CRISC Exam Simulation — 100 Questions

Question 1

Match each risk response strategy to its definition.

Question 2

Match each information security objective to its description.

Question 3

A healthcare organization is migrating its electronic health records (EHR) system to a public cloud. The risk manager identifies several risks. Which TWO of the following are the MOST significant risks related to data privacy and regulatory compliance?

Accepted Answer

Data residency and jurisdiction issues.. Data residency and jurisdiction issues (B) are a top risk because healthcare data is subject to strict regulations like HIPAA and GDPR, which may require data to remain within specific geographic boundaries. Migrating EHRs to a public cloud can inadvertently place data in regions with different legal protections, exposing the organization to non-compliance and legal penalties.

Answer

Potential for service downtime affecting patient care.

Answer

Loss of control over the cloud provider's internal access controls.

Answer

Vendor lock-in due to proprietary APIs.

Question 4

You are the IT risk manager at a multinational corporation that recently migrated its customer database to a cloud-based platform. The database contains personally identifiable information (PII) subject to GDPR. During a routine vulnerability scan, you discover that the database is accessible from the internet without encryption (port 1433 open). The cloud provider's shared responsibility model indicates that securing the database configuration is the customer's responsibility. You have identified the risk as high likelihood and high impact. The business owner argues that the database is only accessible to a limited IP range and that encryption would degrade performance. Which course of action should you recommend to treat the risk?

Accepted Answer

Close the port or implement a VPN, and enforce encryption. Option D is correct because closing the port or implementing a VPN is the most effective way to eliminate the direct exposure, and encryption should be applied to protect data in transit. Option A is wrong because accepting risk without compensating controls violates GDPR requirements. Option B is wrong because a compensating control (WAF) does not address the lack of encryption. Option C is wrong because transferring risk via cyber insurance does not reduce the actual exposure.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk because the IP restriction reduces likelihood

Answer

Implement a web application firewall (WAF) to monitor traffic

Question 5

A multinational corporation is expanding its cloud infrastructure to include a new SaaS application that stores sensitive customer data. The vendor claims compliance with SOC 2 Type II and ISO 27001. The risk manager must determine if the remaining residual risk after vendor controls is within the company's risk appetite. Which of the following is the MOST critical next step?

Accepted Answer

Conduct a data classification and legal review to identify applicable regulatory obligations.. Option B is correct because understanding the data classification and regulatory requirements determines if additional controls are needed beyond the vendor's certifications. Option A is wrong because certifications alone do not guarantee all risks are addressed. Option C is wrong because the vendor's own risk assessment may not consider the company's specific requirements. Option D is wrong because a pilot does not assess regulatory compliance.

Answer

Request the vendor's latest risk assessment report.

Answer

Perform a pilot deployment and monitor for security incidents.

Answer

Accept the vendor's certifications as sufficient evidence of control effectiveness.

Question 6

An organization is implementing a new identity and access management (IAM) system. The risk manager is tasked with identifying risks associated with the migration from legacy authentication to single sign-on (SSO). Which of the following is the GREATEST risk during this migration?

Accepted Answer

Legacy authentication accounts may remain active, creating orphan accounts.. Option D is correct because legacy accounts that are not disabled after migration become unmanaged orphan accounts, posing a significant security risk. Option A is wrong because increased user convenience is a benefit, not a risk. Option B is wrong while password reuse is a risk, it is less severe than orphan accounts. Option C is wrong because SSO typically reduces help desk calls for password resets.

Answer

Users may reuse strong passwords across multiple systems.

Answer

Users may experience increased convenience, leading to reduced security awareness.

Answer

Help desk call volumes may increase due to SSO authentication failures.

Question 7

Which THREE of the following are key components of an IT risk assessment report as per ISACA guidelines?

Accepted Answer

Identified risk scenarios and their risk levels. Option C is correct because an IT risk assessment report, per ISACA guidelines, must include identified risk scenarios and their associated risk levels. This is a core component that documents the specific threats, vulnerabilities, and the resulting inherent risk ratings (e.g., using a 5x5 risk matrix) to provide a clear picture of the risk landscape.

Answer

Detailed results of control testing

Answer

Cost-benefit analysis of risk responses

Question 8

You are the IT risk manager for a mid-sized e-commerce company that processes over 10,000 transactions per day. The company recently migrated its customer database from an on-premises SQL Server to a cloud-based PostgreSQL instance on AWS RDS. The database contains personally identifiable information (PII) including names, addresses, and credit card numbers (stored as encrypted tokens). The migration was performed by the DevOps team with minimal involvement from the security team. Two weeks after the migration, the company experienced a data breach where an attacker exfiltrated a subset of customer records. The forensic investigation revealed that the attacker exploited a misconfigured security group that allowed inbound traffic from the internet on port 5432 (PostgreSQL default port). Additionally, the database had a publicly accessible endpoint, and the master user password was weak (eight characters, no special characters). The attacker used a brute-force attack to guess the password. The security group has since been corrected, and the password has been changed to a strong one. The breach notification laws require reporting within 72 hours. The CEO wants to understand the root cause and prevent recurrence. As the risk manager, which of the following actions should you recommend as the MOST effective to prevent a similar incident?

Accepted Answer

Implement infrastructure-as-code (IaC) security scanning and policy enforcement in the CI/CD pipeline to prevent insecure configurations.. Option C is correct because the root cause is the misconfigured security group and weak password, both of which stem from insufficient security review and lack of automated controls. Implementing a policy-as-code tool that enforces security group rules (e.g., no public access to databases) and password policies during deployment would prevent such misconfigurations. Option A is wrong because while a dedicated DBA could help, it does not address the process gap for automated enforcement. Option B is wrong because quarterly reviews are too infrequent to catch misconfigurations quickly. Option D is wrong because IDS/IPS detects attacks but does not prevent misconfigurations.

Answer

Deploy an intrusion detection system (IDS) to monitor database traffic for brute-force attempts.

Answer

Hire a dedicated database administrator to review all database configurations weekly.

Answer

Conduct quarterly security audits of cloud infrastructure configurations.

Question 9

A financial institution uses a third-party cloud service for data analytics. The service has access to non-public personal information (NPI). During a risk assessment, the risk manager discovers that the cloud provider uses subprocessors without notifying the institution. The contract does not require notification of subprocessor changes. What should the risk manager do FIRST?

Accepted Answer

Notify the vendor of the contract breach and request a list of all subprocessors and their compliance certifications.. Option A is correct because immediate termination may disrupt operations; the first step should be to notify the vendor of the breach and request a list of subprocessors to assess risk. Option B is wrong because immediately terminating the contract could cause significant business disruption. Option C is wrong because the risk manager should first gather information. Option D is wrong because accepting risk without understanding the subprocessors' controls is not prudent.

Answer

Report the incident to the data protection authority as a breach of contract.

Answer

Accept the risk since the vendor remains SOC 2 Type II certified.

Answer

Terminate the contract immediately to mitigate the risk of unauthorized data access.

Question 10

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Accepted Answer

Re-evaluate risk treatment options with the risk owner. When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Answer

Escalate directly to the board

Answer

Update the risk register to reflect the residual risk

Answer

Accept the residual risk

Question 11

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Accepted Answer

Communicate the risk exposure to senior management. Option C is correct because the risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 12

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended. Option A is indirect. Option C does not verify effectiveness. Option D is too broad.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 13

Order the steps for implementing a risk treatment plan.

Question 14

Arrange the steps for performing a risk assessment in the correct order.

Question 15

Order the steps for incident response handling.

Question 16

Put the steps for developing an information security policy in order.

Question 17

Sequence the steps for implementing a new control based on risk assessment findings.

Question 18

Arrange the steps for performing a vulnerability assessment.

Question 19

Order the steps for change management in an IT environment.

Question 20

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

Accepted Answer

Implement flood barriers and redundant cooling systems. Implementing flood barriers and redundant cooling systems directly reduces the likelihood and impact of a flood event on the data center's physical infrastructure. This is a risk mitigation strategy that proactively addresses the root cause of the risk (flooding) by hardening the facility, which is the most effective treatment for a high-probability, high-impact physical threat.

Answer

Purchase business interruption insurance

Answer

Move all operations to a cloud provider

Answer

Accept the risk and document it in the risk register