CRISC Risk Response and Reporting — Timed 10 Questions

Question 1

During a cost-benefit analysis for a proposed control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce the ALE to $100,000. The control implementation cost is $150,000, and the annual operating cost is $30,000. What is the net annual benefit of the control?

10 minute time limit — choose an answer to begin.

Accepted Answer

$220,000. The net annual benefit is calculated as the reduction in ALE minus the annual operating cost and the implementation cost (treated as an annual cost for this calculation). The reduction in ALE is $500,000 - $100,000 = $400,000. Subtracting the annual operating cost of $30,000 gives $370,000, then subtracting the implementation cost of $150,000 yields $220,000.

Answer

$400,000

Answer

$370,000

Answer

$250,000

Question 2

Which of the following is the best example of a Key Control Indicator (KCI) for a firewall rule review process?

Accepted Answer

Percentage of firewall rules reviewed within the defined period. A Key Control Indicator (KCI) measures the effectiveness of a control by tracking its operational performance. For a firewall rule review process, the percentage of rules reviewed within the defined period directly indicates whether the control (periodic review) is being executed as intended, ensuring that stale or overly permissive rules are identified and remediated on schedule.

Answer

Number of firewall breaches per quarter

Answer

Number of firewall administrators

Answer

Time since last firewall software update

Question 3

An organization is implementing continuous monitoring for its network security controls. Which TWO of the following are examples of continuous monitoring techniques?

Accepted Answer

Automated control testing via SIEM rules. Options D and E are correct because continuous monitoring involves automated, ongoing validation of security controls. Option D, automated control testing via SIEM rules, operates in real-time by analyzing logs and triggering alerts. Option E, weekly vulnerability scanning, while scheduled, is an automated process that provides frequent, regular assessments, which is a key component of a continuous monitoring program. In contrast, options A, B, and C are performed too infrequently (annually or quarterly) to be considered continuous.

Answer

Annual access reviews

Answer

Annual vulnerability scanning

Answer

Quarterly control testing by internal audit

Question 4

A security team is considering implementing a control to prevent unauthorized access to a critical database. Which type of control is most appropriate for this objective?

Accepted Answer

Preventive control. Preventive controls are designed to stop an incident from occurring. In this case, preventing unauthorized access aligns with a preventive control.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 5

The risk team is evaluating the cost-effectiveness of a proposed control that will reduce the annualized loss expectancy (ALE) for a cyber attack from $500,000 to $100,000. The annual cost of the control is $150,000. What is the net benefit of implementing this control?

Accepted Answer

$250,000. The ALE reduction is $400,000. Subtracting the control cost of $150,000 gives a net benefit of $250,000.

Answer

$400,000

Answer

$150,000

Answer

$350,000

Question 6

A Key Control Indicator (KCI) for a firewall rule review process shows an exception rate of 15% for the past quarter, exceeding the acceptable threshold of 10%. What is the most appropriate immediate action for the control owner?

Accepted Answer

Investigate the root cause of the high exception rate. A KCI exception rate exceeding the threshold indicates a process failure, not necessarily a control failure. The control owner must first perform root cause analysis to determine whether the exceptions are due to misconfigured rules, policy violations, or environmental changes before taking corrective action. This aligns with the CRISC principle that control owners are responsible for monitoring and improving control effectiveness through investigation.

Answer

Increase the acceptable threshold to 20%

Answer

Replace the control with a different one

Answer

Escalate to the board immediately

Question 7

An organization uses a Key Risk Indicator (KRI) that tracks the average number of days to patch critical vulnerabilities. The KRI has been trending upward over the last three months, from 15 days to 30 days, while the risk appetite threshold is 20 days. Which conclusion is most appropriate?

Accepted Answer

The vulnerability risk is increasing and requires management attention. Since the KRI has exceeded the threshold and is trending upward, the risk level is increasing, requiring attention from management.

Answer

The patching process is effective because the KRI is still below 60 days

Answer

The KRI should be replaced with a lagging indicator

Answer

The risk is within appetite because the increase is gradual

Question 8

When implementing a new access control system, which activity is essential during the change management process?

Accepted Answer

Updating the system documentation and user manuals. Updating relevant documentation ensures that the change is properly recorded and that operational procedures remain accurate.

Answer

Removing all legacy controls

Answer

Assigning control ownership to external vendors

Answer

Disabling audit logs to save storage

Question 9

An IT risk manager is preparing a quarterly risk report for the CISO. Which type of reporting structure does this represent?

Accepted Answer

Tactical risk reporting. Quarterly reporting to the CISO/CIO is considered tactical risk reporting, focusing on decisions affecting the IT portfolio.

Answer

Executive risk reporting

Answer

Operational risk reporting

Answer

Strategic risk reporting

Question 10

An organization is implementing a continuous monitoring solution for its network. Which of the following is an example of continuous monitoring?

Accepted Answer

Daily automated vulnerability scanning. Automated vulnerability scanning is a continuous monitoring activity that provides ongoing visibility into security posture.

Answer

Monthly control testing by internal audit

Answer

Annual penetration testing

Answer

Quarterly access reviews