CRISC IT Risk Assessment Practice Test 2 — 15 Questions

Question 1

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

Accepted Answer

Accept the risk with compensating controls such as network segmentation.. Option D is correct because the system processes non-critical data and cannot be patched, making risk acceptance with compensating controls the most appropriate strategy. Network segmentation reduces the likelihood of exploitation by isolating the legacy system from critical assets, while the low likelihood and non-critical data make decommissioning or insurance less suitable. This aligns with CRISC best practices for legacy systems where patching is impossible and the risk is within the organization's risk appetite.

Answer

Mitigate the risk by applying vendor patches.

Answer

Avoid the risk by decommissioning the system immediately.

Answer

Transfer the risk by purchasing cyber insurance.

Question 2

During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?

Accepted Answer

Implement a web application firewall (WAF) as a compensating control.. A web application firewall (WAF) is the appropriate compensating control because it can inspect and block SQL injection payloads at the HTTP/HTTPS layer without modifying the application code. This provides immediate risk reduction while the development team works on the permanent fix, aligning with the principle of defense-in-depth and the risk manager's responsibility to treat unacceptable risk during the remediation window.

Answer

Accept the risk due to the low likelihood of exploitation.

Answer

Document the risk and defer action to the next assessment.

Answer

Request an immediate emergency patch deployment.

Question 3

A risk manager is evaluating the risk associated with a new third-party vendor that will have access to customer data. The vendor has been in business for 10 years and holds ISO 27001 certification. Which factor should be given the MOST weight when determining the vendor's risk level?

Accepted Answer

The sensitivity and volume of data the vendor will access.. The sensitivity and volume of data directly determine the potential impact of a breach, which is a core component of inherent risk. Even with strong controls like ISO 27001, the risk level is primarily driven by the value and quantity of the asset at risk (customer data). In IT risk assessment, the asset's criticality and exposure outweigh historical or certification-based indicators when calculating residual risk.

Answer

The vendor's years in operation.

Answer

The vendor's ISO 27001 certification.

Answer

The contractual terms for data protection.

Question 4

Which TWO of the following are valid techniques for identifying risk in IT risk assessment?

Accepted Answer

SWOT analysis. SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) is a structured technique used to identify both internal and external risk factors during IT risk assessment. It helps uncover threats that could exploit weaknesses, as well as opportunities that might mitigate risks, making it a valid identification method.

Answer

Residual risk assessment

Answer

Risk aggregation

Answer

Monte Carlo simulation

Question 5

Which THREE of the following are key components of a risk assessment report?

Accepted Answer

Risk register with identified risks. A risk register is a core component of a risk assessment report because it formally documents each identified risk, its owner, status, and tracking information. This register serves as the authoritative record that links risk identification to subsequent analysis and response activities, ensuring traceability throughout the risk management lifecycle.

Answer

Copies of vendor contracts

Answer

Network topology diagram

Question 6

Which TWO of the following are examples of inherent risk?

Accepted Answer

Risk of unauthorized access due to weak password policy. Inherent risk is the risk that exists in the absence of any controls or mitigations. Option A describes the risk of unauthorized access due to a weak password policy, which is a vulnerability present before any compensating controls (like multifactor authentication) are applied. Option B describes the risk of a data breach due to unencrypted sensitive data, which is a direct exposure that exists before encryption controls are implemented. Both represent the raw, uncontrolled risk level.

Answer

Residual risk after implementing firewalls

Answer

Risk appetite defined by the board

Answer

Risk reduction achieved by multifactor authentication

Question 7

Based on the exhibit, what is the MOST likely risk scenario?

Accepted Answer

Brute force attack resulting in account compromise. The exhibit shows a high number of failed authentication attempts from a single IP address over a short time window, followed by a successful login. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations until one succeeds, leading to account compromise.

Answer

Phishing attack that captured user credentials

Answer

Insider threat from a legitimate user

Answer

Denial of service attack on the authentication server

Question 8

Based on the exhibit, what is the primary risk to the organization?

Accepted Answer

Unauthorized disclosure of sensitive customer data. The exhibit shows a database server with customer data accessible via a web application that uses unencrypted HTTP (port 80) and has direct internet exposure. This configuration allows an attacker to intercept traffic or exploit the lack of encryption to read sensitive customer data in transit, making unauthorized disclosure the primary risk. The core reasoning is that unencrypted HTTP exposes data to eavesdropping and man-in-the-middle attacks, directly violating confidentiality requirements for sensitive customer information.

Answer

Unauthorized modification of customer data

Answer

Data loss due to accidental deletion

Answer

Denial of service due to excessive read requests

Question 9

You are the IT risk manager for a multinational corporation with a hybrid cloud environment. The company uses AWS for its primary infrastructure and maintains an on-premises data center for legacy applications. Recently, the security team detected that a contractor's credentials were used to access an S3 bucket containing personally identifiable information (PII) of European customers. The contractor had been granted access to this bucket six months ago for a data migration project that has since been completed. The access was not revoked. The security team has implemented an automated process to review and revoke access for contractors after project completion, but this process has not been applied retroactively. The company is subject to GDPR. Which of the following is the BEST course of action to address the immediate risk?

Accepted Answer

Immediately revoke the contractor's access and initiate a review of all contractor accounts to revoke any unnecessary permissions.. The immediate risk is that the contractor still has active access to an S3 bucket containing PII, which violates GDPR's principle of data minimization and access control (Article 5(1)(f)). Revoking the contractor's access now stops any ongoing unauthorized access, and initiating a review of all contractor accounts addresses the systemic failure to apply the automated process retroactively. This directly mitigates the risk of further data exposure without delay.

Answer

Conduct a forensic investigation to determine if any data was exfiltrated, then update the incident response plan.

Answer

Manually review access rights for all contractors and revoke those not needed, starting with the most sensitive systems.

Answer

Update the automated access review process to include all existing contractor accounts and schedule it to run weekly.

Question 10

A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?

Accepted Answer

Scenario analysis with a focus on likelihood and impact. Scenario analysis is most appropriate because the risk of data exfiltration by a malicious insider at the cloud provider is a complex, low-frequency, high-impact threat that is difficult to quantify with historical data. This approach allows the risk manager to systematically evaluate specific attack paths (e.g., an insider with database access copying customer records) by focusing on likelihood and impact, which aligns with the qualitative nature of insider threat assessment in a cloud environment.

Answer

Quantitative risk assessment using ALE and SLE

Answer

Application of the COSO ERM framework

Answer

Control self-assessment (CSA) against ISO 27001

Question 11

During a risk assessment for a critical financial application, the IT risk manager identifies a vulnerability in the application's authentication module. The exploit would require authenticated access. Which risk rating is most appropriate if the vulnerability has a CVSS base score of 9.0, but the application is behind a strong firewall and requires two-factor authentication?

Accepted Answer

Medium, after considering the compensating controls. Option A is correct because the CVSS base score of 9.0 reflects the intrinsic severity of the vulnerability, but the final risk rating must incorporate compensating controls. The strong firewall and two-factor authentication (2FA) significantly reduce the likelihood of exploitation, as the attacker would need to bypass both network-level filtering and an additional authentication factor. In CRISC methodology, risk is a function of likelihood and impact; here, the controls lower the likelihood, resulting in a Medium residual risk rating despite the high base score.

Answer

Low, because the application requires authenticated access

Answer

High, because CVSS base score is 9.0

Answer

Very high, due to the criticality of the application

Question 12

Which THREE of the following are key components of an IT risk assessment report as per ISACA guidelines?

Accepted Answer

Identified risk scenarios and their risk levels. Option C is correct because an IT risk assessment report, per ISACA guidelines, must include identified risk scenarios and their associated risk levels. This is a core component that documents the specific threats, vulnerabilities, and the resulting inherent risk ratings (e.g., using a 5x5 risk matrix) to provide a clear picture of the risk landscape.

Answer

Detailed results of control testing

Answer

Cost-benefit analysis of risk responses

Question 13

Based on the exhibit, which risk should be treated first according to the risk rating?

Accepted Answer

R001, because it has the highest risk level. Option D is correct because risk treatment priority is determined by the risk level, which is a function of both likelihood and impact. In the exhibit, R001 has the highest risk level (e.g., 16), calculated as likelihood × impact, making it the most critical to address first. This aligns with the CRISC principle of prioritizing risks with the highest residual risk rating.

Answer

R003, because the likelihood is highest

Answer

R002, because the impact is highest

Answer

All three should be treated simultaneously

Question 14

You are the IT risk manager at a multinational corporation that recently migrated its customer database to a cloud-based platform. The database contains personally identifiable information (PII) subject to GDPR. During a routine vulnerability scan, you discover that the database is accessible from the internet without encryption (port 1433 open). The cloud provider's shared responsibility model indicates that securing the database configuration is the customer's responsibility. You have identified the risk as high likelihood and high impact. The business owner argues that the database is only accessible to a limited IP range and that encryption would degrade performance. Which course of action should you recommend to treat the risk?

Accepted Answer

Close the port or implement a VPN, and enforce encryption. Option D is correct because closing the port or implementing a VPN is the most effective way to eliminate the direct exposure, and encryption should be applied to protect data in transit. Option A is wrong because accepting risk without compensating controls violates GDPR requirements. Option B is wrong because a compensating control (WAF) does not address the lack of encryption. Option C is wrong because transferring risk via cyber insurance does not reduce the actual exposure.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk because the IP restriction reduces likelihood

Answer

Implement a web application firewall (WAF) to monitor traffic

Question 15

Refer to the exhibit. An organization has identified vulnerabilities on a critical server. The risk owner has limited resources and can remediate only one finding this quarter. Based on the information provided, which approach is the most appropriate risk assessment decision?

Accepted Answer

Remediate the SSL/TLS certificate vulnerability first, as it affects a critical service and has a higher severity.. Option B is correct because the SSL/TLS certificate vulnerability affects a critical service (likely HTTPS) and has a higher severity rating, making it the most urgent risk to address given limited resources. Risk assessment prioritizes remediating vulnerabilities that pose the greatest threat to critical business functions, even if another finding is easier to fix. The risk owner should allocate the single remediation slot to the highest-severity vulnerability on a critical server to maximize risk reduction.

Answer

Remediate both findings by reallocating budget from another project.

Answer

Remediate the SSH vulnerability first because it is easier to fix (upgrade OpenSSH).

Answer

Accept both risks because they are low and medium severity, and resources are limited.