CRISC Hard Questions — 25 Difficult Questions

Question 1

A Key Risk Indicator (KRI) for vulnerability management is the "average patch lag time" (number of days between patch release and deployment). In the last month, this metric increased from 15 days to 45 days. How should the risk practitioner interpret this change?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The risk level has increased because exposure to known vulnerabilities has grown.. An increase in average patch lag from 15 to 45 days means critical vulnerabilities remain exploitable for a longer window, directly increasing exposure to known threats. Since KRIs are designed to signal changes in risk levels, a rising KRI indicates the risk level has increased and warrants attention. The correct interpretation is that the organization's exposure to known vulnerabilities has grown.

Answer

The KRI is not relevant because patch lag is a control indicator, not a risk indicator.

Answer

The risk level has decreased because patches are being evaluated more thoroughly.

Answer

The risk level remains unchanged because patch lag is a lagging indicator.

Question 2

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 3

Your organization is undergoing a merger and acquisition. The IT risk assessment team is tasked with evaluating the target company's IT environment. During the assessment, you discover that the target company uses a legacy ERP system that is no longer supported by the vendor. They have no disaster recovery plan for this system, and it contains financial data critical to the merged entity. The integration timeline is aggressive, and replacing the system would delay the merger by 18 months. The executive team is reluctant to delay. What is the BEST risk treatment option?

Accepted Answer

Mitigate by developing a disaster recovery plan and implementing compensating controls such as regular backups and manual procedures.. The legacy ERP system contains critical financial data and cannot be replaced without an 18-month delay, making risk mitigation the most practical approach. Developing a disaster recovery plan and implementing compensating controls (e.g., regular backups, manual procedures) reduces the likelihood and impact of a system failure while allowing the merger to proceed on schedule. This aligns with the CRISC principle of treating risk by reducing residual risk to an acceptable level without blocking business objectives.

Answer

Avoid the risk by excluding the legacy system from the merger and migrating data to a new system.

Answer

Accept the risk because the system has been running for years without issue.

Answer

Transfer the risk to the target company's previous owners.

Question 4

During a risk assessment, an organization identifies that its remote workforce uses personal devices for work. The risk manager is concerned about data leakage. The organization has a risk appetite that is 'moderate' and wants to treat the risk. Which of the following is the MOST effective risk treatment option?

Accepted Answer

Implement a Mobile Device Management (MDM) policy with containerization. The most effective because MDM with containerization creates a separate, encrypted work profile on the personal device, isolating corporate data from personal apps and data. This directly addresses data leakage by enforcing security policies (e.g., remote wipe of the work container only) without requiring full control over the entire device, aligning with a 'moderate' risk appetite that seeks a balance between security and usability.

Answer

Implement a VPN for remote access

Answer

Require full disk encryption on all personal devices

Answer

Ban the use of personal devices for work

Question 5

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 6

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 7

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Accepted Answer

A service account is authenticating with a password rather than a certificate. Service accounts should authenticate using non-replayable methods like certificates or managed service accounts (gMSA) rather than static passwords. A password-based authentication for a privileged service account, especially after a series of failed logins, indicates a high risk of credential compromise and lateral movement, making this the most significant finding from a risk monitoring perspective.

Answer

The service account has excessive database privileges

Answer

The failed login events were not logged in real time

Answer

Failed logins indicate a possible brute force attack

Question 8

A company is integrating its IT risk management program with the enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It provides a holistic view of risk across the organization.. Integration ensures that IT risks are considered in the context of overall organizational objectives and that risk responses are aligned across the enterprise.

Answer

It allows IT to operate independently from business units.

Answer

It eliminates the requirement for a separate IT risk register.

Answer

It reduces the need for IT-specific risk assessments.

Question 9

A multinational corporation has deployed a centralized log management system that collects security events from all subsidiaries. The CRO notices that the number of critical alerts from the Asia-Pacific region has dropped significantly over the past week. Upon investigation, the log source status shows that 30% of the devices in that region have not sent any logs in 48 hours. What is the MOST likely cause?

Accepted Answer

A configuration change was made to the log forwarder agent on the affected devices, causing it to stop sending logs.. A configuration change to the log forwarder agent (e.g., syslog-ng, rsyslog, or a proprietary agent) is the most plausible cause for a sudden, sustained drop in log volume from a subset of devices. Unlike network segmentation (Option D), which would affect all traffic, or a DDoS (Option B), which would cause intermittent or total loss, an agent misconfiguration selectively stops log generation while the device remains online. The 48-hour window and 30% device impact align with a staged or partial rollout of a faulty agent configuration.

Answer

The security team applied a new log suppression rule that filters out low-severity events.

Answer

The region experienced a distributed denial-of-service (DDoS) attack that overwhelmed the log collection infrastructure.

Answer

The network team recently implemented a segmentation change that blocked log traffic from those devices.

Question 10

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register must capture B (Risk owner), because every identified risk needs an accountable individual responsible for monitoring and managing it throughout its lifecycle. C (Root cause) is essential because documenting the underlying source or driver of the risk enables proper analysis and effective treatment rather than just addressing symptoms. E (Risk description) is required to clearly articulate the nature of the risk, including the event, its potential consequences, and context, so it can be understood and prioritized. A (Quantified monetary impact) is not always essential at the identification stage, since qualitative or semi-quantitative assessments may suffice initially and quantification often occurs later during analysis. D (Mitigation plan) is a risk treatment output that follows assessment and is not a core identification component, as the register first needs to record the risk itself before responses are defined.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 11

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 12

A risk manager is updating the risk report for the IT steering committee. Which THREE elements should be included to provide a comprehensive view of the risk posture?

Accepted Answer

Risk trend analysis. Risk trend analysis (B) is correct because tracking how risk exposure changes over time (e.g., increasing, decreasing, or stable risk levels across reporting periods) gives the steering committee insight into whether risk management efforts are effective and where emerging risks are developing. A risk heat map (C) is correct because it visually plots risks by likelihood and impact, enabling the committee to quickly identify and prioritize the highest-exposure areas across the organization's risk posture. Top risks and their status (E) is correct because summarizing the most significant risks along with their current mitigation status, owners, and progress provides the committee with actionable, decision-ready information for governance. Names of all IT employees (A) is not a risk posture element—it is personnel data with no bearing on risk likelihood, impact, or treatment. Detailed configuration of each firewall (D) is far too granular and technical for a steering-committee risk report; such operational detail belongs in technical security documentation, not executive risk reporting.

Answer

Names of all IT employees

Answer

Detailed configuration of each firewall

Question 13

An organization is designing a control monitoring program. Which THREE of the following are types of control monitoring activities that should be included?

Accepted Answer

Periodic internal audits of control processes. Periodic internal audits of control processes (Option A) are a formal, independent review of control design and effectiveness, providing assurance that controls are operating as intended. This is a detective control monitoring activity that validates the control environment over time, often aligned with frameworks like COSO or COBIT.

Answer

Defining risk appetite statements

Answer

Penetration testing of critical systems

Question 14

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

Accepted Answer

Conduct a root cause analysis of the deficiencies. A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Answer

Report the deficiency to the board for oversight

Answer

Increase the frequency of control testing to monthly

Answer

Immediately replace the control with a more robust one

Question 15

A company uses cyber insurance to cover losses from data breaches. This is an example of which risk treatment?

Accepted Answer

Transfer. Transfer shifts risk to a third party, such as an insurance company.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 16

A financial institution is redesigning its control monitoring program to comply with a new regulatory requirement that mandates near-real-time monitoring of high-risk transactions. The current system performs batch processing daily. Which approach BEST meets the requirement while minimizing operational impact?

Accepted Answer

Implement a real-time monitoring solution that only processes transactions flagged as high-risk based on predefined criteria.. It directly satisfies the near-real-time monitoring requirement by processing only high-risk transactions as they occur, using predefined criteria to minimize latency and operational overhead. This targeted approach avoids the cost and complexity of converting all transaction processing to real-time, while still meeting regulatory demands for immediate detection of high-risk activity.

Answer

Use manual reviews of high-risk transactions by compliance officers within 24 hours.

Answer

Replace batch processing with a fully real-time system for all transactions.

Answer

Increase batch processing frequency from daily to hourly.

Question 17

In a quantitative risk analysis, the annualized loss expectancy (ALE) is calculated as $1 million. If the organization implements a control that reduces the ARO from 0.5 to 0.1, and the SLE remains constant at $2 million, what is the new ALE?

Accepted Answer

$200,000. The annualized loss expectancy (ALE) is calculated as SLE × ARO. With SLE constant at $2 million and the new ARO reduced to 0.1, the new ALE is $2,000,000 × 0.1 = $200,000. This reflects the residual risk after the control is implemented.

Answer

$500,000

Answer

$100,000

Answer

$1 million

Question 18

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Accepted Answer

Actor. In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

Answer

Event

Answer

Threat type

Answer

Asset/Resource

Question 19

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness. Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 20

A large bank has implemented a sophisticated risk and control monitoring system with multiple dashboards and automated reporting for key risk indicators (KRIs). However, the board of directors has been receiving conflicting KRI reports from different business units (e.g., retail banking, corporate lending, and wealth management). For example, the fraud KRI shows a high risk in retail but low risk in wealth management, yet both units use the same underlying data source. The chief risk officer (CRO) is concerned that the board is losing confidence in the risk reporting. An investigation reveals that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. What is the most likely root cause and the best remediation?

Accepted Answer

The KRI definitions and calculation methods are not standardized across business units.. The root cause of conflicting KRI reports is that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. This lack of standardization leads to inconsistent risk measurements, even when using the same underlying data source. The best remediation is to standardize KRI definitions, calculation methods, thresholds, and reporting frequencies across all business units to ensure consistent and comparable risk reporting to the board.

Answer

The reporting frequency is inadequate; monthly reports should be weekly.

Answer

The data sources for KRIs are inconsistent across business units.

Answer

The board members are misinterpreting the KRI reports due to lack of training.