CRISC Timed Practice Test 2 — 10 Questions

Question 1

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Accepted Answer

Communicate the risk exposure to senior management. Option C is correct because the risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 2

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended. Option A is indirect. Option C does not verify effectiveness. Option D is too broad.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 3

Order the steps for implementing a risk treatment plan.

Question 4

Arrange the steps for performing a risk assessment in the correct order.

Question 5

Order the steps for incident response handling.

Question 6

Put the steps for developing an information security policy in order.

Question 7

Sequence the steps for implementing a new control based on risk assessment findings.

Question 8

Arrange the steps for performing a vulnerability assessment.

Question 9

Order the steps for change management in an IT environment.

Question 10

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

Accepted Answer

Implement flood barriers and redundant cooling systems. Implementing flood barriers and redundant cooling systems directly reduces the likelihood and impact of a flood event on the data center's physical infrastructure. This is a risk mitigation strategy that proactively addresses the root cause of the risk (flooding) by hardening the facility, which is the most effective treatment for a high-probability, high-impact physical threat.

Answer

Purchase business interruption insurance

Answer

Move all operations to a cloud provider

Answer

Accept the risk and document it in the risk register