CRISC Multiple Select — 10 Questions

Question 1

Which TWO are characteristics of inherent risk?

Accepted Answer

Risk level before controls. Option C is correct because inherent risk is defined as the level of risk that exists before any controls are applied, representing the raw exposure of an asset or process to a threat. Option E is correct because inherent risk is assessed under the assumption that no controls exist, which establishes a baseline against which control effectiveness can later be measured. Together, these two characteristics distinguish inherent risk from residual risk, which is the risk remaining after controls are implemented. Option A is incorrect because basing risk on the effectiveness of current controls describes residual risk, not inherent risk. Option B is incorrect because determining the control gap is a derived analysis activity that compares inherent and residual risk, not a defining characteristic of inherent risk itself. Option D is incorrect because the risk level after controls is the definition of residual risk.

Answer

Based on the effectiveness of current controls

Answer

Used to determine control gap

Answer

Risk level after controls

Question 2

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 3

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 4

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register must capture B (Risk owner), because every identified risk needs an accountable individual responsible for monitoring and managing it throughout its lifecycle. C (Root cause) is essential because documenting the underlying source or driver of the risk enables proper analysis and effective treatment rather than just addressing symptoms. E (Risk description) is required to clearly articulate the nature of the risk, including the event, its potential consequences, and context, so it can be understood and prioritized. A (Quantified monetary impact) is not always essential at the identification stage, since qualitative or semi-quantitative assessments may suffice initially and quantification often occurs later during analysis. D (Mitigation plan) is a risk treatment output that follows assessment and is not a core identification component, as the register first needs to record the risk itself before responses are defined.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 5

A security awareness program is being designed to promote a risk-aware culture. Which TWO elements are most critical for the program's success?

Accepted Answer

Tone from the top. Option D, 'Tone from the top,' is critical because a risk-aware culture must be visibly championed by senior leadership; when executives model and reinforce risk-conscious behavior, employees perceive security as a genuine organizational priority rather than a compliance formality. Option E, 'Communicating risk in business terms,' is equally essential because awareness messages framed around business impact—such as financial loss, reputational damage, or operational disruption—resonate with staff and drive risk-informed decision-making far better than abstract technical jargon. Together, these two elements establish both the authority and the relevance needed for a sustainable security awareness program. Option A is not among the marked correct answers because a risk committee is a governance structure that supports risk management but is not itself a critical element of awareness-program success. Option B is not marked correct because mandatory pass/fail testing can create a compliance checkbox mentality rather than fostering genuine risk awareness. Option C is not marked correct because detailed technical training for all staff is unnecessary and impractical; awareness programs should target relevant behaviors, not deep technical expertise.

Answer

Establishing a risk committee

Answer

Mandatory annual testing with pass/fail

Answer

Detailed technical training for all staff

Question 6

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Accepted Answer

Segmentation of networks into zones and conduits. IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

Answer

Mandatory cloud-based backup for all control systems

Answer

Annual penetration testing by an external firm

Answer

Use of AES-256 encryption for all communications

Question 7

A risk manager is updating the risk report for the IT steering committee. Which THREE elements should be included to provide a comprehensive view of the risk posture?

Accepted Answer

Risk trend analysis. Risk trend analysis (B) is correct because tracking how risk exposure changes over time (e.g., increasing, decreasing, or stable risk levels across reporting periods) gives the steering committee insight into whether risk management efforts are effective and where emerging risks are developing. A risk heat map (C) is correct because it visually plots risks by likelihood and impact, enabling the committee to quickly identify and prioritize the highest-exposure areas across the organization's risk posture. Top risks and their status (E) is correct because summarizing the most significant risks along with their current mitigation status, owners, and progress provides the committee with actionable, decision-ready information for governance. Names of all IT employees (A) is not a risk posture element—it is personnel data with no bearing on risk likelihood, impact, or treatment. Detailed configuration of each firewall (D) is far too granular and technical for a steering-committee risk report; such operational detail belongs in technical security documentation, not executive risk reporting.

Answer

Names of all IT employees

Answer

Detailed configuration of each firewall

Question 8

Which THREE of the following are key components of an effective risk response plan?

Accepted Answer

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept). A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.

Answer

Detailed implementation timeline

Answer

Regulatory impact analysis

Question 9

Which TWO controls are most effective for reducing the risk of data leakage from endpoints in a remote work environment?

Accepted Answer

Implement Data Loss Prevention (DLP) software.. Option B, implementing Data Loss Prevention (DLP) software, is correct because DLP solutions inspect data in use, in motion, and at rest, applying content-aware policies (regex, keywords, file fingerprints) to block or quarantine sensitive data from being exfiltrated via email, USB, cloud uploads, or clipboard on remote endpoints. Option D, requiring full-disk encryption on all laptops, is correct because technologies like BitLocker, FileVault, or LUKS with TPM/PIN protect data at rest, ensuring that if a remote worker's laptop is lost or stolen, the stored data cannot be read without the decryption key, directly reducing leakage risk. Option A, phishing simulations, primarily reduces credential-theft and malware risk through user awareness, not endpoint data exfiltration. Option C, complex password policies for local accounts, hardens authentication against brute-force but does not prevent a legitimate user or malware from copying data out. Option E, a VPN, encrypts data in transit and hides traffic from local networks, but it does not stop an authorized endpoint from leaking data to unauthorized destinations.

Answer

Conduct regular phishing simulation campaigns.

Answer

Enforce complex password policies for local accounts.

Answer

Use a VPN for all remote connections.

Question 10

Which THREE of the following are key components of a risk assessment report?

Accepted Answer

Risk register with identified risks. A risk assessment report must document the identified risks in a structured format, so option A (Risk register with identified risks) is correct because the risk register is the core artifact that catalogs each risk, its owner, and its status. Option C (Recommended risk response actions) is correct because the report must translate findings into actionable treatment options such as mitigate, transfer, avoid, or accept, guiding decision-makers on next steps. Option E (Risk analysis (likelihood and impact)) is correct because quantifying or qualifying each risk by its probability and potential impact is the analytical heart of the assessment, typically expressed as a risk score (e.g., likelihood × impact). Options B (Copies of vendor contracts) and D (Network topology diagram) are supporting evidence or technical artifacts that may inform the assessment but are not key components of the risk assessment report itself.

Answer

Copies of vendor contracts

Answer

Network topology diagram