CRISC Risk Response and Reporting Practice Test 8 — 15 Questions

Question 1

Which of the following is the best example of a Key Control Indicator (KCI) for a firewall rule review process?

Accepted Answer

Percentage of firewall rules reviewed within the defined period. A Key Control Indicator (KCI) measures the effectiveness of a control by tracking its operational performance. For a firewall rule review process, the percentage of rules reviewed within the defined period directly indicates whether the control (periodic review) is being executed as intended, ensuring that stale or overly permissive rules are identified and remediated on schedule.

Answer

Number of firewall breaches per quarter

Answer

Number of firewall administrators

Answer

Time since last firewall software update

Question 2

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Accepted Answer

Continuous monitoring. This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Answer

Periodic control testing

Answer

Access review

Answer

Vulnerability scanning

Question 3

A risk manager is reviewing the risk report content for a quarterly IT risk committee meeting. Which TWO items are most important to include in the report?

Accepted Answer

Risk heat map. A risk heat map (A) is essential because it visually prioritizes risks by likelihood and impact, allowing the IT risk committee to quickly identify and compare exposure across the risk portfolio. Top risks and their status (D) must be included so the committee can focus on the most significant threats, track mitigation progress, and make informed governance decisions. Individual employee performance metrics (B) are an HR concern and do not reflect organizational risk posture. Detailed technical logs (C) are too granular and operational for a quarterly executive-level risk report. A list of all IT assets (E) is an inventory artifact, not a risk report element, and would overwhelm the committee without risk context.

Answer

Individual employee performance metrics

Answer

Detailed technical logs

Answer

List of all IT assets

Question 4

A security awareness program is being designed to promote a risk-aware culture. Which TWO elements are most critical for the program's success?

Accepted Answer

Tone from the top. Option D, 'Tone from the top,' is critical because a risk-aware culture must be visibly championed by senior leadership; when executives model and reinforce risk-conscious behavior, employees perceive security as a genuine organizational priority rather than a compliance formality. Option E, 'Communicating risk in business terms,' is equally essential because awareness messages framed around business impact—such as financial loss, reputational damage, or operational disruption—resonate with staff and drive risk-informed decision-making far better than abstract technical jargon. Together, these two elements establish both the authority and the relevance needed for a sustainable security awareness program. Option A is not among the marked correct answers because a risk committee is a governance structure that supports risk management but is not itself a critical element of awareness-program success. Option B is not marked correct because mandatory pass/fail testing can create a compliance checkbox mentality rather than fostering genuine risk awareness. Option C is not marked correct because detailed technical training for all staff is unnecessary and impractical; awareness programs should target relevant behaviors, not deep technical expertise.

Answer

Establishing a risk committee

Answer

Mandatory annual testing with pass/fail

Answer

Detailed technical training for all staff

Question 5

An organization is selecting a control to prevent unauthorized access to a critical database. Which control type is most appropriate?

Accepted Answer

Preventive control. Preventive control is the most appropriate because it directly stops unauthorized access before it occurs. For a critical database, this includes mechanisms like database firewalls, access control lists (ACLs), or mandatory access control (MAC) policies that enforce authentication and authorization at the point of entry, such as requiring valid credentials and role-based permissions before any query is processed.

Answer

Detective control

Answer

Corrective control

Answer

Directive control

Question 6

During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control will cost $100,000 annually and is expected to reduce the ALE by 80%. What is the net benefit of implementing this control?

Accepted Answer

$300,000. The current annual loss expectancy (ALE) is $500,000. An 80% reduction lowers the ALE by $400,000, resulting in a new ALE of $100,000. The annual control cost is $100,000, so the net benefit is the reduction in ALE ($400,000) minus the control cost ($100,000), which equals $300,000.

Answer

$100,000

Answer

$400,000

Answer

$500,000

Question 7

A key control indicator (KCI) for a critical access control shows a deficiency rate of 12% for the quarter, exceeding the target of 5%. Which of the following should be the risk practitioner's PRIMARY action?

Accepted Answer

Investigate root causes of the high deficiency rate. The primary action is to investigate root causes because a KCI deficiency rate of 12% against a 5% target indicates a systemic control failure. Without understanding why the access control is failing (e.g., misconfigured role-based access control (RBAC) rules, stale user entitlements, or bypassed multi-factor authentication), any subsequent remediation may be ineffective. Root cause analysis ensures the risk practitioner addresses the underlying issue rather than applying a superficial fix.

Answer

Escalate the deficiency to the board immediately

Answer

Implement compensating controls to reduce risk

Answer

Increase the frequency of control testing

Question 8

An organization is implementing a new access control system. Which of the following is the MOST important consideration during the implementation phase?

Accepted Answer

Change management. During the implementation phase of a new access control system, change management is the most critical consideration because it ensures that all changes to the authentication and authorization infrastructure are controlled, tested, and approved before deployment. Without a formal change management process, misconfigurations in protocols like LDAP, RADIUS, or SAML can lead to security gaps or service outages, making it the foundational control for a successful rollout.

Answer

Control ownership assignment

Answer

User training

Answer

Documentation update

Question 9

Which of the following is a leading Key Risk Indicator (KRI) for the risk of a data breach?

Accepted Answer

Percentage of systems with unpatched critical vulnerabilities. A leading KRI predicts future risk events. The percentage of systems with unpatched critical vulnerabilities directly indicates an increasing attack surface and likelihood of exploitation, making it a leading indicator for a data breach. In contrast, lagging indicators like detection time or breach count measure past incidents.

Answer

Average time to detect a breach

Answer

Number of data breaches in the past quarter

Answer

Number of security incidents closed

Question 10

When integrating IT risk into the enterprise risk management (ERM) program, what is the PRIMARY benefit?

Accepted Answer

Better alignment of IT risk with business objectives. Integrating IT risk into ERM ensures that IT risk decisions are directly linked to business strategy and objectives, enabling leadership to prioritize risks that could impact critical business outcomes. This alignment is the primary benefit because it transforms IT risk from a technical concern into a strategic business driver, facilitating better resource allocation and governance.

Answer

Improved compliance with IT standards

Answer

Reduced IT operational costs

Answer

Increased frequency of risk assessments

Question 11

In third-party risk management, which of the following is MOST indicative of a vendor's control effectiveness for a critical vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the most indicative of a vendor's control effectiveness because it provides an independent auditor's opinion on the design and operating effectiveness of controls over a specified period (typically 6–12 months). For a critical vendor, this third-party attestation offers objective evidence that security and privacy controls are actually working, not just promised.

Answer

Contractual security requirements

Answer

Vendor's self-assessment questionnaire

Answer

Vendor's marketing materials

Question 12

A risk practitioner notices that the number of failed authentication attempts has spiked by 300% over the past week. Which of the following actions should be taken FIRST?

Accepted Answer

Analyze the logs to identify the source and nature of the attempts. The first step in responding to a security incident, such as a 300% spike in failed authentication attempts, is to analyze the logs to determine the source and nature of the activity. This aligns with the NIST incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes any containment or reporting action. Without understanding whether the spike is due to a brute-force attack, a misconfigured application, or a credential-stuffing campaign, any subsequent action could be premature or ineffective.

Answer

Report the spike to the board

Answer

Implement multi-factor authentication

Answer

Increase the frequency of password changes

Question 13

Which of the following is the BEST example of promoting a risk-aware culture within an organization?

Accepted Answer

Encouraging incident reporting without blame. A blame-free incident reporting culture is the foundation of a risk-aware environment. When employees feel safe to report errors or near-misses without fear of punishment, the organization can collect accurate data on control weaknesses and emerging threats, enabling proactive risk response. This aligns with the COBIT 5 principle of fostering a culture of openness and learning, which is essential for effective risk management.

Answer

Implementing strict penalties for security violations

Answer

Assigning risk ownership to IT only

Answer

Conducting annual security training

Question 14

During a vendor risk assessment, a prospective vendor for critical services cannot provide a SOC 2 Type II report. According to the organization's vendor risk appetite, which action should be taken?

Accepted Answer

Reject the vendor or request a formal risk acceptance. A SOC 2 Type II report provides independent assurance over a service organization's controls over a period of time. When a prospective vendor for critical services cannot provide this report, and the organization's risk appetite is defined, the appropriate action is to reject the vendor or require a formal risk acceptance from the risk owner. This ensures that any deviation from the required control evidence is explicitly acknowledged and approved, rather than bypassing the requirement.

Answer

Lower the vendor's tier to reduce requirements

Answer

Accept the vendor's self-assessment instead

Answer

Onboard the vendor with additional monitoring

Question 15

An organization is implementing continuous monitoring for its critical systems. Which TWO of the following are examples of continuous monitoring techniques? (Select TWO)

Accepted Answer

Continuous vulnerability scanning. Option A (Continuous vulnerability scanning) is correct because it is an automated, ongoing process that repeatedly identifies new vulnerabilities as systems and threat data change, which is a core continuous monitoring technique. Option C (Automated SIEM rules to detect anomalies) is correct because SIEM correlation rules and alerting run continuously against real-time log and event streams, providing ongoing detection rather than point-in-time assessment. Option B (Weekly review of access logs by a manager) is a periodic, manual review, so it is not continuous. Option D (Annual penetration testing) is a point-in-time, typically yearly assessment, not continuous monitoring. Option E (Quarterly control testing by internal audit) is periodic assurance performed on a quarterly cycle, not continuous monitoring.

Answer

Weekly review of access logs by a manager

Answer

Annual penetration testing

Answer

Quarterly control testing by internal audit