Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 76–150

Why this answer

How to eliminate wrong answers

Option A is wrong because qualitative risk assessment uses subjective ratings (e.g., high, medium, low) rather than monetary values and does not calculate expected loss numerically. Option B is wrong because semi-quantitative risk assessment uses ordinal scales or weighted scores to approximate risk levels, but it does not assign precise monetary values or compute expected loss with formulas like SLE and ALE. Option C is wrong because 'comprehensive' is not a recognized category of risk assessment methodology in the CRISC framework; it describes scope, not the quantitative vs. qualitative distinction.

Why this answer

How to eliminate wrong answers

Option A is wrong because removing a control without a compensating alternative increases residual risk to an unacceptable level; the issue is frequency, not the control's existence. Option B is wrong because waiting for a control failure before increasing frequency is reactive and violates the proactive monitoring mandate of CRISC; a high-velocity risk demands preventive adjustment. Option C is wrong because regulatory compliance is a minimum baseline, not a risk-optimized strategy; annual testing is insufficient when the risk can change in weeks.

Why this answer

How to eliminate wrong answers

Option A is wrong because a penetration test report, while useful for identifying technical vulnerabilities, is a point-in-time assessment that does not cover the full breadth of operational, privacy, and compliance controls needed for a payroll processor handling sensitive personal data. Option B is wrong because online user reviews and ratings are anecdotal, lack technical depth, and are not a reliable or auditable source for identifying specific control weaknesses or compliance gaps. Option C is wrong because marketing materials and case studies are promotional content designed to highlight successes, not to disclose risks, control failures, or security incidents.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because while a critical severity vulnerability is serious, the severity itself is not the most concerning aspect of risk monitoring; the lack of monitoring and remediation over three months is a greater indicator of process failure. Option C is wrong because the three-month gap between scans, though suboptimal, is not as alarming as the complete absence of monitoring or remediation activity after detection; scanning frequency is a secondary concern when no action is taken on findings. Option D is wrong because risk acceptance by the system owner is a legitimate risk response option when properly documented and approved; the exhibit does not indicate that the acceptance was invalid or that compensating controls were absent, so it is not inherently the most concerning monitoring issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing RCSA frequency to quarterly still relies on periodic, point-in-time assessments, which cannot capture real-time control failures between reviews. Option B is wrong because manual monthly checks introduce human error, inconsistency, and delay, and are insufficient for high-risk controls that require near-instantaneous detection of ineffectiveness. Option C is wrong because implementing compensating controls reduces residual risk but does not enhance monitoring of the original controls; it is a risk treatment action, not a monitoring enhancement.

Why this answer

How to eliminate wrong answers

Option A is wrong because the alert only shows a connection attempt to port 1433, not any evidence of data transfer or exfiltration; exfiltration would require additional indicators like large outbound data flows or SQL query patterns. Option B is wrong because the alert does not show lateral movement, propagation behavior, or malware signatures; a single inbound connection to a database port is not indicative of a spreading infection. Option C is wrong because a DDoS attack would involve a high volume of traffic from multiple sources overwhelming bandwidth or services, not a single SYN packet to a specific database port.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because implementing a compensating control would be a risk mitigation action, not a response to a risk acceptance decision; the risk owner has already chosen to accept the risk, so adding controls contradicts that decision unless the risk manager renegotiates. Option C is wrong because the risk manager does not have the authority to override the risk owner's decision; the risk owner is accountable for the risk, and the risk manager's role is advisory and documentation-focused. Option D is wrong because immediate board reporting is not required for a single accepted risk with a documented rationale; escalation to the board is reserved for risks exceeding the organization's risk appetite or for material changes in risk profile, not routine acceptance decisions.

Why this answer

How to eliminate wrong answers

Option A is wrong because implementing additional automated controls without evidence of control failure is an overreaction that wastes resources; the existing compensating control is 100% effective, so the residual risk is already managed. Option B is wrong because escalation to the board and risk acceptance are premature—the breach is temporary and the compensating control mitigates the risk, so the issue does not meet the threshold for board-level acceptance. Option D is wrong because lowering the KRI threshold to 3% would mask the underlying risk trend and violate the principle of maintaining consistent, objective risk indicators; thresholds should be adjusted only after a formal risk assessment, not to accommodate seasonal variations without analysis.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because enhancing incident response procedures to notify customers within 24 hours addresses notification timing after detection, not the root cause of the detection failure—the baseline was corrupted and the monitoring scripts did not detect the misconfiguration. Option C is wrong because increasing the frequency of monitoring scripts to every 30 minutes does not solve the problem; the scripts were already running hourly but failed to detect the change because the baseline had been incorrectly updated, so more frequent checks against a corrupted baseline would still miss the misconfiguration. Option D is wrong because requiring manual review of all configuration changes by a second analyst adds a human check but does not address the automated baseline update process that allowed the misconfiguration to be included without detection; the reversal was not documented, so manual review would not catch the baseline corruption unless the reviewer specifically compares against an immutable approved state.

Why this answer

How to eliminate wrong answers

Option A is wrong because risk scenarios are not designed to calculate exact financial loss; they are qualitative or semi-quantitative constructs that estimate potential impact ranges, not precise monetary values. Option C is wrong because while risk scenarios may support compliance efforts, satisfying regulatory requirements is a secondary benefit, not the primary purpose of scenario development. Option D is wrong because creating a business continuity plan is a separate process that may use risk scenarios as input, but the primary purpose of scenarios is to identify and analyze risks, not to produce continuity plans.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because management approval only indicates that the control design is authorized, not that it is actually working in production. Option C is wrong because cost is a factor in control selection and efficiency, not a measure of whether the control operates effectively. Option D is wrong because documentation in policy only proves the control exists on paper, not that it is executed correctly or consistently.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because control self-assessment is a subjective evaluation of existing controls by internal staff, which is not designed to identify new risks arising from a technology migration like cloud adoption. Option C is wrong because SWOT analysis is a high-level strategic planning tool that assesses strengths, weaknesses, opportunities, and threats at an organizational level, not a technical risk identification method for specific application migration scenarios. Option D is wrong because business impact analysis (BIA) focuses on quantifying the impact of disruptions to critical business functions, not on identifying technical threats or vulnerabilities in a new cloud environment.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because employee suggestions are subjective, anecdotal, and lack the systematic, evidence-based threat data needed for a formal risk assessment; they may reflect personal biases or limited visibility into cloud-specific attack patterns. Option B is wrong because internal audit findings focus on compliance gaps and control deficiencies within the organization's existing environment, not on emerging or external threats specific to cloud service models (IaaS, PaaS, SaaS) like side-channel attacks or provider-side vulnerabilities. Option C is wrong because vendor marketing materials are promotional and designed to highlight product strengths, not to disclose realistic threat scenarios; they often downplay risks such as multi-tenancy isolation failures or shared responsibility model ambiguities.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing monitoring frequency typically increases operational costs (e.g., more log storage, processing, and analysis), not lowers them. Option C is wrong because more frequent monitoring adds overhead to the system (e.g., additional log writes and queries), which can degrade performance rather than increase it. Option D is wrong because increasing monitoring frequency does not inherently reduce false positives; in fact, it may increase them due to more data points and potential noise, unless additional tuning is applied.

Why this answer

How to eliminate wrong answers

Option A is wrong because implementing a new authentication system with biometrics is a long-term control improvement that does not address the immediate monitoring failure; it also introduces new costs and complexity without fixing the SIEM threshold issue. Option C is wrong because enabling all SIEM rules to capture every event would generate excessive noise, overwhelming analysts with false positives and potentially causing alert fatigue, which degrades monitoring effectiveness. Option D is wrong because reviewing logs manually each day is reactive, inefficient, and does not scale; it fails to provide real-time alerting and relies on human attention, which is error-prone and unsustainable for detecting a surge in failed logins.

Why this answer

How to eliminate wrong answers

Option A is wrong because qualitative assessments do not provide precise monetary values; they use ordinal scales (e.g., high/medium/low) rather than dollar amounts, which is the defining characteristic of quantitative analysis. Option C is wrong because while qualitative matrices can facilitate comparison, the primary benefit over quantitative is not ease of comparison—quantitative methods actually allow more objective cross-unit comparisons via normalized financial metrics. Option D is wrong because qualitative approaches still heavily rely on expert judgment; they do not eliminate it, and in fact, they depend on subjective input from stakeholders and SMEs.

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because escalating to the board is premature without first understanding the root cause; the board should only be informed of material risks after analysis confirms a significant threat. Option B is wrong because accepting the control owner's assessment without investigation ignores the principle that a KRI trend, even within appetite, may indicate a control weakness or emerging risk that requires validation. Option D is wrong because increasing monitoring frequency addresses symptom detection but does not resolve the underlying cause of the upward trend; root cause analysis must precede any change in monitoring cadence.

Why this answer

How to eliminate wrong answers

Option B is wrong because escalating to the risk committee for immediate action bypasses the initial investigation step; the committee should only be involved after the analyst understands the cause and determines that the risk is significant enough to warrant escalation. Option C is wrong because updating the risk register to reflect a control deficiency should occur only after confirming the deficiency is valid and understanding its root cause; premature updates may introduce inaccuracies. Option D is wrong because recommending removal of a control based solely on non-performance ignores the possibility that the control is still necessary and that the issue is with execution, not the control design.

Why this answer

How to eliminate wrong answers

Option A is wrong because risk transfer involves shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing to a managed security provider), not deploying a technical control like a WAF. Option C is wrong because risk avoidance would require ceasing the activity that introduces the risk (e.g., taking the web application offline or removing the vulnerable feature entirely), not implementing a control to allow continued operation. Option D is wrong because risk acceptance means formally acknowledging the risk and taking no action to reduce it, whereas deploying a WAF is an active countermeasure that reduces the risk level.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because percentage of controls tested and employee training completion rates are operational or compliance process metrics, not risk indicators that reflect the organization's specific risk appetite for revenue and regulatory compliance. Option C is wrong because vendor risk ratings and number of security incidents are tactical, third-party and security event metrics that do not directly map to the dual risk appetite focus on revenue generation and regulatory compliance. Option D is wrong because number of open remediation items and budget variance for risk projects are project management and remediation tracking metrics, not strategic risk indicators that inform the executive team about alignment with risk appetite.

Why this answer

How to eliminate wrong answers

Option A is wrong because transferring risk via student consent forms does not eliminate the FERPA violation; FERPA prohibits disclosure of personally identifiable information (PII) like email addresses without prior written consent, and requiring consent for a default exposure shifts liability but still violates regulatory compliance if consent is not obtained for all students. Option B is wrong because avoiding the risk by selecting a different LMS vendor would likely delay the launch beyond two weeks, contradicting the university's timeline and moderate risk appetite, and may introduce other unassessed risks. Option D is wrong because accepting the risk ignores that email addresses are considered PII under FERPA, and the exposure could lead to privacy violations and regulatory penalties, which is inconsistent with a moderate risk appetite that seeks to mitigate rather than tolerate such compliance risks.

Why this answer

How to eliminate wrong answers

Option A is wrong because approving the threshold increase without investigation ignores the fact that the 2% threshold was set based on risk appetite; raising it to 3% could allow an unacceptable level of failed transactions to go unmonitored, potentially leading to customer dissatisfaction and financial loss. Option B is wrong because suggesting automated remediation assumes the network issues are fully understood and can be programmatically resolved, but without root cause analysis, automation might address symptoms rather than the underlying cause, and could introduce new risks if misconfigured. Option D is wrong because requiring investigation of every breach without considering the pattern of transient, self-resolving issues is inefficient and could lead to alert fatigue, but it does not address the need to understand why the network issues recur.

Why this answer

How to eliminate wrong answers

Option B is wrong because specific control test results for each system are too granular for the board; they are more appropriate for operational management and internal audit reporting. Option C is wrong because vendor risk assessment scores for all third parties are tactical details that should be summarized into aggregate risk exposure or trends for board-level reporting. Option D is wrong because detailed weekly operational incidents are operational metrics, not strategic risk information, and would overwhelm the board with noise rather than actionable insight.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because avoiding discussion of risk appetite prevents senior management from understanding the organization's risk tolerance, which is essential for aligning risk responses with business objectives. Option C is wrong because presenting detailed technical analysis for every risk overwhelms senior management, who require summarized, high-level information rather than granular technical details. Option E is wrong because including all available risk data for transparency leads to information overload, obscuring key risk areas and exceptions that require attention.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because mitigating with controls reduces risk to an acceptable level but does not eliminate it; residual risk remains, which contradicts a fully risk-averse stance. Option C is wrong because accepting risk means the organization retains the full exposure, which is contrary to a risk-averse appetite that seeks to avoid any potential loss. Option D is wrong because transferring risk through insurance shifts financial liability but does not remove the operational threat; the organization still faces the event's consequences, such as downtime or reputational damage, which a risk-averse entity would find unacceptable.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it describes inherent risk, which is the risk level before any controls are implemented, not after. Option C is wrong because it describes risk transfer (e.g., via insurance or outsourcing), which is a risk response strategy, not the remaining risk after controls. Option D is wrong because it describes risk acceptance, which is a decision to tolerate the residual risk without further action, not the residual risk itself.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because accepting a critical-tier vendor based solely on a self-reported questionnaire, even with strong controls, lacks independent verification and audit rigor, which is a key requirement for high-risk data access. Option C is wrong because proceeding with the contract and increasing monitoring frequency does not address the lack of foundational, audited controls; monitoring is a detective control, not a preventive one, and is insufficient for a critical vendor. Option D is wrong because lowering the vendor's tier to avoid a requirement is a form of risk avoidance that circumvents proper risk management and policy, and it does not actually reduce the inherent risk of the vendor's access to sensitive data.

Why this answer

How to eliminate wrong answers

Option A is wrong because accepting the risk is only appropriate when the impact and likelihood are low or when the cost of mitigation exceeds the potential loss; here, a critical remote code execution vulnerability with active exploits in the wild cannot be accepted without justification. Option B is wrong because transferring the risk (e.g., via cyber insurance) does not eliminate the underlying technical vulnerability; the attacker can still exploit the unpatched service, and insurance does not prevent the breach. Option C is wrong because avoiding by disabling the service would eliminate the functionality that the business relies on, which is a disproportionate response unless the service is non-essential; patching or compensating controls (e.g., WAF rules) are the standard, less disruptive approach.

Why this answer

How to eliminate wrong answers

Option A is wrong because conducting a penetration test on the firewall is an intrusive and resource-intensive step that should only be performed after verifying that no recent changes have been made; it could also disrupt operations if the misconfiguration is severe. Option B is wrong because immediately blocking the IP range is a reactive measure that may disrupt legitimate traffic and does not address the root cause of the suspected misconfiguration; it should only be considered after confirming the issue through change records. Option D is wrong because updating the risk register with a new risk is premature without first understanding the cause of the dropped packets; the risk register should be updated only after the misconfiguration is confirmed and its impact assessed.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because vendor lock-in due to proprietary APIs is a strategic risk, not the most critical when PII and regulatory compliance are at stake; it can be mitigated through standard API abstraction or multi-cloud strategies. Option B is wrong because shared responsibility model gaps are important but typically address security controls (e.g., encryption, access management) rather than the fundamental legal obligation to store data within specific geographic boundaries. Option D is wrong because multi-tenancy isolation risks are a security concern but are secondary to the primary risk of violating data residency laws, which can lead to immediate regulatory penalties.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because SQL injection is an application-layer attack exploiting unsanitized input, not a database concurrency error. Option C is wrong because unauthorized access involves authentication or authorization failures, not transaction-level conflicts. Option D is wrong because insufficient disk space would cause transaction failures or write errors, not the concurrency-specific error shown in the exhibit.

Why this answer

How to eliminate wrong answers

Option A is wrong because the risk register shows encryption (AES-256) is already implemented, so adding further encryption controls would provide negligible risk reduction and is not cost-effective. Option B is wrong because transferring the risk to a third-party insurer is typically reserved for high-impact, low-frequency risks (e.g., data breach liability), not for a low-impact, low-likelihood risk already within appetite. Option C is wrong because discontinuing storage of PII would avoid the risk entirely but is a drastic measure that would disrupt business operations and is disproportionate to the low severity of R-0042.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because while model bias is a significant ethical and regulatory concern, it is often a subset of the broader explainability issue; regulators primarily mandate that decisions be explainable to detect and mitigate bias. Option B is wrong because data privacy during model training is important but is typically addressed by data protection impact assessments and anonymization techniques, not the core compliance requirement for automated decision systems. Option C is wrong because adversarial attacks are a security risk that can affect model integrity, but they are not directly tied to regulatory compliance requirements for transparency and accountability in automated credit scoring.

Why this answer

How to eliminate wrong answers

Option A is wrong because industry benchmark risk assessments from similar organizations are historical and aggregated, lacking the specificity to identify novel threats targeting a new mobile payment application with end-to-end encryption; they may also be outdated by the time of use. Option C is wrong because previous internal audit reports on legacy applications focus on past vulnerabilities and controls for older systems, which do not reflect the unique attack surface of a new mobile payment app using modern encryption protocols like TLS 1.3 or E2EE. Option D is wrong because vendor-provided security white papers for the encryption product are promotional and biased, often omitting real-world threat scenarios or zero-day vulnerabilities that could affect the application's specific implementation.

Why this answer

How to eliminate wrong answers

Option A is wrong because transferring the risk (e.g., via cyber insurance) does not reduce the immediate technical exposure; the vulnerability remains exploitable on the device. Option B is wrong because accepting the risk would leave the critical network infrastructure open to active exploitation, which is unacceptable given the severity and known exploit. Option D is wrong because ignoring the risk is not a valid risk response in CRISC; it represents negligence and violates the principle of due care, especially when a technical control can be rapidly applied.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling the correlation rule entirely removes detection of SSH brute-force attacks, creating a blind spot that attackers could exploit. Option B is wrong because increasing the threshold may reduce false positives but could also cause the rule to miss genuine low-and-slow brute-force attacks, and it does not address the root cause of legitimate monitoring traffic. Option C is wrong because investigating the monitoring servers for compromise is unnecessary and wastes resources, as the traffic is expected from internal monitoring tools, not indicative of an actual compromise.

Why this answer

How to eliminate wrong answers

Option A is wrong because CVE-2022-9876 on the file server is a medium-severity directory traversal vulnerability (CVSS 6.5) that requires authenticated access, limiting its exploitability and impact compared to a remote code execution on a critical asset. Option B is wrong because CVE-2023-5678 on the web server is a cross-site scripting (XSS) vulnerability (CVSS 6.1) that only affects client-side users and does not grant server-level access, making it less impactful than a critical server compromise. Option D is wrong because risk is not equal across vulnerabilities; it must be assessed based on asset criticality, threat likelihood, and vulnerability severity, which differ significantly among the options.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the control test methodology is not inherently flawed; the test correctly identified unauthorized access attempts, so the issue lies with the control's effectiveness, not the testing approach. Option B is wrong because while the control may be detective in nature, the remediation of adding logging is still inappropriate—it fails to address the preventive weakness that allowed unauthorized access, and detective controls should complement, not replace, preventive measures. Option C is wrong because although additional logging will help detect future attempts, detection without prevention does not remediate the underlying vulnerability; the goal should be to stop unauthorized access, not just log it.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because applying the patch immediately without consultation bypasses the risk owner's authority and could introduce unintended side effects, such as breaking WAF rules or causing service disruption, without a proper risk assessment. Option C is wrong because accepting the risk when the impact is unknown violates the principle of informed risk acceptance; the risk manager must first gather information or escalate to someone with the authority to accept or reject the risk. Option D is wrong because waiting for the risk owner to return could leave a critical vulnerability unaddressed for an extended period, increasing the likelihood of exploitation and violating incident response timelines.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because contacting the destination IP owner to verify credentials is a slow, manual process that does not address the immediate security risk; the logs show repeated failures, not a single credential issue, and the source IP may be malicious. Option C is wrong because updating the VPN policy to allow all authentication methods would weaken security by permitting weaker or unauthenticated methods, potentially enabling successful attacks. Option D is wrong because ignoring the logs as routine failed attempts overlooks the pattern of repeated failures, which could indicate an active brute-force attack or reconnaissance, violating monitoring and response best practices.

Why this answer

Why this answer