Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 151–225

Hard-coded secrets in images or manifests are easily exposed through image layers, source repositories, or runtime environment variables. In a banking context, exposed API keys could allow attackers to bypass authentication and access customer data. This risk is both highly likely and high impact, and it can be mitigated through secret management tools, image scanning, and secure coding practices, warranting priority in the risk register.

Adding an exception for the internal monitoring server IPs suppresses the noisy false positives at source, so the rule still detects genuine brute-force attempts elsewhere. This is more precise than disabling or lowering the rule's severity, preserving detection coverage.

Cyber policies typically exclude physical perils such as power outages without a malicious element, since these are property or business-interruption losses rather than cyber incidents. This exclusion satisfies the stem's requirement by removing non-malicious, non-cyber causes of loss from cover.

This is a vulnerability because it creates an uncontrolled data repository outside the organization's visibility and protection, directly increasing the likelihood that sensitive information is exposed or lost. It reflects a weakness in data handling practices and control coverage rather than an external threat or a business impact. Documenting it as a vulnerability supports targeted controls such as data loss prevention and acceptable use enforcement.

Additional logging only records unauthorised attempts; it cannot prevent them, so the failed control remains unaddressed. Since the test detected unauthorised access, the root cause is weak access enforcement, and strengthening access controls directly satisfies that constraint. Logging supports detection and investigation, not prevention, making it an inappropriate primary remediation here.

A parent-child structure clusters risks that stem from the same root cause while retaining each entry's likelihood, impact, owner, and treatment. This reduces the apparent volume of top-level entries without losing the granularity needed for treatment and monitoring. It maintains traceability and supports aggregation for reporting to the board, which is exactly what the CISO needs here.

Hacktivists pursue ideological or political ends, attacking targets to publicise a cause. Organised crime actors pursue financial gain, typically through ransomware, fraud or data theft. The axis of difference is motivation, which shapes target selection, persistence and monetisation, making this the best description.

Risk decisions require an accountable owner; the primary owner's absence must not stall remediation. Escalating to the pre-designated alternate preserves the ownership and authority chain, enabling a timely, authorised decision on the critical vulnerability rather than leaving it unaddressed.

Risk trend analysis reveals whether exposure is rising, falling or stable over successive reporting periods, satisfying the committee's need to judge direction rather than a single snapshot. Plotting inherent and residual risk across cycles exposes deteriorating controls and validates whether prior treatments worked, giving the forward-looking context a comprehensive posture view requires.

Data may be stored in countries with inadequate privacy laws.

Under the shared responsibility model the provider secures the cloud infrastructure, while the customer always owns its data. Classification and access control are therefore customer duties, governing who may reach data and how it is labelled, regardless of the deployment model chosen.

Full reconciliation matches every migrated record against the legacy source, detecting all corruption rather than extrapolating from samples. Given the tight timeline but low tolerance for data integrity issues, this response aligns with the organisation's stated risk appetite and avoids production delays from undetected errors.

This is correct because network segmentation with restrictive firewall rules prevents exploitation attempts from reaching the unpatched terminals and limits lateral movement, directly lowering the likelihood that a known vulnerability is successfully exploited. It is a preventive control that reduces exposure even when patching is not feasible on the legacy point-of-sale devices.

This is correct because consistent, well-documented rating criteria allow different business units to apply the same scales in comparable ways, and recording the evidence behind each rating gives auditors a clear rationale to review. It directly supports both comparability across units and traceability of assessment judgments for the trading platform risk register.

Acceptance is a deliberate decision, so the risk owner must record the risk in the risk register with its acceptance rationale and obtain formal sign-off. This creates an auditable trail proving the risk was knowingly accepted within the organisation's stated risk appetite, satisfying governance and accountability requirements.

Ransomware affecting health records typically triggers statutory notification and penalty exposure under health privacy regulations, and these costs can dwarf the ransom itself. Including them makes the magnitude estimate reflect legal and compliance consequences rather than only restoration effort. This directly addresses the scenario's concern about undercounting loss dimensions beyond direct recovery.

NERC CIP standards mandate controls such as electronic security perimeters, access management and incident reporting for entities operating bulk electric system assets. Their primary objective is protecting the reliability of that system, satisfying the stem's compliance requirement for the power utility.

The ISACA risk scenario structure combines a threat source, an event, an asset or resource affected, and the resulting consequence. The current entries capture only consequence, so adding the threat source, the event itself, and the affected asset completes the scenario. This makes the register entry testable and lets the practitioner assess likelihood and impact consistently across entries.

Preventive controls act before an event occurs, blocking or deterring it to lower likelihood. Detective and corrective controls address discovery or recovery after the fact, so they reduce impact rather than probability, which the stem specifically asks about.

Insurance transfers financial risk.

DAST tests a running application from the outside, sending crafted inputs and observing responses, so it detects SQL injection through runtime behaviour. It satisfies the scenario by identifying the exploitable injection flaw in the deployed web application, matching the OWASP Top 10 entry.

Tuning rules and thresholds addresses the root cause: overly broad signatures or tight baselines generate noise. This restores signal quality so genuine anomalies surface, preserving the continuous monitoring objective rather than disabling alerts or ignoring findings.

Cyber insurance policies commonly exclude loss from acts of war, since such catastrophic, state-driven events are deemed uninsurable. A risk manager must recognise this exclusion because it leaves the organisation retaining that risk, requiring separate treatment within the risk register rather than assuming cover.

Confidential computing isolates the payment workload inside a hardware-backed trusted execution environment so that memory contents remain encrypted and inaccessible to the hypervisor, host OS, or cloud operator even while the application actively processes them. This directly satisfies the requirement to protect cardholder data in use, which transport and at-rest encryption cannot achieve.

Further mitigation brings risk within appetite.

Data flow diagrams map exactly where sensitive data resides, moves and is processed across on-premises and cloud boundaries, while jurisdiction-specific legal requirements define the compliance obligations. Together they expose residency and regulatory risks that generic checklists miss.

War and state-sponsored attack exclusions remove cover for precisely the severe, costly incidents many organisations most need to transfer. Reviewing these exclusions satisfies the evaluation criterion of identifying retained risk, because excluded events remain the organisation's financial responsibility.

A centralised GRC platform with automated feeds removes the manual spreadsheet consolidation that causes errors and delay, directly addressing the fragmented, non-integrated systems named in the stem. Automated data ingestion gives continuous, consistent risk monitoring and reporting across the multinational estate, which point fixes to individual systems cannot achieve.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of the provider's controls over a period of time. This gives the risk practitioner evidence that controls are not only designed appropriately but have been tested and operated effectively, which directly supports risk assessment and monitoring of the outsourced service.

An ARO of 0.2 satisfies the stem's quantitative relationship, since ALE equals SLE multiplied by ARO. Dividing $500,000 by $2,500,000 yields 0.2, meaning the loss event is expected once every five years. This directly reconciles the given single loss expectancy with the stated annual loss expectancy.

EPSS estimates the probability that a vulnerability will be exploited in the wild within 30 days, and combining it with asset criticality aligns remediation with actual business risk. CVSS base score alone reflects intrinsic severity, not likelihood of exploitation or business impact. This enhancement directly supports risk-based prioritization, which is a core CRISC objective.

Expressing impact as financial loss, regulatory penalty and operational disruption links the technical scenario to business consequences using the standard impact categories, satisfying the stem's requirement to connect technical risk to business impact. This translation lets leadership compare and prioritise risks using consistent, decision-ready terms.

Inherent risk is the raw risk exposure before controls are considered. For the SQL injection vulnerability, this means the potential impact and likelihood assuming no compensating controls exist. This baseline helps the risk practitioner prioritize and later measure the effectiveness of controls. The scenario specifically asks for inherent risk, making this the correct characterization.

Automatic escalation to a secondary response team when an alert goes unacknowledged within a defined window ensures coverage during concurrent incidents. This satisfies the need to close monitoring gaps caused by the primary team being occupied elsewhere.

Tactical reporting translates risk data into prioritised mitigation actions for senior security leadership, supporting near-term resource allocation decisions. Strategic reporting addresses long-term risk appetite, while operational reporting handles day-to-day execution, so tactical reporting uniquely equips the CISO to sequence mitigation priorities.

Before deciding on a risk response, the risk practitioner must first assess the risk. The missing right-to-audit clause could limit the company's ability to verify the provider's security controls, potentially increasing risk. A formal risk assessment will quantify the impact and likelihood, enabling an informed decision that aligns with the company's low risk appetite.

Boards govern rather than operate, so they need aggregated top risks, directional trends and control performance metrics to judge whether risk appetite is being met. Operational detail and raw incident logs obscure this strategic view, failing the stem's board-reporting purpose.

Continuous vulnerability scanning qualifies because it runs on an automated, recurring schedule rather than at a single point in time, satisfying the stem's requirement for ongoing detection. Unlike periodic assessments, it feeds findings into risk registers continuously, enabling timely remediation decisions within the organisation's risk tolerance thresholds.

Data residency obligations cross legal, technology, and strategic boundaries, so the risk belongs in the enterprise register with clear linkage to the expansion objective and shared ownership. This framing lets leadership compare the cost of compliant local hosting and controls against the value of the new market, and ensures treatment decisions are made at the right level. It also supports consistent reporting to the board alongside other expansion risks.

Tampering with API parameters to circumvent transaction limits is an intentional compromise of confidentiality, integrity, or authorized use, which is the definition of security risk. Recording it as a security risk links it to threat modeling, secure code review, and authorization testing, and it aligns with how CRISC expects practitioners to separate deliberate adversarial events from accidental operational failures or compliance gaps.

Replacing the unsupported ERP would delay the merger 18 months, which executives reject, so mitigation is the viable treatment. A disaster recovery plan plus backups and manual procedures addresses the absence of recovery capability while compensating for the vendor's withdrawn support.

Liability clauses and cyber insurance shift the financial consequence of payroll errors to the vendor and insurer, while the organisation retains operational responsibility. This is risk transfer, satisfying the stem's high inherent risk mitigated through contractual and insurance mechanisms rather than avoidance or reduction.

Consequence describes the resulting impact of a risk event materialising, quantified in financial, operational or regulatory terms. It satisfies the scenario component that directly links the event to potential financial loss, unlike cause, threat source or event description.

A 15% deficiency rate against a sub-5% target signals the control is failing materially. Root-cause investigation must precede remediation, otherwise corrective actions address symptoms rather than the underlying process, configuration or ownership failure driving the gap.

Cyber insurance transfers the financial impact of a realised risk to the insurer in exchange for premiums, leaving the organisation to bear only deductibles and uncovered losses. This satisfies the stem's requirement for a valid risk transfer mechanism, since the monetary consequence, not the risk itself, is shifted.

Trend analysis over time reveals whether risk exposure is rising, falling or stable, letting senior management judge whether current mitigation spending is working. Without this longitudinal view, the report shows only a static snapshot and cannot support the forward-looking direction the board needs for risk appetite decisions.

Data classification exists to match protection to impact, so the governing factor is the harm that unauthorized disclosure, modification, or loss would cause to individuals and the institution. Health notes and financial aid records carry regulatory and reputational consequences far beyond their storage cost, and that impact analysis correctly drives the encryption, access, and retention controls.

Risk appetite is the level of risk the organisation is willing to pursue, while tolerance is the acceptable deviation from that appetite. Heavy investment in controls reflects low appetite, and accepting residual risk shows tolerance for variation within limits.

Threat analysis is the PASTA stage that enumerates threat agents, their capabilities, motivations and objectives, mapping them against the application's assets and attack surface. This directly satisfies the stem's requirement to identify threat agents and capabilities, distinguishing it from decomposition, attack modelling and risk/impact analysis stages.

Capacity reflects the outer boundary of risk the organization can absorb before objectives or solvency are threatened, while appetite is the deliberate, lower level of risk it chooses to take. Setting appetite inside capacity leaves a buffer for unexpected events and keeps strategic risk-taking sustainable. This relationship is the foundation for deriving risk tolerances and limits that the committee can monitor.

A 5×5 heat map plots likelihood against impact using ordinal ratings, so it needs no quantitative loss data or statistical modelling. This satisfies the scenario's need for a fast, low-data qualitative assessment, though it sacrifices precision.

Escalating to the risk owner triggers investigation into why downtime breached the KRI threshold twice, enabling root-cause analysis and corrective action. This satisfies the immediate-action requirement, since the owner holds authority to assess and respond to the indicator breach.

Daily reporting of users holding excessive privileges lets the team identify and revoke inappropriate access promptly, shrinking the exposure window. This satisfies the primary benefit sought: timely remediation of access violations before they can be exploited.

An effective risk assessment produces treatment decisions that are actually executed; measuring whether risk treatment plans are implemented within agreed timelines demonstrates that assessment outputs drive real remediation, rather than remaining documentation. This evidences the process's operational effectiveness.

When a risk exceeds appetite and the business unit is unwilling to mitigate, the risk practitioner must escalate to the risk committee or appropriate governance body for a formal risk acceptance decision. This ensures that the decision is made at the right level and documented. The risk practitioner does not have authority to accept risk on behalf of the organization.

The skill level and motivation of a threat actor directly influence the probability that a vulnerability will be exploited. A highly skilled and motivated attacker is more likely to identify and successfully exploit weaknesses. This factor is a core component of threat likelihood estimation in risk assessments, as it reflects the capability and intent of potential adversaries.

A heat map plots residual risk, which combines inherent risk and control effectiveness. A fall in inherent risk from external factors can outweigh the control's decline from 95% to 85%, lowering residual risk from high to medium.

Comparing premium against expected loss establishes whether transferring the risk is economically rational. This satisfies the stem's evaluation requirement by testing cost-effectiveness: if premiums approach or exceed probable losses, retention or mitigation may deliver better value than insurance.

Very low likelihood combined with very high impact does not justify the cost of avoidance, transfer or mitigation. Acceptance is appropriate because the expected loss is small, though the risk should still be monitored and a contingency plan retained.

Migrating to SSO leaves legacy authentication accounts active if deprovisioning is incomplete, creating orphan accounts that bypass SSO controls. These unmanaged credentials are the greatest risk because they evade the new centralised authentication and oversight.

Risk acceptance requires the risk owner to formally sign off, documenting accountability for the decision to tolerate the risk without added controls. This satisfies the requirement that acceptance be authorised at the appropriate level, since the risk falls within the stated risk appetite.

Impact quantifies the consequence if the risk event occurs, expressed in financial, operational or regulatory terms. It is a core component of a risk scenario, alongside the threat source and the event itself, enabling consistent comparison and prioritisation.

Operating effectiveness verifies the control performs consistently as designed over the review period, through testing evidence such as samples, logs or observations. Combined with design adequacy, it establishes whether the control genuinely mitigates the risk within the key process.

Purchasing insurance shifts the financial impact of a risk to a third party. This is a classic example of risk transfer, where the organization pays a premium to transfer the potential financial loss. The risk itself (unauthorized access) is not eliminated, but the financial consequences are shared or shifted to the insurer, which is a valid risk response under CRISC.

Encryption at rest ensures that data stored in the repository is encrypted, so if an attacker gains access, they cannot read the data without the decryption key. This directly reduces the impact of a breach because the confidentiality of the data is preserved. It does not prevent the breach itself, but it mitigates the consequences, such as intellectual property theft or regulatory penalties. This is a classic impact-reducing control.

When decommissioning a data center, ensuring that all sensitive data is securely wiped or destroyed from storage media is critical. If not properly handled, residual data could be recovered by unauthorized parties, leading to a data breach. This is a well-known risk in decommissioning projects and must be included in the risk register. It addresses confidentiality and compliance requirements.

RBAC with least privilege ensures that staff members are granted only the access necessary to perform their job functions. This limits the potential for unauthorized access and reduces the attack surface. It is a preventive control that directly addresses the risk of internal staff accessing patient data they do not need, and it is a fundamental requirement of many healthcare regulations.

Transfer shifts the financial consequences of a risk to a third party, and insurance is the classic example. By purchasing coverage, management retains the operational risk but moves the monetary impact of a breach to the insurer. This matches the decision to keep the platform while offloading financial exposure.

Unpatched critical vulnerabilities represent exposure that attackers can exploit, so the percentage measures conditions preceding a breach rather than breach incidents already suffered. That forward-looking quality makes it a leading indicator, unlike metrics such as confirmed data loss volumes.

The API gateway is the entry point to internal microservices. If authentication or authorization is weak, a partner or attacker could bypass controls and reach services they should not access, leading to data exposure or system compromise. This is a preventive control gap with direct impact on confidentiality and integrity, making it the most critical risk to address before exposing the gateway externally.

A risk-based prioritization process ensures that remediation efforts focus on vulnerabilities that pose the greatest risk to the business. By factoring in asset criticality, threat intelligence, and exploitability, the organization can allocate resources efficiently and reduce the most significant exposures first. This directly addresses the missing prioritization component and aligns vulnerability management with business risk.

Tuning correlation rules removes the broad, noisy detections generating 80% false positives, while risk-based prioritisation focuses the 12 analysts on genuine threats. This restores detection capability without additional headcount, satisfying the budget freeze constraint that rules out hiring more staff.

MDM with containerisation separates corporate data into an encrypted work container, so personal apps cannot access or exfiltrate it, while still permitting BYOD. This treats the leakage risk proportionately, matching the organisation's moderate risk appetite without banning personal devices outright.

When residual risk exceeds the risk appetite, the risk owner must escalate it to the governance body authorized to make risk acceptance or funding decisions. Presenting options, such as phased upgrade, compensating controls, or formal acceptance with mitigation, enables informed decision-making. This aligns with CRISC principles of escalation and governance for risks beyond tolerance.

Identified risks with their ratings form the core register that lets management compare exposures and prioritise responses. Without this ranked inventory, the report cannot satisfy its purpose of communicating which risks threaten objectives and where attention should be directed.