Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 226–300

Why this answer

How to eliminate wrong answers

Option B is wrong because accepting a risk based solely on a vendor's SLA is premature without first assessing the actual impact and likelihood of the political instability affecting the data center's operations. Option C is wrong because requesting the vendor to move data to another region is a risk mitigation action that should only be considered after the risk has been documented and assessed. Option D is wrong because terminating the contract immediately is an extreme response that bypasses the necessary risk assessment and evaluation of alternative treatments.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a final deny-all rule is a standard security best practice; it ensures that any traffic not explicitly permitted is blocked, reducing the attack surface. Option B is wrong because HTTPS (TCP 443) is encrypted and, while permitting it to any destination may be overly permissive, it is far less risky than allowing unencrypted HTTP; the question asks for the MOST significant risk. Option C is wrong because restricting SSH access to the internal network is a security control that reduces exposure of administrative interfaces; this is a good practice, not a risk.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because detective controls, such as audit logs or intrusion detection systems (IDS), only identify unauthorized access after it has happened, not prevent it. Option B is wrong because corrective controls, like restoring from a backup or applying a patch, are used to remediate damage after an incident, not to block initial access. Option C is wrong because directive controls, such as security policies or acceptable use agreements, guide behavior but do not technically enforce or block access to the database.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because incompatibility with new systems is an operational or integration risk, not a security risk, and is less critical than unpatched vulnerabilities. Option C is wrong because lack of vendor support is a contributing factor to the risk, not the risk itself; the core issue is the resulting unpatched vulnerabilities. Option D is wrong because skill shortage for maintenance is a resource risk that affects the ability to manage the system, but it does not directly expose the system to exploitation like unpatched vulnerabilities do.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a denial-of-service attack on the SSH service would manifest as connection timeouts, resource exhaustion, or service unavailability, not repeated authentication failure logs. Option C is wrong because a successful privilege escalation by an insider would show evidence of a normal user account gaining elevated privileges (e.g., via sudo or kernel exploit), not repeated root login attempts. Option D is wrong because a misconfigured firewall allowing unauthorized access would result in unexpected network traffic reaching the server, but the logs specifically show authentication failures, not firewall rule violations or allowed connections from unauthorized IPs.

Why this answer

How to eliminate wrong answers

Option A is wrong because residual risk is not unchanged; it is directly affected by control effectiveness, and a failing control does not reduce the inherent risk. Option C is wrong because residual risk cannot be low when the control fails 10% of the time and the inherent risk is high; low residual risk would require a highly effective control. Option D is wrong because medium residual risk would imply a moderate reduction, but a 10% failure rate for a high inherent risk does not achieve that; the risk remains high.

Why this answer

How to eliminate wrong answers

Option A is wrong because tactical risk reporting is designed for mid-level management and focuses on specific projects or processes, not the enterprise-wide strategic posture required by the board. Option B is wrong because compliance risk reporting is narrowly scoped to regulatory and legal obligations, such as SOX or GDPR, and does not encompass the broader strategic risk landscape. Option D is wrong because operational risk reporting deals with day-to-day risks like system failures or process errors, which are too granular and short-term for board-level strategic oversight.

Why this answer

How to eliminate wrong answers

Option A is wrong because accepting the control owner's assurance without evidence violates the risk practitioner's duty to independently validate control effectiveness; a verbal fix claim does not confirm the system glitch is resolved. Option C is wrong because recommending a compensating control is premature—the fix is already claimed to be implemented, and the practitioner should first verify it before adding compensating controls, which could introduce unnecessary complexity or cost. Option D is wrong because reporting directly to the audit committee bypasses normal escalation and management review; the issue should first be addressed with the control owner and management, and only escalated if the fix is not confirmed or if residual risk remains unacceptable.

Why this answer

How to eliminate wrong answers

Option B is wrong because immediately implementing an automated data entry solution without first conducting a root cause analysis may introduce new risks (e.g., integration issues, cost overruns, or data mapping errors) and does not address why manual errors increased—automation might not be necessary if the root cause is, for example, a training gap. Option C is wrong because increasing monitoring frequency only detects errors sooner but does not prevent them or fix the underlying cause; it is a detective control, not a corrective one, and may increase monitoring costs without improving control effectiveness. Option D is wrong because assigning additional staff to double-check data entries is a compensating control that adds cost and potential for human error, but it does not address why the original errors increased—it merely adds a layer of review without resolving the root cause.

Why this answer

How to eliminate wrong answers

Option A is wrong because average server uptime is an operational metric for availability, not a risk indicator for unauthorized access; it does not measure who can access data or how access controls are configured. Option B is wrong because the number of firewalls deployed is a control metric (a count of security devices), not a KRI; it does not indicate the effectiveness of access controls or the actual exposure of sensitive data. Option D is wrong because the number of security awareness trainings completed is a compliance or activity metric; it measures training completion, not the actual risk of unauthorized access, and does not reflect whether users are following access policies.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 10.3 per year results from incorrectly adding TEF and V (10 + 0.3), but LEF is a multiplicative product, not a sum. Option B is wrong because 30 per year results from dividing TEF by V (10 / 0.3 ≈ 33.3) or multiplying by the reciprocal, which misapplies the FAIR formula. Option C is wrong because 0.3 per year treats V as the LEF itself, ignoring TEF entirely; LEF must incorporate both TEF and V multiplicatively.

Why this answer

How to eliminate wrong answers

Option A is wrong because the number of audit findings per business unit is a lagging indicator of control failures, not a direct measure of control effectiveness; it reflects past issues rather than current control performance. Option B is wrong because the number of risk assessments completed this month measures process activity (volume of assessments), not the quality or effectiveness of controls themselves. Option C is wrong because the percentage of employees completing annual compliance training measures awareness and training completion, not whether the controls themselves are operating effectively; training is a preventive control, but its completion does not guarantee control effectiveness.

Why this answer

How to eliminate wrong answers

Option B is wrong because a standard threat checklist is inherently limited to predefined threats and cannot identify novel or context-specific threats that emerge from the unique environment or technology stack. Option C is wrong because reviewing historical incident logs only reveals threats that have already materialized, missing latent or future-oriented threats that have not yet occurred. Option D is wrong because interviewing department heads individually lacks the synergistic cross-pollination of ideas that occurs in a group workshop, often resulting in siloed perspectives and missed interdependencies.

Why this answer

How to eliminate wrong answers

Option A is wrong because accepting the risk without active monitoring or compensating controls is inappropriate when known, exploitable vulnerabilities exist on a critical system; passive acceptance increases exposure unnecessarily. Option B is wrong because the scenario explicitly states the system cannot be patched, making remediation via vendor patches technically infeasible. Option C is wrong because decommissioning a critical system would avoid the risk but at the cost of severe operational disruption, which is not the most appropriate response when compensating controls can reduce risk while maintaining operations.

Why this answer

How to eliminate wrong answers

Option A is wrong because a 20% reduction would yield a residual risk of 16 (20 * 0.8 = 16), not 8. Option B is wrong because if controls had no effect, residual risk would equal inherent risk (20), not 8. Option D is wrong because a 40% reduction would give a residual risk of 12 (20 * 0.6 = 12), not 8; the actual reduction is 60% as calculated.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because control design refers to the initial creation or selection of controls, not the process of ensuring they are updated when a change occurs. Option C is wrong because project management focuses on delivering a project's scope, schedule, and budget, not specifically on the procedural requirement to update security controls during operational changes. Option D is wrong because user training addresses end-user competency, not the procedural governance of change implementation and security control alignment.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because accepting false positives as operational tolerance does not improve efficiency; it merely accepts the waste of resources investigating non-events. Option C is wrong because increasing monitoring frequency would generate even more false positives, exacerbating the problem and increasing analyst fatigue. Option D is wrong because converting a detective control to a preventive control is a fundamental design change that may not be feasible or appropriate for the specific risk, and it does not address the root cause of high false positives.

Why this answer

How to eliminate wrong answers

Option B is wrong because service level agreements (SLAs) define performance and availability metrics, not the security controls or risk posture of sub-processors; they are contractual, not evidence-based. Option C is wrong because SOC 2 Type II reports of the primary provider cover the primary provider's controls, not those of its sub-processors, and may exclude sub-processor operations entirely. Option D is wrong because public announcements of data breaches are reactive and historical, not a proactive source for identifying current risks associated with sub-processors.

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy does not include any statement allowing s3:GetObject; it only grants s3:PutObject, so any user cannot read from the bucket. Option B is wrong because the policy includes a condition using aws:SourceIp to restrict PutObject to the 10.0.0.0/8 range, so it does not allow writes from any IP address. Option D is wrong because the policy does not grant s3:GetObject at all, so users from the internal network cannot read from the bucket.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because automating report generation addresses efficiency, not the fundamental requirement of relevance; a dashboard can be fully automated yet still present irrelevant or overwhelming data. Option B is wrong because real-time data feeds are not always necessary for operational risk monitoring—latency tolerance varies by risk type, and real-time feeds can introduce noise and false positives without proper context. Option D is wrong because including all available risk indicators violates the principle of materiality; excessive indicators obscure critical signals and violate the 'less is more' heuristic for effective dashboards.

Why this answer

How to eliminate wrong answers

Option B is wrong because recommending migration to a different cloud provider is premature without first understanding whether the current vendor's legal and contractual framework can be remediated; migration may be unnecessary or more costly than adjusting safeguards. Option C is wrong because implementing technical controls like encryption (e.g., TLS 1.3 for transit, AES-256 for at-rest) addresses data confidentiality but does not resolve regulatory compliance issues such as data residency, lawful access by foreign governments, or cross-border transfer restrictions. Option D is wrong because accepting risk based solely on vendor compliance with industry standards (e.g., ISO 27001) ignores the fact that regulatory requirements are jurisdiction-specific and may impose obligations beyond those standards.

Why this answer

How to eliminate wrong answers

Option A is wrong because inherent risk is the risk level before considering controls; it is determined by the nature of the threat and vulnerability, not by control effectiveness, so updating control effectiveness does not change inherent risk. Option C is wrong because improving control effectiveness reduces, not increases, the residual risk; an increase would occur if control effectiveness were downgraded. Option D is wrong because residual risk is directly affected by changes in control effectiveness; it does not remain unchanged when the control's ability to mitigate risk improves.

Why this answer

How to eliminate wrong answers

Option A is wrong because updating the risk register to reflect high residual risk should only occur after the control's effectiveness has been validated; prematurely updating without evidence could misrepresent the risk posture. Option B is wrong because recommending additional compensating controls is premature without first determining whether the existing control is effective; if the control is effective, compensating controls may be unnecessary and introduce unnecessary cost and complexity. Option C is wrong because escalating to the risk committee is a governance action that should be taken only after the risk practitioner has gathered sufficient evidence through testing; escalation without validation could cause unnecessary alarm or misdirect committee attention.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because transferring risk to a third party (e.g., via insurance or outsourcing) is a risk response strategy, not a measure of remaining risk after controls. Option B is wrong because avoiding risk by eliminating the activity is another risk response (risk avoidance), not the residual risk that persists after controls are applied. Option C is wrong because risk without any controls in place is defined as inherent risk, not residual risk; residual risk explicitly accounts for controls that are in place and their effectiveness.

Why this answer

How to eliminate wrong answers

Option A is wrong because reviewing the cloud provider's SOC 2 report focuses on internal controls and security practices, not on compliance with specific data localization laws of the new country; SOC 2 reports are based on AICPA trust service criteria and do not address jurisdictional legal requirements. Option B is wrong because conducting a thorough legal review of the contract's data handling clauses, while important, assumes the contract is the primary risk control, but the contract clauses have not been tested and may not align with the new country's untested legal interpretations; this step is secondary to understanding the actual regulatory landscape. Option D is wrong because mapping data flows to ensure proper classification is a data governance activity that helps understand where data resides and moves, but it does not directly identify the legal risks of non-compliance with data localization laws; it is a supporting step, not the most critical for risk identification.

Why this answer

How to eliminate wrong answers

Option A is wrong because periodic control testing refers to scheduled, manual or automated checks performed at set intervals (e.g., quarterly or annually), not the ongoing, real-time analysis provided by SIEM rules. Option B is wrong because vulnerability scanning is a specific type of assessment that identifies known vulnerabilities (e.g., missing patches, misconfigurations) in systems or networks, not the detection of unauthorized access attempts in real time. Option C is wrong because an access review is a periodic or ad-hoc audit of user permissions and entitlements (e.g., reviewing Active Directory group memberships), not the continuous detection of access attempts via SIEM correlation rules.

Why this answer

How to eliminate wrong answers

Option A is wrong because brainstorming is a creative, group-based technique that generates ideas without relying on historical data, focusing instead on hypothetical scenarios and expert intuition. Option C is wrong because SWOT analysis evaluates internal strengths/weaknesses and external opportunities/threats in a strategic context, not past incident records for risk prediction. Option D is wrong because the Delphi technique uses iterative anonymous surveys to achieve consensus among experts, not analysis of historical loss events.

Why this answer

How to eliminate wrong answers

Option A is wrong because continuous monitoring typically adds complexity to the control environment (e.g., implementing automated tools, configuring alerts, and managing data streams) rather than simplifying it. Option B is wrong because continuous monitoring often increases costs due to the need for specialized software, infrastructure, and ongoing maintenance, though it can reduce long-term costs by preventing larger failures. Option D is wrong because no monitoring approach can eliminate all control failures; continuous monitoring improves detection speed but does not prevent failures from occurring in the first place.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'High tier' is typically used for vendors with significant but not the highest risk, such as those with moderate data access or operational impact, but it does not capture the extreme risk posed by both sensitive data and critical operations. Option C is wrong because 'Low tier' applies to vendors with minimal data access and low operational impact, such as those providing non-essential services with no sensitive data handling, which is the opposite of the scenario described. Option D is wrong because 'Medium tier' is reserved for vendors with moderate risk, such as those with some data access or partial operational criticality, but it fails to address the highest-risk combination of sensitive data and criticality.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because escalating to the board of directors is a governance step that should occur after operational remediation actions have been attempted or if there is a systemic failure, not as the first action for a specific technical vulnerability. Option C is wrong because adjusting the threshold to 10% would arbitrarily lower the risk acceptance level without addressing the underlying vulnerabilities, potentially masking critical risks and violating risk management best practices. Option D is wrong because scheduling a root cause analysis for next month delays immediate remediation of critical vulnerabilities, which should be patched urgently to prevent exploitation; root cause analysis can be performed in parallel or after patching.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because periodic control testing involves scheduled assessments (e.g., quarterly penetration tests) to verify control effectiveness, not real-time monitoring. Option B is wrong because a compliance audit is a point-in-time evaluation against regulatory standards (e.g., PCI DSS), not ongoing surveillance. Option C is wrong because vulnerability scanning is a periodic or scheduled process to identify known vulnerabilities (e.g., using Nessus or Qualys), not continuous monitoring of suspicious activities.

Why this answer

How to eliminate wrong answers

Option A is wrong because organizational charts show reporting structures and roles, not the technical dependencies or recovery time objectives (RTOs) of critical processes. Option B is wrong because industry benchmarks on downtime provide generic statistics (e.g., average cost per hour) but do not identify specific risks to an organization's unique processes or infrastructure. Option D is wrong because historical incident reports only capture past failures, missing emerging threats, single points of failure not yet realized, or risks that have never materialized.

Why this answer

How to eliminate wrong answers

Option A is wrong because insufficient training on secure coding practices, while valuable, does not address the immediate technical gap that allowed the secret to be committed; training alone cannot prevent accidental pushes without automated enforcement. Option B is wrong because over-reliance on manual code reviews is a secondary concern; the incident occurred due to a lack of automated scanning, not because manual reviews were bypassed or failed. Option D is wrong because inadequate incident response procedures for exposed credentials are a reactive control; the most significant risk is the preventive failure that allowed the secret to be pushed, not the speed of response after exposure.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because reducing data shared (mitigation) does not address the vendor's unwillingness to remediate the root cause of the high-risk findings; the vendor's insecure data handling practices would still expose the organization to residual risk exceeding its low appetite. Option C is wrong because transferring risk via insurance does not reduce the likelihood or impact of a data breach; it only provides financial compensation after an incident, which is insufficient when the organization's risk appetite is low and the vendor is non-compliant with contractual security standards. Option D is wrong because accepting the risk and monitoring contradicts the organization's low risk appetite; acceptance is appropriate only when residual risk falls within appetite, but here the high-risk findings and vendor non-compliance create an unacceptable level of exposure.

Why this answer

How to eliminate wrong answers

Option A is wrong because a denial of service attack on the S3 bucket is possible but less significant than unauthorized data access; the configuration does not inherently make the bucket more vulnerable to DoS than any other public endpoint. Option B is wrong because loss of encryption keys is not directly related to the bucket's public accessibility; encryption keys are managed separately (e.g., via AWS KMS) and are not exposed by the bucket policy itself. Option D is wrong because data exfiltration by internal users is a valid risk but is not the most significant in this context; the configuration explicitly allows any internet user to access the data, making external unauthorized access the primary concern.

Why this answer

How to eliminate wrong answers

Option A is wrong because it incorrectly assumes the full ALE ($500,000) is saved each year without accounting for the 80% reduction factor, leading to an overestimation of $1,000,000 net benefit. Option B is wrong because it likely miscalculates the total cost or savings, perhaps omitting the initial implementation cost or misapplying the reduction percentage, resulting in $950,000. Option C is wrong because it may only consider the first year's net benefit or incorrectly subtract the total cost from a single year's savings, yielding $800,000.

Why this answer

How to eliminate wrong answers

Option B (Detective control) is wrong because it operates during or after an event to identify that an undesirable outcome has occurred, such as intrusion detection systems (IDS) logging suspicious activity after the fact. Option C (Corrective control) is wrong because it operates after an event to restore normal operations, like applying a patch to fix a vulnerability that was exploited. Option D (Compensating control) is wrong because it is an alternative control used when a primary control is not feasible, not specifically designed to operate before an event.

Why this answer

How to eliminate wrong answers

Option A is wrong because the purpose of integration is not to reduce the frequency of reporting but to enhance the quality and context of risk information; frequency is determined by risk velocity and materiality, not by integration alone. Option B is wrong because integrating IT risk reporting into ERM does not eliminate the need for IT risk assessments; IT risk assessments remain essential for identifying, analyzing, and evaluating specific technical threats, vulnerabilities, and controls. Option D is wrong because ERM does not replace IT risk management; rather, it subsumes IT risk as a component of the overall risk portfolio, requiring continued specialized IT risk management practices.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the question does not provide any information about the timing of the CSA relative to the audit; even if the CSA was conducted recently, the discrepancy could still exist due to bias. Option C is wrong because while a control owner might misunderstand objectives, the more fundamental issue is that the owner's rating is a subjective judgment, not a technical misunderstanding of the control's purpose. Option D is wrong because while different definitions could cause a discrepancy, the audit and CSA typically use the same organizational standard for 'effective'; the more likely root cause is the owner's biased perception rather than a definitional mismatch.

Why this answer

How to eliminate wrong answers

Option A is wrong because Asset Value is used in calculating Loss Magnitude, not Loss Event Frequency; multiplying Threat Event Frequency by Asset Value conflates frequency with impact. Option C is wrong because Loss Magnitude is a separate component in the FAIR model used to derive risk, not a factor in Loss Event Frequency; multiplying TEF by Loss Magnitude would incorrectly combine frequency and impact into a single metric. Option D is wrong because Annualized Rate of Occurrence (ARO) × Single Loss Expectancy (SLE) is the formula for Annualized Loss Expectancy (ALE) in quantitative risk analysis, not Loss Event Frequency in FAIR.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a denial of service vulnerability typically involves resource exhaustion or protocol-level attacks (e.g., SYN flood, ICMP flood), which are not directly identified by an ACL permitting remote access to a server. Option B is wrong because malware propagation across subnets would require evidence of lateral movement paths, such as unrestricted inter-subnet firewall rules or open file-sharing ports, not a single inbound rule to a critical server. Option C is wrong because a weak password policy is a governance or configuration issue unrelated to network access controls; it would be identified through password audits or policy reviews, not by examining ACLs or network diagrams.

Why this answer

How to eliminate wrong answers

Option B is wrong because a report on current loss amounts per business unit provides only a static snapshot of past losses, not a forward-looking projection to assess future appetite compliance. Option C is wrong because a summary of historical operational losses by month is purely retrospective and does not incorporate the remaining two-week period or current trends. Option D is wrong because a detailed KRI report showing loss frequency by category, while useful for identifying patterns, does not project total losses against the $2 million threshold over the remaining timeframe.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because application architecture focuses on the design and interaction of software applications, not on the underlying storage and processing of data, and while applications may implement encryption, the primary responsibility for data classification and encryption controls lies with the data architecture. Option C is wrong because technology architecture deals with the hardware and software infrastructure (e.g., servers, networks, databases) that supports data processing, but it does not define how data is classified or encrypted; those controls are applied to the data itself, which is the domain of data architecture. Option D is wrong because business architecture describes business strategy, processes, and goals, and it does not directly manage data storage, processing, or technical controls like encryption.