Certified in Risk and Information Systems Control CRISC CRISC Questions 976–983 | Page 14/14

976

MCQmedium

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

A.Denial of service due to excessive login attempts.

B.Unauthorized access to patient medical records.

C.Insufficient encryption of data in transit.

D.Phishing attacks targeting portal users.

AnswerB

Breach of medical records can lead to legal penalties, identity theft, and harm to patients.

Why this answer

The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.

Exam trap

The trap here is that candidates may focus on the immediate technical symptom (denial of service) rather than the primary business impact (unauthorized data access), which is the core of risk identification in CRISC.

How to eliminate wrong answers

Option A is wrong because denial of service from excessive login attempts is a temporary availability issue, not the most critical risk; brute-force attacks primarily aim to gain access, not to overwhelm the system, and rate limiting or account lockout policies can mitigate DoS. Option C is wrong because insufficient encryption of data in transit is a separate vulnerability related to data exposure during transmission (e.g., missing TLS), not directly caused by brute-force login attempts; the question focuses on the consequence of brute-force attacks, not encryption weaknesses. Option D is wrong because phishing attacks are a different attack vector involving social engineering to steal credentials, not a direct result of brute-force attempts; the scenario explicitly describes brute-force login attempts, not phishing.

Full explanation →

977

MCQhard

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

A.Risk Avoidance

B.Risk Transfer

C.Risk Mitigation

D.Risk Acceptance

AnswerA

Avoidance is the decision to stop the risky activity.

Why this answer

Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Exam trap

The trap here is that candidates often confuse risk avoidance with risk mitigation, mistakenly thinking that any proactive action (like migrating) is a form of mitigation, whereas avoidance specifically means ceasing the activity that generates the risk.

How to eliminate wrong answers

Option B is wrong because risk transfer would involve shifting the financial impact of failure to a third party (e.g., purchasing cyber insurance or outsourcing to a managed service provider), not removing the system. Option C is wrong because risk mitigation would involve implementing controls to reduce the likelihood or impact of failure (e.g., adding monitoring, applying patches, or isolating the system) while keeping it operational. Option D is wrong because risk acceptance means formally acknowledging the risk and its potential consequences without taking action, which contradicts the active decision to decommission and migrate.

Full explanation →

978

MCQeasy

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

A.Loss of confidence in the control by management.

B.Increased risk of missing actual security incidents.

C.Reduced system performance due to alert processing.

D.Increased cost of investigating alerts.

AnswerB

Alert fatigue causes real incidents to be overlooked.

Why this answer

A high false positive rate in a detective control leads to alert fatigue, where security personnel may ignore or dismiss alerts, increasing the risk that actual security incidents are missed. Option A is a consequence but not the most significant. Option C may occur but is secondary.

Option D is an operational impact but does not directly increase risk.

Full explanation →

979

Multi-Selectmedium

An organization is evaluating the business impact of a potential ransomware attack. Which TWO impact categories should be considered as direct financial losses? (Select TWO)

Select 2 answers

A.Incident response and recovery costs

B.Reputation damage and customer trust loss

C.Lost business due to downtime

D.Notification costs to affected parties

E.Regulatory fines

AnswersA, D

These are direct costs of responding to and recovering from the attack.

Why this answer

Direct financial losses include costs directly incurred from the incident, such as incident response and recovery, and notification costs. Lost business and reputation damage are indirect costs.

Full explanation →

980

MCQmedium

A control monitoring system generates an alert when transaction volumes exceed 10,000 per hour. Recently, the system has been generating false positives during peak business hours due to legitimate seasonal spikes. Which of the following is the BEST approach to reduce false positives while maintaining effective monitoring?

A.Disable the alerting during peak hours

B.Implement manual review of all alerts during peak hours

C.Apply dynamic thresholding that adjusts based on historical baseline

D.Increase the alert threshold to 15,000 transactions per hour

AnswerC

Dynamic thresholding adapts to regular patterns, reducing false positives.

Why this answer

Dynamic thresholding uses historical baselines to automatically adjust alerting thresholds in response to predictable patterns, such as seasonal spikes. This approach reduces false positives during peak hours while preserving the system's ability to detect anomalous transaction volumes that deviate from the learned baseline, ensuring effective monitoring without manual intervention.

Exam trap

The trap here is that candidates mistakenly choose a static threshold increase (Option D) thinking it solves false positives, but CRISC expects adaptive controls that align with risk-based monitoring principles, not rigid rule changes.

How to eliminate wrong answers

Option A is wrong because disabling alerting during peak hours creates a blind spot, allowing genuine security or operational incidents to go undetected during the busiest period. Option B is wrong because manual review of all alerts during peak hours is not scalable, introduces human latency, and defeats the purpose of automated monitoring; it also increases operational overhead without addressing the root cause of false positives. Option D is wrong because simply raising the threshold to 15,000 transactions per hour is a static, one-size-fits-all fix that would still generate false positives during higher seasonal spikes and could miss true anomalies that fall below the new fixed threshold.

Full explanation →

981

MCQmedium

A risk manager is using the FAIR model to quantify cyber risk. Which of the following inputs is MOST directly used to calculate probable financial loss?

A.Annualized loss expectancy (ALE)

B.Loss event frequency and loss magnitude

C.Vulnerability severity scores (CVSS)

D.Number of security incidents per year

AnswerB

These are the primary inputs to calculate probable financial loss.

Why this answer

FAIR calculates loss magnitude using loss event frequency and loss magnitude (monetary impact). The probable financial loss is derived from these factors.

Full explanation →

982

MCQhard

Refer to the exhibit. This JSON snippet defines a monitoring policy for S3 bucket access. Which of the following is a potential risk that might NOT be detected by this monitoring policy?

A.Unauthorized GET operations from within the trusted IP range.

B.Unauthorized PUT operations from within the trusted IP range.

C.Unauthorized DELETE operations from any IP.

D.Unauthorized PUT operations from outside the trusted IP range.

AnswerC

DELETE operations are not covered by the policy at all, so they would not be monitored.

Why this answer

The monitoring policy only covers PutObject and GetObject actions. DeleteObject is not included, so unauthorized DELETE operations would go undetected. Option A (GET from trusted IP) is monitored, as GetObject is covered.

Option B (PUT from trusted IP) is also monitored because PutObject is covered; if the policy denies such PUTs, that would still be detected by the monitoring. Option D (PUT from outside trusted IP) is likewise monitored. Only DELETE actions are completely outside the monitoring scope.

Full explanation →

983

MCQhard

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

A.Report the deficiency to the board for oversight

B.Increase the frequency of control testing to monthly

C.Immediately replace the control with a more robust one

D.Conduct a root cause analysis of the deficiencies

AnswerD

Understanding why the control is failing is essential before implementing corrective actions.

Why this answer

A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Full explanation →

Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 976–983