CRISC Practice Questions

Question 1

During a risk assessment for a critical financial application, the IT risk manager identifies a vulnerability in the application's authentication module. The exploit would require authenticated access. Which risk rating is most appropriate if the vulnerability has a CVSS base score of 9.0, but the application is behind a strong firewall and requires two-factor authentication?

Accepted Answer

Medium, after considering the compensating controls. The CVSS base score of 9.0 reflects the intrinsic severity of the vulnerability, but the final risk rating must incorporate compensating controls. The strong firewall and two-factor authentication (2FA) significantly reduce the likelihood of exploitation, as the attacker would need to bypass both network-level filtering and an additional authentication factor. In CRISC methodology, risk is a function of likelihood and impact; here, the controls lower the likelihood, resulting in a Medium residual risk rating despite the high base score.

Answer

Low, because the application requires authenticated access

Answer

High, because CVSS base score is 9.0

Answer

Very high, due to the criticality of the application

Question 2

When integrating IT risk into the enterprise risk management (ERM) program, what is the PRIMARY benefit?

Accepted Answer

Better alignment of IT risk with business objectives. Integrating IT risk into ERM ensures that IT risk decisions are directly linked to business strategy and objectives, enabling leadership to prioritize risks that could impact critical business outcomes. This alignment is the primary benefit because it transforms IT risk from a technical concern into a strategic business driver, facilitating better resource allocation and governance.

Answer

Improved compliance with IT standards

Answer

Reduced IT operational costs

Answer

Increased frequency of risk assessments

Question 3

During a third-party risk assessment, a vendor is classified as 'critical' due to its access to sensitive customer data. According to the organization's vendor risk appetite, what is the minimum security requirement for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor because it provides an independent audit of controls over security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6–12 months). This aligns with the organization's risk appetite for sensitive customer data, as it offers more assurance than a point-in-time assessment or self-report.

Answer

Annual compliance attestation

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 4

A risk register is being updated after a quarterly risk assessment. One risk has decreased in likelihood due to new controls. However, the risk score remains unchanged because the impact increased. What should the risk practitioner do?

Accepted Answer

Recalculate the risk score using the new likelihood and impact values. The risk score is a function of both likelihood and impact. Even though new controls reduced likelihood, the increased impact means the overall risk level may remain unchanged. The correct action is to recalculate the risk score using the updated values to reflect the current risk posture accurately, as required by the risk assessment process.

Answer

Remove the risk from the register because it is under control

Answer

Automatically accept the risk because likelihood decreased

Answer

Escalate to senior management for a new risk treatment plan

Question 5

Which risk identification technique relies on analyzing past incidents to predict future risks?

Accepted Answer

Loss event data analysis. Loss event data analysis (B) is the correct risk identification technique because it systematically examines historical incident records, such as security logs, breach reports, and audit findings, to identify patterns and trends that can predict future risks. This empirical approach leverages past loss events to quantify likelihood and impact, making it distinct from generative or qualitative methods.

Answer

Brainstorming

Answer

SWOT analysis

Answer

Delphi technique

Question 6

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 7

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Accepted Answer

Implement compensating controls. When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 8

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

Accepted Answer

Deploy an automated monitoring tool that ingests audit logs from the CRM and cloud infrastructure APIs to trigger alerts on anomalies.. It establishes a continuous, automated monitoring feedback loop by ingesting audit logs from both the CRM application (e.g., user activity logs) and cloud infrastructure APIs (e.g., AWS CloudTrail, Azure Monitor). This approach enables real-time anomaly detection and alerting, which is essential for maintaining control effectiveness across the entire stack without manual intervention.

Answer

Implement a generic Security Information and Event Management (SIEM) system with standard rules.

Answer

Rely on the CRM vendor's SOC 2 Type II report for control assurance.

Answer

Schedule quarterly manual reviews of user access logs and system configurations.

Question 9

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Accepted Answer

Escalate to senior management. When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Answer

Update the risk register

Answer

Implement additional controls

Answer

Reduce the risk appetite

Question 10

Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?

Accepted Answer

Investigate Wednesday and Thursday spikes as they are above the Green threshold.. Wednesday (12) and Thursday (15) are in the Amber zone (10-20), indicating a need for investigation. Option A is premature because the threshold for Red (>20) was not breached. Option B ignores the amber days. Option D suggests adjusting the threshold without understanding the cause of the spikes.

Answer

Adjust the KRI threshold to 15 per day to reduce false positives.

Answer

Continue monitoring as all days are within Green or Amber.

Answer

Escalate to the risk committee because the threshold was breached.

Question 11

A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?

Accepted Answer

Account lockout policy is not enforced. The repeated login failures followed by a successful authentication indicate that the account lockout policy was not enforced. Without a lockout threshold, an attacker can perform unlimited password attempts until they guess the correct credential. This is a direct failure of the account lockout control, which is designed to prevent brute-force attacks by disabling the account after a defined number of failed attempts (e.g., 5 failures within 15 minutes per NIST SP 800-63B).

Answer

No multi-factor authentication

Answer

Insufficient failed login monitoring

Answer

Weak password policy

Question 12

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Accepted Answer

Transfer. Purchasing insurance transfers the financial risk to the insurer. Options B, C, and D do not describe transfer via insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 13

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 14

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 15

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Accepted Answer

A service account is authenticating with a password rather than a certificate. Service accounts should authenticate using non-replayable methods like certificates or managed service accounts (gMSA) rather than static passwords. A password-based authentication for a privileged service account, especially after a series of failed logins, indicates a high risk of credential compromise and lateral movement, making this the most significant finding from a risk monitoring perspective.

Answer

The service account has excessive database privileges

Answer

The failed login events were not logged in real time

Answer

Failed logins indicate a possible brute force attack

Certified in Risk and Information Systems Control CRISC practice test

Three ways to study

Study CRISC by domain

Study CRISC by topic

IT Risk Identification practice questions

IT Risk Assessment practice questions

Risk Response and Reporting practice questions

Information Technology and Security practice questions

Risk Response and Mitigation practice questions

CRISC fundamentals practice questions

CRISC scenario practice questions

CRISC troubleshooting practice questions

Top CRISC questions

Certified in Risk and Information Systems Control CRISC practice questions

How to use these CRISC questions

Quick answer