CRISC Risk Response and Reporting — Timed 15 Questions

Question 1

During a cost-benefit analysis for a proposed control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce the ALE to $100,000. The control implementation cost is $150,000, and the annual operating cost is $30,000. What is the net annual benefit of the control?

15 minute time limit — choose an answer to begin.

Accepted Answer

$220,000. The net annual benefit is calculated as the reduction in ALE minus the annual operating cost and the implementation cost (treated as an annual cost for this calculation). The reduction in ALE is $500,000 - $100,000 = $400,000. Subtracting the annual operating cost of $30,000 gives $370,000, then subtracting the implementation cost of $150,000 yields $220,000.

Answer

$400,000

Answer

$370,000

Answer

$250,000

Question 2

Which of the following is the best example of a Key Control Indicator (KCI) for a firewall rule review process?

Accepted Answer

Percentage of firewall rules reviewed within the defined period. A Key Control Indicator (KCI) measures the effectiveness of a control by tracking its operational performance. For a firewall rule review process, the percentage of rules reviewed within the defined period directly indicates whether the control (periodic review) is being executed as intended, ensuring that stale or overly permissive rules are identified and remediated on schedule.

Answer

Number of firewall breaches per quarter

Answer

Number of firewall administrators

Answer

Time since last firewall software update

Question 3

An organization is implementing continuous monitoring for its network security controls. Which TWO of the following are examples of continuous monitoring techniques?

Accepted Answer

Automated control testing via SIEM rules. Options D and E are correct because continuous monitoring involves automated, ongoing validation of security controls. Option D, automated control testing via SIEM rules, operates in real-time by analyzing logs and triggering alerts. Option E, weekly vulnerability scanning, while scheduled, is an automated process that provides frequent, regular assessments, which is a key component of a continuous monitoring program. In contrast, options A, B, and C are performed too infrequently (annually or quarterly) to be considered continuous.

Answer

Annual access reviews

Answer

Annual vulnerability scanning

Answer

Quarterly control testing by internal audit

Question 4

A security team is considering implementing a control to prevent unauthorized access to a critical database. Which type of control is most appropriate for this objective?

Accepted Answer

Preventive control. Preventive controls are designed to stop an incident from occurring. In this case, preventing unauthorized access aligns with a preventive control.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 5

The risk team is evaluating the cost-effectiveness of a proposed control that will reduce the annualized loss expectancy (ALE) for a cyber attack from $500,000 to $100,000. The annual cost of the control is $150,000. What is the net benefit of implementing this control?

Accepted Answer

$250,000. The ALE reduction is $400,000. Subtracting the control cost of $150,000 gives a net benefit of $250,000.

Answer

$400,000

Answer

$150,000

Answer

$350,000

Question 6

A Key Control Indicator (KCI) for a firewall rule review process shows an exception rate of 15% for the past quarter, exceeding the acceptable threshold of 10%. What is the most appropriate immediate action for the control owner?

Accepted Answer

Investigate the root cause of the high exception rate. A KCI exception rate exceeding the threshold indicates a process failure, not necessarily a control failure. The control owner must first perform root cause analysis to determine whether the exceptions are due to misconfigured rules, policy violations, or environmental changes before taking corrective action. This aligns with the CRISC principle that control owners are responsible for monitoring and improving control effectiveness through investigation.

Answer

Increase the acceptable threshold to 20%

Answer

Replace the control with a different one

Answer

Escalate to the board immediately

Question 7

An organization uses a Key Risk Indicator (KRI) that tracks the average number of days to patch critical vulnerabilities. The KRI has been trending upward over the last three months, from 15 days to 30 days, while the risk appetite threshold is 20 days. Which conclusion is most appropriate?

Accepted Answer

The vulnerability risk is increasing and requires management attention. Since the KRI has exceeded the threshold and is trending upward, the risk level is increasing, requiring attention from management.

Answer

The patching process is effective because the KRI is still below 60 days

Answer

The KRI should be replaced with a lagging indicator

Answer

The risk is within appetite because the increase is gradual

Question 8

When implementing a new access control system, which activity is essential during the change management process?

Accepted Answer

Updating the system documentation and user manuals. Updating relevant documentation ensures that the change is properly recorded and that operational procedures remain accurate.

Answer

Removing all legacy controls

Answer

Assigning control ownership to external vendors

Answer

Disabling audit logs to save storage

Question 9

An IT risk manager is preparing a quarterly risk report for the CISO. Which type of reporting structure does this represent?

Accepted Answer

Tactical risk reporting. Quarterly reporting to the CISO/CIO is considered tactical risk reporting, focusing on decisions affecting the IT portfolio.

Answer

Executive risk reporting

Answer

Operational risk reporting

Answer

Strategic risk reporting

Question 10

An organization is implementing a continuous monitoring solution for its network. Which of the following is an example of continuous monitoring?

Accepted Answer

Daily automated vulnerability scanning. Automated vulnerability scanning is a continuous monitoring activity that provides ongoing visibility into security posture.

Answer

Monthly control testing by internal audit

Answer

Annual penetration testing

Answer

Quarterly access reviews

Question 11

During a control implementation project, the risk manager discovers that the resource requirements have increased significantly, making the original cost-benefit analysis invalid. What should the risk manager do first?

Accepted Answer

Perform a revised cost-benefit analysis. Before proceeding, the risk manager should reassess the cost-benefit analysis with updated costs to determine if the control is still justified.

Answer

Continue the project and request additional budget later

Answer

Escalate to the board for approval of additional funds

Answer

Cancel the project immediately

Question 12

Which of the following best describes the purpose of a risk heat map in an IT risk report?

Accepted Answer

To provide a visual representation of the likelihood and impact of risks. A risk heat map visually displays risks based on likelihood and impact, helping to prioritize and communicate risk levels.

Answer

To list the top risks in order of priority

Answer

To illustrate the relationship between risks and controls

Answer

To show the cost of controls

Question 13

A critical vendor is being onboarded. The vendor risk appetite policy requires SOC 2 Type II reports for critical vendors. The vendor has provided a SOC 2 Type I report. What should the risk manager do?

Accepted Answer

Request a SOC 2 Type II report from the vendor. SOC 2 Type II covers controls over a period, providing more assurance than Type I. The requirement is Type II, so the vendor should be asked to provide it.

Answer

Downgrade the vendor to a lower tier

Answer

Exempt the vendor from the requirement

Answer

Accept the Type I report as sufficient

Question 14

An organization's IT risk team is promoting a risk-aware culture. Which initiative is most likely to encourage employees to report security incidents without fear?

Accepted Answer

Establishing a no-blame incident reporting policy. A no-blame incident reporting policy directly addresses the psychological barrier of fear of reprisal, which is the primary reason employees hesitate to report security incidents. By explicitly stating that reporters will not face disciplinary action for unintentional errors or omissions, the organization fosters psychological safety and encourages timely reporting, which is critical for effective risk response.

Answer

Publishing quarterly incident statistics

Answer

Increasing the frequency of security awareness training

Answer

Implementing automated incident detection

Question 15

Which of the following is a leading indicator that the risk of a credential-based attack may be increasing?

Accepted Answer

Failed authentication spike. A spike in failed authentications can indicate an attempted credential attack, serving as a leading KRI.

Answer

Number of accounts created

Answer

Password reset frequency

Answer

Number of successful logins