CRISC Timed Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. An organization has identified vulnerabilities on a critical server. The risk owner has limited resources and can remediate only one finding this quarter. Based on the information provided, which approach is the most appropriate risk assessment decision?

Accepted Answer

Remediate the SSL/TLS certificate vulnerability first, as it affects a critical service and has a higher severity.. Option B is correct because the SSL/TLS certificate vulnerability affects a critical service (likely HTTPS) and has a higher severity rating, making it the most urgent risk to address given limited resources. Risk assessment prioritizes remediating vulnerabilities that pose the greatest threat to critical business functions, even if another finding is easier to fix. The risk owner should allocate the single remediation slot to the highest-severity vulnerability on a critical server to maximize risk reduction.

Answer

Remediate both findings by reallocating budget from another project.

Answer

Remediate the SSH vulnerability first because it is easier to fix (upgrade OpenSSH).

Answer

Accept both risks because they are low and medium severity, and resources are limited.

Question 2

Match each key risk indicator (KRI) to its description.

Question 3

Match each compliance framework to its primary focus.

Question 4

Match each control type to its example.

Question 5

Match each CRISC domain to its description.

Question 6

Match each risk management term to its definition.

Question 7

Match each risk assessment method to its characteristic.

Question 8

Match each risk analysis formula to its component.

Question 9

Match each risk management process step to its activity.

Question 10

You are the risk manager for a healthcare organization that uses an electronic health records (EHR) system. The system has a built-in audit log that records all access to patient data. Recently, the Chief Information Security Officer (CISO) raised a concern that there have been multiple reports of unauthorized access to patient records, but the audit log analysis has not identified any suspicious activity. You have been asked to investigate. Your review of the audit log configuration reveals that the system only logs successful access events, not failed access attempts. Additionally, the log retention period is set to 30 days, and the logs are stored in a flat file on the same server as the EHR application. The monitoring team manually reviews the logs at the end of each month. Which of the following is the MOST significant risk associated with the current monitoring approach?

Accepted Answer

Storing logs on the same server as the EHR application exposes them to alteration or deletion if the server is compromised.. Storing audit logs on the same server as the EHR application violates the principle of log segregation. If the server is compromised, an attacker can alter or delete the logs to cover their tracks, making detection impossible. This is the most significant risk because it directly undermines the integrity and availability of the evidence needed to investigate unauthorized access.

Answer

The 30-day log retention period is too short to detect long-term patterns of unauthorized access.

Answer

Manual review of logs is ineffective and may miss critical events; automated monitoring should be implemented.

Answer

The audit log does not capture failed access attempts, which could indicate brute-force attacks or unauthorized access attempts.

CRISC Timed Practice Test 5 — 10 Questions

Exhibit

CRISC Timed Practice Test 5 — 10 Questions

Exhibit