CRISC IT Risk Assessment Practice Test 7 — 15 Questions

Question 1

A financial institution is selecting a risk assessment methodology for evaluating cybersecurity risks across its critical systems. Which of the following is the PRIMARY consideration when choosing between qualitative and quantitative approaches?

Accepted Answer

Availability of reliable numerical data for risk factors. The choice between qualitative and quantitative risk assessment hinges on the availability of reliable numerical data. Quantitative methods require precise, objective data (e.g., asset values, historical loss frequencies, exposure factors) to compute metrics like Annualized Loss Expectancy (ALE). Without such data, the results would be misleading, making qualitative approaches (using ordinal scales and expert judgment) more appropriate. This is the primary technical gate, as it directly determines the feasibility and validity of the quantitative model.

Answer

The skill level of the risk assessment team

Answer

The organization's risk appetite statement

Answer

Compliance with regulatory requirements

Question 2

During a risk assessment, a risk practitioner identifies that a legacy application uses a deprecated encryption protocol. The application is critical for business operations and cannot be patched. Which of the following is the BEST approach to assess the risk?

Accepted Answer

Analyze the threat landscape and existing compensating controls to determine residual risk. The best approach is to consider the compensating controls in place. The risk should be evaluated in context of existing controls; if controls reduce likelihood/impact, residual risk may be acceptable. Option A is too extreme without analysis; option B is not a complete assessment; option D is premature.

Answer

Replace the application with a modern alternative

Answer

Assign a high inherent risk score without further analysis

Answer

Immediately escalate to senior management for an exception

Question 3

A company calculates the annualized loss expectancy (ALE) for a server outage as $75,000. The cost to implement a high-availability solution is $200,000 with a lifespan of 5 years and annual maintenance of $10,000. What is the residual risk if the solution reduces outage likelihood by 90%?

Accepted Answer

$7,500. The correct answer is B: $7,500. The annualized loss expectancy (ALE) before mitigation is $75,000. The high-availability solution reduces outage likelihood by 90%, so the residual ALE is 10% of $75,000 = $7,500. The cost of the solution ($200,000 capital with $10,000 annual maintenance over 5 years) is used to calculate the cost-benefit or net present value, but does not directly affect the residual risk figure, which is purely the remaining expected loss after controls are applied.

Answer

$50,000

Answer

$42,500

Answer

$57,500

Question 4

After a risk assessment, the risk owner states that the residual risk for a specific asset is within the organization's risk tolerance. Which of the following BEST describes the action that should be taken?

Accepted Answer

Formally accept the risk and document the decision. When the risk owner confirms that residual risk is within the organization's risk tolerance, the appropriate action is to formally accept the risk and document the decision. This is a standard risk treatment option (risk acceptance) under the ISACA Risk IT Framework, where no further controls are needed because the residual risk level is already acceptable. Documenting the acceptance ensures auditability and accountability for the decision.

Answer

Transfer the risk to a third party

Answer

Implement additional controls to reduce risk further

Answer

Reassess the risk using a quantitative method

Question 5

During a risk assessment, the risk practitioner discovers that a critical database does not have an active failover solution. The database is used by multiple business applications. Which of the following factors should be given the HIGHEST weight when determining the inherent risk level?

Accepted Answer

The criticality of the database to business operations. The inherent risk level is determined by the potential impact and likelihood of a threat exploiting a vulnerability, without considering controls. The criticality of the database to business operations directly drives the impact severity—if the database fails, multiple business applications could be disrupted, leading to significant operational and financial damage. This makes option A the highest-weighted factor because it defines the worst-case consequence, which is the foundation of inherent risk.

Answer

The number of existing compensating controls

Answer

The frequency of vulnerability scans

Answer

The cost to restore the database from backup

Question 6

A risk practitioner is conducting a threat modeling exercise for a new cloud-based application using the STRIDE methodology. Which of the following is the PRIMARY benefit of using STRIDE over a simple checklist?

Accepted Answer

It identifies threats by category, reducing the chance of missing key threat types. The STRIDE methodology categorizes threats into six specific types (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). This structured approach ensures that the threat modeling exercise systematically covers each category, reducing the likelihood of overlooking entire classes of threats that a simple checklist might miss. For a cloud-based application, this is critical because threats like elevation of privilege or information disclosure can manifest in unique ways across shared infrastructure, and STRIDE forces the practitioner to consider each category explicitly.

Answer

It requires less expertise to perform

Answer

It automatically quantifies risk levels

Answer

It ensures consistent application of controls

Question 7

Which of the following is the BEST indicator that a control is effective in mitigating a risk?

Accepted Answer

Regular testing shows the control consistently reduces the risk to the desired level. Option A is correct because the effectiveness of a control is ultimately measured by its ability to consistently reduce residual risk to the organization's defined risk appetite. Regular testing provides empirical evidence that the control is operating as intended and achieving the desired risk mitigation outcome, which is the primary goal of risk treatment.

Answer

The control is automated and runs daily

Answer

The control is documented in a policy

Answer

The cost of the control is lower than the potential loss

Question 8

A risk register is being updated after a quarterly risk assessment. One risk has decreased in likelihood due to new controls. However, the risk score remains unchanged because the impact increased. What should the risk practitioner do?

Accepted Answer

Recalculate the risk score using the new likelihood and impact values. The risk score is a function of both likelihood and impact. Even though new controls reduced likelihood, the increased impact means the overall risk level may remain unchanged. The correct action is to recalculate the risk score using the updated values to reflect the current risk posture accurately, as required by the risk assessment process.

Answer

Remove the risk from the register because it is under control

Answer

Automatically accept the risk because likelihood decreased

Answer

Escalate to senior management for a new risk treatment plan

Question 9

During a quantitative risk analysis, the risk practitioner determines that the single loss expectancy (SLE) for a ransomware attack is $500,000 and the annualized rate of occurrence (ARO) is 0.4. The organization has a risk appetite that accepts annual losses up to $150,000. What is the recommended action?

Accepted Answer

Implement controls to reduce the likelihood or impact until ALE is below $150,000. The ALE is $500,000 * 0.4 = $200,000, which exceeds the risk appetite of $150,000. Therefore, additional controls are needed to reduce either SLE or ARO. Option A is incorrect because residual risk is not yet acceptable; option B is not justified by cost; option D is only if risk is within appetite.

Answer

Purchase insurance to cover the potential loss

Answer

Accept the risk because it is within the organization's risk appetite

Answer

Reassess using qualitative analysis because the ARO is not precise

Question 10

Which TWO of the following are valid triggers for initiating a risk assessment outside the regular cycle? (Select 2)

Accepted Answer

A significant change in the IT infrastructure. A significant change in IT infrastructure (Option B) is a classic trigger for ad-hoc risk assessment because it introduces new vulnerabilities, alters the attack surface, or changes the effectiveness of existing controls. For example, migrating from on-premises servers to a cloud environment (e.g., AWS, Azure) changes network segmentation, identity management, and data residency, requiring a fresh risk evaluation to identify and treat new threats before they are exploited.

Answer

An employee completing annual security awareness training

Answer

The annual internal audit of financial controls

Answer

Completion of a routine security patch cycle

Question 11

Which TWO of the following are characteristics of quantitative risk analysis compared to qualitative risk analysis? (Select 2)

Accepted Answer

It produces results in monetary values or percentages. Quantitative risk analysis uses numerical data to assign monetary values or percentages to risk components such as asset value, exposure factor, and annualized loss expectancy. This allows for precise, data-driven comparisons and prioritization of risks based on financial impact.

Answer

It is always easier to communicate to non-technical stakeholders

Answer

It requires less specialized expertise to perform

Answer

It relies solely on expert judgment without numerical data

Question 12

Which THREE of the following are valid risk response options according to the ISACA risk management framework? (Select 3)

Accepted Answer

Mitigate the risk through controls. Option B is correct because risk mitigation involves implementing controls to reduce the likelihood or impact of a risk to an acceptable level. In the ISACA framework, this is a primary risk response option, often achieved through technical controls like firewalls, encryption, or access management systems.

Answer

Enhance the risk to gain strategic advantage

Answer

Monitor the risk without taking action

Question 13

Based on the exhibit, which of the following is the MOST likely risk scenario?

Accepted Answer

A brute-force attack targeting the root account. The exhibit shows repeated failed login attempts for the root account, which is a classic indicator of a brute-force attack. SSH logs typically record authentication failures, and a high frequency of 'Failed password for root' entries from a single source IP strongly suggests an automated password guessing attempt. This aligns with the risk scenario of a brute-force attack targeting the root account.

Answer

A denial-of-service attack on the SSH service

Answer

A successful privilege escalation by an insider

Answer

A misconfigured firewall allowing unauthorized access

Question 14

Based on the exhibit, what is the PRIMARY risk associated with this S3 bucket policy?

Accepted Answer

The policy permits unauthenticated access to sensitive data. The S3 bucket policy includes a `Principal: "*"` statement that grants public access to the bucket. Combined with an `Effect: Allow` and `Action: s3:GetObject`, this permits any unauthenticated user on the internet to read objects in the bucket. This is the primary risk because it exposes sensitive data to anyone without requiring AWS credentials or any form of authentication.

Answer

The policy allows access to all S3 buckets in the account

Answer

The policy denies access to legitimate users from outside the subnet

Answer

The policy uses an incorrect IP range that blocks all traffic

Question 15

Based on the exhibit, which of the following poses the HIGHEST risk to the environment?

Accepted Answer

The database has a direct SSH connection from the internet. Option D is correct because a direct SSH connection from the internet to the database server bypasses all network segmentation and firewall controls, exposing the database to brute-force attacks, credential theft, and unauthorized remote access. SSH is a management protocol, not an application protocol, and its exposure on the internet creates a direct attack surface on the most sensitive data tier, which is the highest risk to the environment.

Answer

The web servers are in a public subnet

Answer

The communication between web and application servers is encrypted via HTTPS

Answer

The application servers use embedded credentials to access the database