CRISC IT Risk Assessment — Timed 30 Questions

Question 1

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

Accepted Answer

Implement flood barriers and redundant cooling systems. Implementing flood barriers and redundant cooling systems directly reduces the likelihood and impact of a flood event on the data center's physical infrastructure. This is a risk mitigation strategy that proactively addresses the root cause of the risk (flooding) by hardening the facility, which is the most effective treatment for a high-probability, high-impact physical threat.

Answer

Purchase business interruption insurance

Answer

Move all operations to a cloud provider

Answer

Accept the risk and document it in the risk register

Question 2

A risk assessment for a healthcare organization reveals a high likelihood of data breaches due to weak encryption on portable devices. The organization decides to deploy full-disk encryption and enforce multi-factor authentication. Which risk response strategy is being applied?

Accepted Answer

Mitigation. Deploying full-disk encryption and multi-factor authentication directly reduces the likelihood and/or impact of data breaches from weak encryption on portable devices. This is the definition of risk mitigation — applying controls to lower risk to an acceptable level. The organization is actively reducing the vulnerability, not transferring, accepting, or avoiding the risk.

Answer

Transfer

Answer

Acceptance

Answer

Avoidance

Question 3

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

Accepted Answer

To determine the criticality and recovery time objectives of business processes. Option B is correct because the BIA identifies critical business processes and their recovery priorities. Option A is wrong because vulnerability assessment is separate. Option C is wrong because threats are identified in threat modeling. Option D is wrong because asset inventory is part of asset management.

Answer

To identify vulnerabilities in IT systems

Answer

To identify potential threat actors

Answer

To inventory all IT assets

Question 4

A retail company is assessing the risk of a POS malware attack. Which approach would BEST quantify the potential financial impact?

Accepted Answer

Scenario analysis with input from business and IT stakeholders. Scenario analysis with input from business and IT stakeholders is the best approach because it allows the organization to model specific POS malware attack scenarios, incorporating both technical threat vectors (e.g., memory scraping of track data) and business context (e.g., PCI DSS fines, card reissuance costs, brand damage). This collaborative method produces a more accurate and contextualized financial impact estimate than purely historical or technical assessments, especially for emerging or evolving threats like POS malware.

Answer

Vulnerability scanning and penetration testing

Answer

Annualized Loss Expectancy (ALE) calculation based on past incidents

Answer

Failure Mode and Effects Analysis (FMEA)

Question 5

A risk assessor is evaluating a third-party cloud service provider. Which of the following is the MOST important factor to consider when assessing the risk of data exfiltration?

Accepted Answer

The provider's encryption standards for data at rest and in transit. Data exfiltration risk is primarily mitigated by strong encryption standards for data at rest and in transit. Even if a provider has robust access controls, weak encryption (e.g., using TLS 1.0 or AES-128-CBC with predictable IVs) can allow an attacker to intercept or decrypt data during transfer or storage. Encryption directly prevents unauthorized extraction of readable data, making it the most critical factor.

Answer

The provider's data portability and exit process

Answer

The provider's service level agreement (SLA) for uptime

Answer

The number of security certifications held by the provider

Question 6

An organization has a risk appetite that is risk-averse. Which risk treatment option would be most aligned with this appetite?

Accepted Answer

Avoid the risk by discontinuing the activity. A risk-averse organization prioritizes avoiding exposure to threats. Discontinuing the activity that introduces the risk (option A) eliminates the threat source entirely, ensuring no residual risk remains. This aligns directly with a risk-averse appetite, where even low-probability, high-impact events are unacceptable.

Answer

Mitigate the risk with controls

Answer

Accept the risk

Answer

Transfer the risk through insurance

Question 7

During a risk assessment, a financial institution identifies that its online banking application uses an outdated encryption protocol. The likelihood of exploitation is high, and the impact is moderate. What should the risk owner do FIRST?

Accepted Answer

Validate the risk rating with additional data. The risk owner's first responsibility is to ensure the risk assessment is accurate before deciding on a response. Validating the risk rating with additional data (option B) confirms that the high likelihood and moderate impact are correctly assessed, which is a prerequisite for selecting an appropriate treatment. Jumping to implement controls, transfer, or accept the risk without validation could lead to misallocation of resources or inadequate mitigation.

Answer

Implement a compensating control to mitigate the risk

Answer

Transfer the risk via cyber insurance

Answer

Accept the risk as low priority

Question 8

A multinational corporation is assessing the risk of non-compliance with GDPR. Which of the following is the BEST approach to quantify the potential fine?

Accepted Answer

Base the estimate on the organization's annual global turnover. Under GDPR, the maximum fine for non-compliance is the greater of €20 million or 4% of the organization's annual global turnover. Therefore, basing the estimate on annual global turnover directly aligns with the regulatory formula used by supervisory authorities, making it the most accurate and defensible quantification approach for potential fines.

Answer

Estimate based on the cost of cyber insurance premiums

Answer

Calculate the cost of data breach using the Ponemon Institute model

Answer

Use industry benchmarks for data breach costs

Question 9

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

Accepted Answer

Risk treatment plans are implemented within agreed timelines. The effectiveness of an IT risk assessment process is ultimately measured by whether identified risks are actually treated within agreed timelines. Option D directly demonstrates that the organization moves from risk identification to remediation, closing the risk management loop. Without timely implementation of treatment plans, even the most thorough risk assessments provide no reduction in actual risk exposure.

Answer

The risk register contains a large number of risks

Answer

Risk appetite statements are clearly defined

Answer

Risk assessments are performed annually

Question 10

A risk assessment reveals that a legacy system has a high vulnerability score but low business criticality. The cost to remediate is high. What is the MOST appropriate risk response?

Accepted Answer

Accept the risk and monitor it. Option B is correct because acceptance is appropriate when the cost of mitigation exceeds the potential loss. Option A is wrong because mitigation might not be cost-effective. Option C is wrong because avoidance might not be necessary. Option D is wrong because transfer might not be possible for legacy systems.

Answer

Avoid the risk by decommissioning the system

Answer

Mitigate the vulnerability with a patch

Answer

Transfer the risk via a managed security service

Question 11

An organization uses a quantitative risk analysis method. The annualized rate of occurrence (ARO) for a specific threat is 0.5, and the single loss expectancy (SLE) is $200,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as ARO × SLE = 0.5 × $200,000 = $100,000. This represents the expected annual financial loss from the threat, factoring in both the frequency of occurrence and the impact per incident.

Answer

$400,000

Answer

$100,000

Answer

$200,000

Question 12

During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?

Accepted Answer

Obtain a third-party audit report (e.g., SOC 2 Type II).. A SOC 2 Type II report provides an independent, third-party assessment of a cloud provider's controls over a period of time, directly addressing the lack of visibility by offering verifiable evidence of control effectiveness. This is the standard approach for gaining assurance over a provider's security posture without relying on internal access or self-reporting.

Answer

Request the provider to self-attest their controls.

Answer

Accept the risk based on the provider's reputation.

Answer

Conduct a penetration test on the provider's infrastructure.

Question 13

A financial institution is assessing the risk of a new real-time payment system. The risk manager calculates that the annualized loss expectancy (ALE) for a potential fraud scenario is $500,000. The cost to implement a fraud detection solution is $200,000 initially with $50,000 annual maintenance. The solution is expected to reduce the ALE by 80%. What is the net benefit of implementing the solution over three years?

Accepted Answer

$850,000. The correct answer is D because the net benefit over three years is calculated as the reduction in ALE minus the total cost of the solution. The original ALE is $500,000 per year, and an 80% reduction saves $400,000 annually. Over three years, total savings are $1,200,000. The total cost includes the initial $200,000 plus three years of maintenance at $50,000 each ($150,000), totaling $350,000. Net benefit = $1,200,000 - $350,000 = $850,000.

Answer

$1,000,000

Answer

$950,000

Answer

$800,000

Question 14

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

Accepted Answer

Conduct a threat modeling workshop with the development team.. Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Answer

Perform a vulnerability scan on the CRM server.

Answer

Run a penetration test against the CRM application.

Answer

Review the business impact analysis for the CRM.

Question 15

After a risk assessment, the risk owner decides to mitigate a high-risk finding by implementing additional access controls. What should the risk manager do NEXT?

Accepted Answer

Reassess the residual risk level after controls are implemented.. After mitigation controls are implemented, the risk manager must reassess the residual risk level to determine whether the controls have effectively reduced the risk to an acceptable level. This step ensures that the risk treatment decision is validated and that any remaining exposure is understood before updating the risk register or closing the issue.

Answer

Update the risk register with the mitigation actions taken.

Answer

Accept the residual risk on behalf of the organization.

Answer

Close the risk issue and move to the next priority.

Question 16

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

Accepted Answer

Accept the risk with compensating controls such as network segmentation.. Option D is correct because the system processes non-critical data and cannot be patched, making risk acceptance with compensating controls the most appropriate strategy. Network segmentation reduces the likelihood of exploitation by isolating the legacy system from critical assets, while the low likelihood and non-critical data make decommissioning or insurance less suitable. This aligns with CRISC best practices for legacy systems where patching is impossible and the risk is within the organization's risk appetite.

Answer

Mitigate the risk by applying vendor patches.

Answer

Avoid the risk by decommissioning the system immediately.

Answer

Transfer the risk by purchasing cyber insurance.

Question 17

During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?

Accepted Answer

Implement a web application firewall (WAF) as a compensating control.. A web application firewall (WAF) is the appropriate compensating control because it can inspect and block SQL injection payloads at the HTTP/HTTPS layer without modifying the application code. This provides immediate risk reduction while the development team works on the permanent fix, aligning with the principle of defense-in-depth and the risk manager's responsibility to treat unacceptable risk during the remediation window.

Answer

Accept the risk due to the low likelihood of exploitation.

Answer

Document the risk and defer action to the next assessment.

Answer

Request an immediate emergency patch deployment.

Question 18

A risk manager is evaluating the risk associated with a new third-party vendor that will have access to customer data. The vendor has been in business for 10 years and holds ISO 27001 certification. Which factor should be given the MOST weight when determining the vendor's risk level?

Accepted Answer

The sensitivity and volume of data the vendor will access.. The sensitivity and volume of data directly determine the potential impact of a breach, which is a core component of inherent risk. Even with strong controls like ISO 27001, the risk level is primarily driven by the value and quantity of the asset at risk (customer data). In IT risk assessment, the asset's criticality and exposure outweigh historical or certification-based indicators when calculating residual risk.

Answer

The vendor's years in operation.

Answer

The vendor's ISO 27001 certification.

Answer

The contractual terms for data protection.

Question 19

Which TWO of the following are valid techniques for identifying risk in IT risk assessment?

Accepted Answer

SWOT analysis. SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) is a structured technique used to identify both internal and external risk factors during IT risk assessment. It helps uncover threats that could exploit weaknesses, as well as opportunities that might mitigate risks, making it a valid identification method.

Answer

Residual risk assessment

Answer

Risk aggregation

Answer

Monte Carlo simulation

Question 20

Which THREE of the following are key components of a risk assessment report?

Accepted Answer

Risk register with identified risks. A risk register is a core component of a risk assessment report because it formally documents each identified risk, its owner, status, and tracking information. This register serves as the authoritative record that links risk identification to subsequent analysis and response activities, ensuring traceability throughout the risk management lifecycle.

Answer

Copies of vendor contracts

Answer

Network topology diagram