failing (e.g., misconfigured role-based access control (RBAC) rules, stale user entitlements, or bypassed multi-factor authentication), any subsequent remediation may be ineffective. Root cause analysis ensures the risk practitioner addresses the underlying issue rather than applying a superficial fix.

Answer

Escalate the deficiency to the board immediately

Answer

Implement compensating controls to reduce risk

Answer

Increase the frequency of control testing

Question 5

An organization is implementing a new access control system. Which of the following is the MOST important consideration during the implementation phase?

Accepted Answer

Change management. During the implementation phase of a new access control system, change management is the most critical consideration because it ensures that all changes to the authentication and authorization infrastructure are controlled, tested, and approved before deployment. Without a formal change management process, misconfigurations in protocols like LDAP, RADIUS, or SAML can lead to security gaps or service outages, making it the foundational control for a successful rollout.

Answer

Control ownership assignment

Answer

User training

Answer

Documentation update

Question 6

Which of the following is a leading Key Risk Indicator (KRI) for the risk of a data breach?

Accepted Answer

Percentage of systems with unpatched critical vulnerabilities. A leading KRI predicts future risk events. The percentage of systems with unpatched critical vulnerabilities directly indicates an increasing attack surface and likelihood of exploitation, making it a leading indicator for a data breach. In contrast, lagging indicators like detection time or breach count measure past incidents.

Answer

Average time to detect a breach

Answer

Number of data breaches in the past quarter

Answer

Number of security incidents closed

Question 7

A risk practitioner is designing a quarterly IT risk report for the CISO. Which of the following elements is MOST critical for tactical decision-making?

Accepted Answer

Control performance metrics. Control performance metrics (D) are most critical for tactical decision-making because they provide quantifiable, real-time data on how well existing security controls are operating. Tactical decisions require immediate, actionable insights—such as whether a firewall rule is blocking 95% of malicious traffic or if a patch management process is meeting its 30-day SLA—rather than high-level summaries or future projections. Without control metrics, the CISO cannot assess the effectiveness of current defenses or prioritize remediation efforts.

Answer

Top risks and status

Answer

Risk heat map

Answer

Upcoming risk events

Question 8

When integrating IT risk into the enterprise risk management (ERM) program, what is the PRIMARY benefit?

Accepted Answer

Better alignment of IT risk with business objectives. Integrating IT risk into ERM ensures that IT risk decisions are directly linked to business strategy and objectives, enabling leadership to prioritize risks that could impact critical business outcomes. This alignment is the primary benefit because it transforms IT risk from a technical concern into a strategic business driver, facilitating better resource allocation and governance.

Answer

Improved compliance with IT standards

Answer

Reduced IT operational costs

Answer

Increased frequency of risk assessments

Question 9

In third-party risk management, which of the following is MOST indicative of a vendor's control effectiveness for a critical vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the most indicative of a vendor's control effectiveness because it provides an independent auditor's opinion on the design and operating effectiveness of controls over a specified period (typically 6–12 months). For a critical vendor, this third-party attestation offers objective evidence that security and privacy controls are actually working, not just promised.

Answer

Contractual security requirements

Answer

Vendor's self-assessment questionnaire

Answer

Vendor's marketing materials

Question 10

A risk practitioner notices that the number of failed authentication attempts has spiked by 300% over the past week. Which of the following actions should be taken FIRST?

Accepted Answer

Analyze the logs to identify the source and nature of the attempts. The first step in responding to a security incident, such as a 300% spike in failed authentication attempts, is to analyze the logs to determine the source and nature of the activity. This aligns with the NIST incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes any containment or reporting action. Without understanding whether the spike is due to a brute-force attack, a misconfigured application, or a credential-stuffing campaign, any subsequent action could be premature or ineffective.

Answer

Report the spike to the board

Answer

Implement multi-factor authentication

Answer

Increase the frequency of password changes

Question 11

Which of the following is the BEST example of promoting a risk-aware culture within an organization?

Accepted Answer

Encouraging incident reporting without blame. A blame-free incident reporting culture is the foundation of a risk-aware environment. When employees feel safe to report errors or near-misses without fear of punishment, the organization can collect accurate data on control weaknesses and emerging threats, enabling proactive risk response. This aligns with the COBIT 5 principle of fostering a culture of openness and learning, which is essential for effective risk management.

Answer

Implementing strict penalties for security violations

Answer

Assigning risk ownership to IT only

Answer

Conducting annual security training

Question 12

During a vendor risk assessment, a prospective vendor for critical services cannot provide a SOC 2 Type II report. According to the organization's vendor risk appetite, which action should be taken?

Accepted Answer

Reject the vendor or request a formal risk acceptance. A SOC 2 Type II report provides independent assurance over a service organization's controls over a period of time. When a prospective vendor for critical services cannot provide this report, and the organization's risk appetite is defined, the appropriate action is to reject the vendor or require a formal risk acceptance from the risk owner. This ensures that any deviation from the required control evidence is explicitly acknowledged and approved, rather than bypassing the requirement.

Answer

Lower the vendor's tier to reduce requirements

Answer

Accept the vendor's self-assessment instead

Answer

Onboard the vendor with additional monitoring

Question 13

Which of the following is the BEST Key Control Indicator (KCI) for measuring the effectiveness of a firewall?

Accepted Answer

Percentage of blocked intrusion attempts. The percentage of blocked intrusion attempts directly measures how effectively the firewall is enforcing its security policies to prevent unauthorized access. A high block rate indicates the firewall is correctly identifying and stopping threats, making it the most direct KCI for firewall effectiveness.

Answer

Time since last firewall firmware update

Answer

Number of firewall rule changes per month

Answer

Number of firewall alerts generated

Question 14

An organization is implementing continuous monitoring for its critical systems. Which TWO of the following are examples of continuous monitoring techniques? (Select TWO)

Accepted Answer

Continuous vulnerability scanning. Continuous monitoring involves automated, ongoing checks. SIEM rules continuously analyze logs for threats, and vulnerability scanning can be automated to run continuously or frequently.

Answer

Weekly review of access logs by a manager

Answer

Annual penetration testing

Answer

Quarterly control testing by internal audit

Question 15

Which THREE of the following are components of an effective IT risk reporting structure for a large enterprise? (Select THREE)

Accepted Answer

Strategic risk reporting to the board on a semi-annual basis. Strategic risk reporting to the board on a semi-annual basis is correct because the board requires high-level, aggregated risk information that aligns with enterprise strategy and risk appetite. Semi-annual reporting provides sufficient frequency for oversight without overwhelming the board with operational details, as mandated by governance frameworks like COBIT and ISO 31000.

Answer

Annual risk reporting to IT operational staff

Answer

Daily risk reporting to the board