Courseiva

Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 301–375

983 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 14

Page 6
301
MCQhard

A large organization is implementing a continuous monitoring program for its critical systems. Which of the following is the MOST important factor for the program's success?

A.Use of advanced analytics and machine learning.
B.Integration with automated incident response workflows.
C.Support from senior management.
D.Clear definition of monitoring scope and objectives.
AnswerB

Automation ensures timely response to alerts.

Why this answer

Integration with automated incident response workflows is the most important factor because continuous monitoring is only effective if detected anomalies or threats can be acted upon in near real-time. Without automated response, alerts may be ignored or delayed, rendering the monitoring program ineffective. This aligns with the CRISC focus on reducing risk through timely remediation, not just detection.

Exam trap

The trap here is that candidates often choose 'Support from senior management' (Option C) because it seems universally important, but the question specifically asks for the 'MOST important factor for the program's success' in a technical monitoring context, where operational integration with response is the key differentiator.

How to eliminate wrong answers

Option A is wrong because advanced analytics and machine learning are enhancements, not foundational requirements; they can introduce false positives and complexity without guaranteeing success if response workflows are manual. Option C is wrong because while senior management support is necessary for funding and policy, it does not directly ensure the operational success of the monitoring program's technical execution. Option D is wrong because clear scope and objectives are prerequisites, but they alone do not ensure that monitoring leads to risk reduction; without automated response, even well-defined monitoring can fail to mitigate threats in time.

Full explanation →
302
MCQhard

A financial institution is implementing a new real-time payment system that will process high-value transactions. To identify emerging risks, which method would be MOST effective during the development phase?

A.Embed automated security testing and threat modeling into the CI/CD pipeline
B.Wait for a post-implementation penetration test
C.Conduct a security review of the completed system before deployment
D.Develop a straw man architecture and perform a threat model
AnswerA

Continuous integration of security identifies risks early and often.

Why this answer

Embedding automated security testing and threat modeling into the CI/CD pipeline enables continuous risk identification as code is developed, which is critical for a real-time high-value payment system where vulnerabilities introduced early could lead to financial loss or fraud. This approach aligns with the CRISC focus on proactive risk identification during the development phase, rather than relying on later-stage reviews.

Exam trap

The trap here is that candidates often choose a later-stage review (like Option C) or a one-time threat model (Option D) because they underestimate the speed of risk emergence in agile development, but the CRISC exam emphasizes continuous risk identification during the development phase, making CI/CD integration the most effective method.

How to eliminate wrong answers

Option B is wrong because waiting for a post-implementation penetration test introduces a significant delay, allowing vulnerabilities to be baked into the production system and increasing remediation costs; it is reactive, not proactive. Option C is wrong because conducting a security review of the completed system before deployment is a point-in-time assessment that misses risks introduced during iterative development, and it does not provide continuous feedback. Option D is wrong because developing a straw man architecture and performing a threat model is a static, upfront activity that does not adapt to code changes or emerging risks during the development lifecycle, and it lacks the automation needed for a CI/CD environment.

Full explanation →
303
MCQeasy

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

A.Update the risk register
B.Escalate to senior management
C.Implement additional controls
D.Reduce the risk appetite
AnswerB

Residual risk exceeding appetite requires senior management decision.

Why this answer

When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Exam trap

The trap here is that candidates confuse the risk owner's authority with senior management's authority, assuming the risk owner can independently implement controls or adjust appetite without escalation.

How to eliminate wrong answers

Option A is wrong because updating the risk register is a documentation step that should occur after the decision is made, not the first action when risk exceeds appetite. Option C is wrong because implementing additional controls is a potential remediation step, but it requires senior management approval or direction first, as the risk owner cannot unilaterally decide to spend resources. Option D is wrong because reducing risk appetite is a strategic decision made by the board or senior management, not the risk owner, and changing appetite to match residual risk violates the purpose of having a defined appetite.

Full explanation →
304
MCQmedium

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

A.$250,000
B.$100,000
C.$10,000
D.$50,000
AnswerC

Correctly calculated: $50,000 × 0.2 = $10,000.

Why this answer

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given SLE = $50,000 and ARO = 0.2, the ALE is $50,000 × 0.2 = $10,000. This aligns with the FAIR framework's quantitative risk analysis formula.

Exam trap

The trap here is that candidates often confuse the ALE formula with the SLE formula or misplace the decimal point in ARO (0.2 vs. 2.0), leading to inflated values like $100,000 or $250,000.

How to eliminate wrong answers

Option A ($250,000) is wrong because it incorrectly divides SLE by ARO ($50,000 / 0.2) instead of multiplying, a common arithmetic reversal. Option B ($100,000) is wrong because it multiplies SLE by 2 (a misinterpretation of ARO as 2.0) rather than by the correct factor of 0.2. Option D ($50,000) is wrong because it assumes ARO = 1.0, ignoring the given 0.2 frequency and treating the loss as occurring once per year.

Full explanation →
305
Multi-Selecthard

Which TWO of the following are considered direct costs in the financial impact assessment of a risk event?

Select 2 answers
A.Increased insurance premium
B.Reputation loss
C.Incident response team expenses
D.Lost business opportunities
E.Customer notification costs
AnswersC, E

Direct cost.

Why this answer

Incident response team expenses (C) are direct costs because they are immediate, quantifiable outlays incurred specifically to respond to and mitigate a risk event. Similarly, customer notification costs (E) are direct costs as they represent mandatory, traceable expenditures for informing affected parties, often required by regulations like GDPR or HIPAA. These costs are directly attributable to the incident and can be precisely measured.

Exam trap

The trap here is that candidates often confuse indirect costs (like reputation loss or increased premiums) with direct costs, failing to recognize that direct costs must be immediate, quantifiable, and directly attributable to the incident response activities.

Full explanation →
306
Multi-Selecteasy

Which TWO of the following are examples of risk mitigation controls?

Select 2 answers
A.Implementing a firewall
B.Purchasing cyber insurance
C.Accepting the risk
D.Encrypting sensitive data
E.Discontinuing a high-risk service
AnswersA, D

Mitigation reduces risk through preventive controls.

Why this answer

Implementing a firewall is a risk mitigation control because it reduces the likelihood and impact of unauthorized network access by enforcing access control policies based on source/destination IP addresses, ports, and protocols. Firewalls operate at Layers 3 and 4 (and sometimes Layer 7) of the OSI model to filter traffic, thereby directly reducing the attack surface and preventing exploitation of vulnerabilities.

Exam trap

The CRISC exam often tests the distinction between risk mitigation (reducing likelihood/impact) and risk transfer (e.g., insurance) or risk avoidance (e.g., discontinuing a service), so candidates mistakenly classify insurance or service discontinuation as mitigation when they are separate risk response strategies.

Full explanation →
307
Multi-Selecthard

Which TWO of the following are valid reasons to accept a risk rather than mitigate it?

Select 2 answers
A.Management is not aware of the risk
B.The risk relates to regulatory non-compliance
C.The risk level is within the risk appetite
D.The organization wants to avoid the risk entirely
E.The cost of mitigation is higher than the potential loss
AnswersC, E

Acceptance is appropriate when within appetite.

Why this answer

Accepting a risk is appropriate when the residual risk level falls within the organization's defined risk appetite. Risk appetite represents the amount of risk the organization is willing to accept in pursuit of its objectives, and risks within that threshold do not require additional mitigation controls. This aligns with the CRISC principle that risk acceptance is a valid response when the risk is within tolerance levels.

Exam trap

The trap here is that candidates often confuse risk acceptance with risk avoidance or assume any risk can be accepted, but CRISC requires that acceptance only applies when the risk is within the risk appetite and does not violate compliance mandates.

Full explanation →
308
Multi-Selecteasy

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Select 2 answers
A.Ensures all cyber attacks are prevented
B.Helps align cybersecurity activities with business objectives
C.Provides a prescriptive set of controls for all organizations
D.Provides a common language for communicating cybersecurity risk
E.Replaces the need for a separate risk appetite statement
AnswersB, D

The framework supports risk-based decisions aligned with business.

Why this answer

The NIST CSF provides a common language for communicating cybersecurity risk (option D) and helps align cybersecurity activities with business objectives (option B). It does not guarantee prevention of all cyber attacks (option A), nor does it replace the need for a separate risk appetite statement (option E), and it is not a prescriptive set of controls but a flexible framework (option C).

Full explanation →
309
MCQeasy

Which of the following is an example of a leading indicator?

A.Number of security incidents.
B.Percentage of employees trained.
C.Audit findings count.
D.Loss amount from fraud.
AnswerB

Training coverage can predict future compliance or security outcomes.

Why this answer

A leading indicator is a proactive metric that predicts future risk events or control effectiveness. The percentage of employees trained is a leading indicator because it measures a preventive control (security awareness) that reduces the likelihood of future incidents, such as phishing or data breaches. In contrast, lagging indicators like incident counts or loss amounts reflect past events.

Exam trap

ISACA's CRISC exam often tests the distinction between leading and lagging indicators by presenting lagging metrics (like incident counts or audit findings) as plausible answers, trapping candidates who confuse reactive measures with proactive predictors.

How to eliminate wrong answers

Option A is wrong because the number of security incidents is a lagging indicator—it measures events that have already occurred, not predictive of future risk. Option C is wrong because audit findings count is a lagging indicator that reports on past compliance gaps or control failures, not forward-looking risk. Option D is wrong because loss amount from fraud is a lagging indicator that quantifies realized financial impact after an event, not a proactive measure.

Full explanation →
310
MCQmedium

During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control is expected to reduce the ALE by 80% and will cost $150,000 per year. What is the net benefit of implementing the control?

A.$100,000
B.$250,000
C.$400,000
D.$350,000
AnswerB

Correct calculation of net benefit.

Why this answer

The current annual loss expectancy (ALE) is $500,000. An 80% reduction means the control saves $400,000 per year. Subtracting the annual control cost of $150,000 yields a net benefit of $250,000.

This is calculated as (ALE × reduction percentage) – control cost.

Exam trap

The trap here is that candidates often forget to subtract the annual control cost from the gross savings, mistakenly selecting the gross savings ($400,000) as the net benefit.

How to eliminate wrong answers

Option A ($100,000) is wrong because it incorrectly subtracts the control cost from the reduced ALE ($100,000 = $100,000 – $0?) or miscalculates the savings as 20% of ALE. Option C ($400,000) is wrong because it represents the gross savings (80% of $500,000) without subtracting the $150,000 annual control cost. Option D ($350,000) is wrong because it likely results from subtracting the control cost from the original ALE ($500,000 – $150,000) and ignoring the 80% reduction factor.

Full explanation →
311
MCQhard

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

A.Implement a generic Security Information and Event Management (SIEM) system with standard rules.
B.Deploy an automated monitoring tool that ingests audit logs from the CRM and cloud infrastructure APIs to trigger alerts on anomalies.
C.Rely on the CRM vendor's SOC 2 Type II report for control assurance.
D.Schedule quarterly manual reviews of user access logs and system configurations.
AnswerB

Enables continuous, real-time monitoring across both layers.

Why this answer

It establishes a continuous, automated monitoring feedback loop by ingesting audit logs from both the CRM application (e.g., user activity logs) and cloud infrastructure APIs (e.g., AWS CloudTrail, Azure Monitor). This approach enables real-time anomaly detection and alerting, which is essential for maintaining control effectiveness across the entire stack without manual intervention.

Exam trap

The trap here is that candidates often confuse point-in-time assurance (SOC 2 reports) with continuous monitoring, or they assume a generic SIEM is sufficient without considering the need for application-specific log ingestion and correlation.

How to eliminate wrong answers

Option A is wrong because a generic SIEM with standard rules lacks the tailored log sources and correlation logic needed to monitor the specific CRM application and cloud infrastructure layers, leading to high false-positive rates and missed anomalies. Option C is wrong because a SOC 2 Type II report provides only a point-in-time assurance of the vendor's controls, not continuous monitoring of the organization's own control environment. Option D is wrong because quarterly manual reviews introduce significant latency and cannot detect control failures or security incidents in near real-time, violating the principle of continuous monitoring.

Full explanation →
312
MCQhard

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

A.Accept the risk
B.Implement compensating controls
C.Transfer via insurance
D.Avoid by decommissioning
AnswerB

Controls like segmentation and monitoring reduce the risk.

Why this answer

When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Exam trap

The trap here is that candidates often choose 'Accept the risk' because they misunderstand risk acceptance as a passive decision, but in CRISC, acceptance is only valid when the risk is within the risk appetite, not when the likelihood and impact are both high and the system is critical.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any mitigation would leave the organization exposed to a high-likelihood, high-impact threat, which is typically unacceptable for a core business function; acceptance is only appropriate when the residual risk is within the organization's risk appetite. Option C is wrong because transferring via insurance does not reduce the likelihood or impact of a security incident; it only provides financial compensation after a loss, and for a legacy system with a high exploitation likelihood, the operational disruption and reputational damage are not fully transferable. Option D is wrong because avoiding by decommissioning contradicts the board's explicit decision to keep the system operational due to its criticality, and it would disrupt the core business function.

Full explanation →
313
MCQeasy

A risk manager is using a 5x5 heat map to assess IT risks. Which of the following best describes the primary limitation of this qualitative risk analysis approach?

A.It requires extensive historical data to be accurate.
B.It is time-consuming and complex to implement.
C.It is subjective and not comparable across organizations.
D.It provides objective, financially meaningful results.
AnswerC

Correct. The subjective nature limits comparability.

Why this answer

Qualitative risk analysis using heat maps is subjective and results are not comparable across different organizations due to varying risk appetites and cultural interpretations.

Full explanation →
314
Multi-Selecthard

Which THREE of the following are effective risk treatment strategies?

Select 3 answers
A.Accept the risk without any analysis
B.Avoid the risk by discontinuing the activity
C.Ignore the risk if it has not materialized yet
D.Implement compensating controls to reduce risk
E.Transfer the risk through outsourcing
AnswersB, D, E

Avoidance eliminates risk entirely.

Why this answer

Avoiding risk by discontinuing the activity is a recognized risk treatment strategy under the ISACA Risk IT framework. By ceasing the activity that introduces the risk, the organization eliminates the possibility of the risk event occurring, which is a valid and often necessary response when the risk exceeds the organization's risk appetite and cannot be cost-effectively mitigated or transferred.

Exam trap

The trap here is confusing 'ignoring' or 'uninformed acceptance' with the legitimate risk acceptance strategy, which requires documented analysis and approval, and assuming that risks that have not yet materialized can be safely disregarded.

Full explanation →
315
MCQmedium

Which of the following best describes the primary limitation of qualitative risk analysis?

A.It requires extensive historical data
B.It is subjective and not comparable across organizations
C.It cannot produce financial loss estimates
D.It is time-consuming and complex
AnswerB

Subjectivity and lack of comparability are key limitations.

Why this answer

Qualitative analysis is subjective and relies on ordinal scales, making results not directly comparable across different organizations.

Full explanation →
316
Multi-Selecthard

A quantitative risk analysis using FAIR requires estimating which THREE primary factors?

Select 3 answers
A.Risk appetite
B.Vulnerability
C.Loss magnitude
D.Threat event frequency
E.Control cost
AnswersB, C, D

Correct; vulnerability is the probability that threat can exploit.

Why this answer

FAIR decomposes risk into threat event frequency, vulnerability, and loss magnitude. These are the main input factors for calculating risk.

Full explanation →
317
MCQhard

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

A.Escalate to the risk committee
B.Change the KRI threshold to amber
C.Investigate the KRI calculation methodology
D.Re-test the control
AnswerC

The KRI might be using incorrect data or outdated baselines.

Why this answer

The KRI showing green while the underlying control has a high failure rate indicates a misalignment between the KRI and the actual control effectiveness. The first step is to investigate the KRI calculation methodology to determine if the KRI is measuring the wrong metric, using stale data, or has an incorrect threshold. Only after understanding why the KRI is misleading can the risk manager take appropriate corrective action.

Exam trap

The trap here is that candidates assume a green KRI means the risk is low and immediately focus on fixing the control (Option D) or adjusting the threshold (Option B), rather than recognizing that the KRI itself may be flawed and requires investigation first.

How to eliminate wrong answers

Option A is wrong because escalating to the risk committee without first understanding the root cause of the discrepancy would provide incomplete or misleading information, potentially causing unnecessary alarm or poor decision-making. Option B is wrong because changing the threshold to amber without investigating the calculation methodology is a superficial fix that does not address the underlying issue of why the KRI is green despite control failures. Option D is wrong because re-testing the control assumes the control test results are accurate, but the core problem is that the KRI is not reflecting the control state; re-testing does not resolve the KRI calculation error.

Full explanation →
318
Multi-Selecteasy

Which TWO of the following are examples of control monitoring activities?

Select 2 answers
A.Periodic manual testing of a sample of transactions for compliance with approval policy.
B.Automated alerts when a system control fails to execute.
C.Assigning owners to each control in the control framework.
D.Reporting key risk indicator values to the risk committee.
E.Updating the risk register based on control test results.
AnswersA, B

Direct testing verifies control operation.

Why this answer

A is correct because periodic manual testing of a sample of transactions is a classic detective control monitoring activity. It involves directly verifying that the control (approval policy) is operating effectively by examining actual evidence (transactions) after the fact. This is a direct, substantive test of control effectiveness, not a design or reporting activity.

Exam trap

The trap here is confusing control monitoring activities (which directly test or observe control operation) with risk management or governance activities (like assigning owners, reporting KRIs, or updating registers), which are related but distinct processes.

Full explanation →
319
MCQmedium

When prioritizing risk treatment actions, which of the following should be the primary consideration?

A.Ease of implementation
B.Compliance requirements only
C.Risk level and cost-benefit analysis
D.Risk owner preference
AnswerC

High-risk items with favorable cost-benefit should be prioritized.

Why this answer

Prioritization should be based on the risk level (score) and the cost-benefit analysis of controls to ensure efficient resource allocation.

Full explanation →
320
MCQhard

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

A.Periodic control testing
B.Continuous monitoring
C.Access review
D.Vulnerability scanning
AnswerB

SIEM rules operate in real time, providing continuous monitoring.

Why this answer

This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Exam trap

The trap here is that candidates confuse 'continuous monitoring' with 'continuous auditing' or assume any automated activity is 'vulnerability scanning,' but the key differentiator is the real-time, rule-based detection of operational anomalies versus scheduled scans for configuration weaknesses.

How to eliminate wrong answers

Option A is wrong because periodic control testing involves scheduled, manual or automated assessments of controls at fixed intervals (e.g., quarterly reviews), whereas the SIEM rule runs continuously without a schedule. Option C is wrong because an access review is a manual or semi-automated process that examines user permissions and entitlements against policy, not real-time detection of failed login anomalies. Option D is wrong because vulnerability scanning identifies known software vulnerabilities (e.g., missing patches, misconfigurations) by probing systems, not by monitoring authentication failure patterns.

Full explanation →
321
Multi-Selecteasy

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Select 2 answers
A.Implementing firewalls to protect the network perimeter.
B.Conducting regular vulnerability assessments and patching.
C.Avoiding the risk by discontinuing the vulnerable activity.
D.Accepting the risk because the cost of mitigation exceeds the potential loss.
E.Purchasing cyber insurance to cover potential losses.
AnswersA, B

Correct: Firewalls reduce the likelihood of network-based attacks, which is a mitigation technique.

Why this answer

Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Exam trap

The trap here is that candidates often confuse risk mitigation with risk transfer (insurance) or risk acceptance, failing to recognize that mitigation involves active controls (like firewalls and patching) that reduce the risk level, not just financial compensation or inaction.

Full explanation →
322
Multi-Selecteasy

Which TWO of the following are examples of operational vulnerabilities that a risk practitioner might identify?

Select 2 answers
A.Insufficient security awareness training for employees
B.Phishing emails targeting senior executives
C.Lack of segregation of duties in financial systems
D.SQL injection vulnerability in a web application
E.Unpatched software in the production environment
AnswersA, C

Why this answer

Operational vulnerabilities include process gaps (e.g., lack of segregation of duties) and training gaps (e.g., insufficient awareness training). The other options are technical vulnerabilities or threat types.

Full explanation →
323
MCQhard

An organization uses the FAIR (Factor Analysis of Information Risk) model to quantify cyber risk. Which of the following is the correct definition of 'Loss Magnitude' in the FAIR model?

A.The probable financial impact of a cyber incident
B.The cost of implementing security controls
C.The number of records compromised in a data breach
D.The probability that a threat event will occur
AnswerA

Correct. Loss Magnitude is the financial impact.

Why this answer

In FAIR, Loss Magnitude is the probable financial impact of a cyber incident, typically expressed as a monetary value. It is calculated based on primary and secondary losses.

Full explanation →
324
Multi-Selectmedium

A risk analyst is assessing the impact of a potential ransomware attack. Which THREE categories of business impact should be considered?

Select 3 answers
A.Geographic diversity
B.Operational downtime
C.Financial losses (direct and indirect)
D.Technical complexity
E.Regulatory fines
AnswersB, C, E

Correct; operational impact affects productivity.

Why this answer

Operational downtime (B) is a direct consequence of a ransomware attack, as encryption of critical systems halts business processes, leading to lost productivity and revenue. This category is essential for impact assessment because it quantifies the duration and scope of service disruption, which directly affects operational continuity.

Exam trap

The trap here is confusing risk factors (like technical complexity or geographic diversity) with impact categories, leading candidates to select options that describe the attack's nature or mitigation rather than its direct business consequences.

Full explanation →
325
MCQhard

You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?

A.Implement automated real-time monitoring of critical configuration changes with alerts.
B.Require all change requests to be approved by the change advisory board (CAB).
C.Increase the frequency of access reviews to monthly.
D.Provide additional training to cloud administrators on security policies.
AnswerA

Real-time monitoring would detect and alert on unauthorized changes immediately.

Why this answer

Implementing automated real-time monitoring of critical configuration changes with alerts would have detected the misconfiguration immediately, allowing the SOC to respond within minutes rather than days. This directly addresses the monitoring gap (24-hour review cycle) and aligns with the low risk appetite for availability. Option B is incorrect because while CAB approval improves change control, it does not improve real-time detection; the change was made without following process, so additional approval steps would not prevent a rogue administrator.

Option C is incorrect because monthly access reviews are still too infrequent to catch real-time configuration changes. Option D is incorrect because training does not provide immediate detection of unauthorized changes.

Full explanation →
326
Multi-Selecthard

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Select 3 answers
A.Timeliness of the information provided.
B.Including all operational data for completeness.
C.Consistency in definitions and metrics over time.
D.Aligning with industry best practices for risk reporting.
E.Tailoring the report to the target audience.
AnswersA, C, E

Timely information allows management to act promptly.

Why this answer

Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Exam trap

The trap here is that candidates may confuse 'completeness' (Option B) with 'comprehensiveness' or think that industry best practices (Option D) are mandatory design elements, when in fact risk reporting must be concise and context-specific to be effective.

Full explanation →
327
MCQeasy

Which of the following is an example of a detective control in IT risk management?

A.Firewall
B.Data encryption
C.Backup restoration
D.Intrusion Detection System (IDS)
AnswerD

Correct. IDS detects intrusions after they occur.

Why this answer

Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Full explanation →
328
MCQhard

A financial institution has a control that manually reviews all wire transfers over $10,000. During an audit, it was found that the review is completed within 24 hours for 95% of transactions, but the target is 99%. The process owner wants to improve the control's effectiveness. Which of the following would be the MOST effective remediation?

A.Implement a second level of approval for all wire transfers.
B.Automate the review process using an application control.
C.Increase the number of staff performing the reviews.
D.Adjust the target to 95% to reflect current performance.
AnswerB

Automation reduces manual effort, errors, and improves timeliness.

Why this answer

Automating the review process with an application control directly addresses the root cause of the missed target (human delay or error) by enforcing real-time or near-real-time validation of wire transfers over $10,000. This eliminates the dependency on manual throughput and ensures consistent, timely compliance with the 99% target, as the control can be configured to block or flag transactions until automated checks are completed within the required window.

Exam trap

The trap here is that candidates confuse 'adding more people' (Option C) with a process improvement, when in fact automation (Option B) is the only option that removes the bottleneck of human latency and variability, directly targeting the root cause of the missed KPI.

How to eliminate wrong answers

Option A is wrong because adding a second level of approval increases manual steps and latency, likely worsening the timeliness metric rather than improving it. Option C is wrong because increasing staff addresses capacity but not the inherent variability and delay of manual processes; it may improve throughput but cannot guarantee the consistent 99% target without automation. Option D is wrong because adjusting the target to match current performance is a risk acceptance or avoidance tactic, not a remediation that improves control effectiveness; it ignores the underlying deficiency and violates the principle of aligning controls with risk appetite.

Full explanation →
329
Multi-Selecthard

Which THREE factors should be considered when determining the likelihood of a threat exploiting a vulnerability?

Select 3 answers
A.Ease of exploitation
B.Regulatory fines
C.Asset value
D.Existing controls
E.Threat actor capability
AnswersA, D, E

Easier exploitation increases likelihood.

Why this answer

Ease of exploitation (A) is a key factor because it directly influences how readily a threat actor can leverage a vulnerability. For example, a vulnerability with a public exploit script or one that requires only low privileges is far more likely to be exploited than one requiring complex, custom tooling. This aligns with the CVSS exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) that quantify how easy it is to trigger the vulnerability.

Exam trap

The trap here is confusing factors that determine likelihood (probability of occurrence) with factors that determine impact (consequences), leading candidates to incorrectly select asset value or regulatory fines as likelihood inputs.

Full explanation →
330
MCQeasy

A risk manager notices that a key risk indicator (KRI) for network downtime has been steadily increasing over the past three months. The current value is 15% above the risk tolerance threshold. Which of the following is the BEST immediate action?

A.Lower the risk tolerance threshold to trigger more frequent alerts
B.Accept the increased risk without further analysis because the trend is gradual
C.Alert the risk owner and initiate a root cause analysis
D.Increase the risk tolerance threshold to match the current level
AnswerC

This follows the standard escalation process for KRI breaches.

Why this answer

The KRI has exceeded the risk tolerance threshold, indicating a potential control failure or emerging threat. The immediate action is to alert the risk owner, who has accountability for the risk, and initiate a root cause analysis to identify why network downtime is increasing. This aligns with the CRISC process of monitoring KRIs and escalating when thresholds are breached.

Exam trap

The trap here is that candidates may confuse adjusting the threshold (a control metric) with managing the risk itself, but CRISC emphasizes that thresholds are set to trigger action, not to be moved to avoid action.

How to eliminate wrong answers

Option A is wrong because lowering the tolerance threshold would increase alert frequency but does not address the underlying cause of the increasing downtime; it merely changes the measurement baseline. Option B is wrong because accepting the risk without analysis violates the principle of proactive risk management; a gradual trend does not justify ignoring a threshold breach, as it may indicate a systemic issue. Option D is wrong because raising the tolerance threshold to match the current level effectively normalizes the breach, eliminating the early warning function of the KRI and masking the problem.

Full explanation →
331
MCQeasy

An IT risk manager is facilitating a workshop to identify risks for a new mobile banking application. Which technique is MOST appropriate for generating a comprehensive list of risks?

A.Review risk registers from similar projects
B.Perform a SWOT analysis
C.Conduct a brainstorming session with cross-functional team members
D.Distribute a risk questionnaire to project stakeholders
AnswerC

Brainstorming with diverse members yields broad risk identification.

Why this answer

Brainstorming with a cross-functional team (option C) is the most appropriate technique for generating a comprehensive list of risks for a new mobile banking application because it leverages diverse perspectives from development, security, compliance, and business units. This collaborative approach helps uncover unknown or emergent risks specific to the application's architecture, such as API vulnerabilities, session management flaws, or regulatory gaps, which might not be captured by historical data or structured questionnaires.

Exam trap

The trap here is that candidates often choose 'Review risk registers from similar projects' (option A) because it seems efficient and data-driven, but they overlook that historical registers may miss novel risks specific to the new application's technology, such as mobile-specific attack vectors or updated compliance requirements.

How to eliminate wrong answers

Option A is wrong because reviewing risk registers from similar projects relies on historical data that may not account for the unique technology stack, threat landscape, or regulatory requirements of a new mobile banking application, leading to blind spots for novel risks. Option B is wrong because a SWOT analysis focuses on strategic strengths, weaknesses, opportunities, and threats at a high level, but it lacks the depth and specificity needed to identify technical risks like insecure data storage, weak authentication, or third-party SDK vulnerabilities. Option D is wrong because distributing a risk questionnaire to project stakeholders is a passive, one-way method that often yields incomplete or biased responses, missing the interactive discussion needed to surface complex, interdependent risks in a mobile banking context.

Full explanation →
332
MCQhard

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

A.Implement a unidirectional gateway that enforces one-way data flow
B.Deploy a host-based intrusion detection system on each ICS device
C.Upgrade the ICS to modern protocols with built-in authentication
D.Disconnect the ICS from the corporate network and use manual data transfer
AnswerA

A unidirectional gateway prevents external threats from entering the ICS while allowing data export, preserving availability.

Why this answer

A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

Exam trap

The trap here is that candidates often choose upgrading protocols (Option C) as the 'best practice' without considering the operational availability constraints of legacy ICS environments, where a unidirectional gateway provides a non-disruptive security layer.

How to eliminate wrong answers

Option B is wrong because a host-based intrusion detection system (HIDS) on each ICS device can detect attacks but cannot prevent exploitation of unauthenticated legacy protocols; it also adds overhead that may impact real-time control availability. Option C is wrong because upgrading to modern protocols with built-in authentication would require replacing or reconfiguring legacy ICS devices, risking operational downtime and incompatibility with existing field equipment. Option D is wrong because disconnecting the ICS and using manual data transfer eliminates the real-time data access requirement entirely, failing to meet the integration objective and introducing latency and human error.

Full explanation →
333
MCQeasy

A retail company uses a legacy inventory system that is no longer supported by the vendor. The IT department is planning to migrate to a modern cloud-based system. During risk identification, which of the following should be considered a PRIMARY risk?

A.Inadequate training of staff on the new system.
B.Potential cost overrun due to migration complexity.
C.Loss of data integrity during the data migration process.
D.Failure to decommission the legacy system after migration.
AnswerC

Data integrity loss directly impacts business operations and is a core IT risk.

Why this answer

Loss of data integrity during migration is the primary risk because the legacy system is unsupported, meaning there are no vendor patches or tools to validate or repair data inconsistencies. Corrupted or incomplete data transferred to the cloud-based system can lead to inaccurate inventory records, financial losses, and operational disruptions that are difficult to reverse without vendor support.

Exam trap

The trap here is that candidates often confuse operational risks (like training or decommissioning) with primary IT risks that directly impact data confidentiality, integrity, or availability during the migration itself.

How to eliminate wrong answers

Option A is wrong because inadequate training is an operational risk that arises after migration, not a primary risk during the identification phase of the migration project itself. Option B is wrong because cost overrun is a financial risk, not a primary IT risk; it is a consequence of technical issues like data loss or migration failure, not a root risk to the system's integrity. Option D is wrong because failure to decommission the legacy system is a post-migration operational risk that does not directly threaten the success or security of the data migration process.

Full explanation →
334
Multi-Selectmedium

An IT risk manager is performing a risk assessment for a new cloud service. Which TWO of the following are key inputs to the risk identification process? (Select TWO.)

Select 2 answers
A.Risk appetite statement
B.Threat intelligence feeds
C.Control testing results
D.Residual risk levels
E.Asset inventory
AnswersB, E

Threat intelligence helps identify potential threats.

Why this answer

Threat intelligence feeds (B) provide current information about emerging threats, attack vectors, and adversary tactics, which are essential for identifying relevant risks to the cloud service. An asset inventory (E) is a foundational input because it lists all assets (e.g., data, VMs, APIs) that could be affected, enabling the risk manager to map threats to specific resources. Both are direct inputs to the risk identification phase, as defined by the CRISC framework.

Exam trap

The trap here is that candidates often confuse risk identification inputs with outputs from later phases, such as control testing results (C) or residual risk levels (D), because they are familiar terms in the overall risk management process but are not used at the start of identification.

Full explanation →
335
Multi-Selecthard

An organization is deploying IoT devices in a smart building. Which of the following are significant security risks associated with IoT? (Choose THREE.)

Select 3 answers
A.Firmware update challenges due to device diversity
B.Legacy device security gaps from unpatched vulnerabilities
C.Increased power consumption
D.Higher data transmission speeds
E.Expanded attack surface due to many connected devices
AnswersA, B, E

Managing updates across heterogeneous devices is difficult.

Why this answer

IoT risks include expanded attack surface, legacy device security gaps, and firmware update challenges.

Full explanation →
336
Multi-Selecteasy

A risk practitioner is identifying risks related to a new API gateway implementation. Which TWO of the following are MOST likely to be significant risks?

Select 2 answers
A.Insufficient logging of API requests.
B.Lack of scalability for peak loads.
C.Insecure direct object references (IDOR) allowing unauthorized data access.
D.Use of outdated programming language.
E.High licensing cost.
AnswersA, C

Logging is critical for detection and forensics; its absence is a risk.

Why this answer

Insufficient logging of API requests (A) is a significant risk because it impairs the ability to detect, investigate, and respond to security incidents such as unauthorized access, injection attacks, or data exfiltration. Without comprehensive logs, the organization cannot perform effective forensic analysis or meet compliance requirements (e.g., PCI DSS, SOX). In the context of an API gateway, which acts as the central entry point for all API traffic, missing logs create a blind spot for threat detection and incident response.

Insecure direct object references (C) allow an attacker to access unauthorized data by manipulating object identifiers (e.g., user IDs, file paths) in API requests. This is a common API vulnerability that can lead to data breaches, especially if the gateway does not enforce proper authorization checks. Together, these two represent critical security risks that could compromise confidentiality and integrity.

Exam trap

The trap here is that candidates often confuse operational risks (scalability, cost) with security risks, or they incorrectly assume that outdated programming languages are a direct risk to the API gateway itself, when in fact the gateway abstracts away language-specific vulnerabilities.

Full explanation →
337
Multi-Selectmedium

Which TWO of the following are examples of detective controls?

Select 2 answers
A.Encryption of data at rest
B.Firewall rules
C.Log monitoring and analysis
D.Intrusion detection system (IDS)
E.Data backup process
AnswersC, D

Log monitoring detects events after the fact.

Why this answer

Detective controls identify incidents that have already occurred. Intrusion detection systems and log monitoring are classic examples.

Full explanation →
338
MCQeasy

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

A.The system is experiencing a denial-of-service attack.
B.There may be a brute-force attack in progress.
C.The password policy needs to be updated.
D.Users have forgotten their passwords.
AnswerB

High failed logins suggest password guessing.

Why this answer

A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Exam trap

The trap here is that candidates confuse a spike in failed logins with a DoS attack, but DoS attacks target availability (e.g., SYN flood) rather than authentication failures, which are a confidentiality/integrity concern.

How to eliminate wrong answers

Option A is wrong because a denial-of-service (DoS) attack typically causes a spike in traffic volume or resource exhaustion, not specifically failed login attempts; a DoS would likely overwhelm the entire system, not just authentication. Option C is wrong because a password policy update (e.g., complexity or expiration) would not cause a sudden two-day spike in failed logins; policy changes affect long-term compliance, not immediate authentication failure rates. Option D is wrong because users forgetting passwords would cause a consistent, low-level increase in failed logins, not a sharp spike to 200% of the threshold on only two days; such a pattern is more indicative of automated malicious activity.

Full explanation →
339
MCQmedium

You are the IT risk manager for a financial institution. During a routine vulnerability scan, you discover that a critical web application has a high-severity vulnerability that could allow remote code execution. The development team states that a patch is not yet available from the vendor, and the application is business-critical with no acceptable downtime. The risk owner wants to accept the risk. However, the organization's risk appetite is very low for security vulnerabilities. You have been asked to recommend a course of action. Which of the following should you recommend?

A.Transfer the risk by purchasing cyber insurance.
B.Decommission the application immediately.
C.Implement a web application firewall (WAF) with virtual patching to reduce exploitability.
D.Accept the risk as the team will monitor for patches.
AnswerC

Provides compensating control until patch is available.

Why this answer

Implementing a web application firewall (WAF) with virtual patching provides an immediate, compensating control that reduces the exploitability of the vulnerability without requiring application downtime. This aligns with the organization's low risk appetite by actively mitigating the risk while waiting for an official vendor patch, rather than passively accepting it.

Exam trap

The trap here is that candidates may confuse risk transfer (insurance) with risk mitigation, or assume that accepting risk is always valid when the risk owner agrees, ignoring the organization's stated risk appetite.

How to eliminate wrong answers

Option A is wrong because purchasing cyber insurance transfers financial risk, not technical risk; the vulnerability remains exploitable, and insurance does not prevent a breach or reduce the likelihood of exploitation. Option B is wrong because decommissioning the application immediately would cause unacceptable business downtime, contradicting the requirement that the application is business-critical with no acceptable downtime. Option D is wrong because accepting the risk while monitoring for patches violates the organization's very low risk appetite for security vulnerabilities; passive acceptance without active mitigation is not appropriate when the risk appetite is low.

Full explanation →
340
MCQmedium

During a risk assessment for a cloud migration project, the risk team identifies that the new SaaS application has not been tested for interoperability with existing identity management systems. The project manager argues that the integration will be straightforward and asks to remove this from the risk register. Which of the following is the BEST response from the risk practitioner?

A.Remove the risk as it is low priority.
B.Keep the risk in the register with a note that further assessment is needed.
C.Accept the risk but document the decision.
D.Escalate to the project steering committee.
AnswerB

Properly documents the risk until assessment clarifies.

Why this answer

The risk should be retained in the register with a note that further assessment is needed until interoperability testing can be conducted. Removing it prematurely (A) ignores potential issues. Accepting the risk (C) is premature without full evaluation.

Escalating (D) may be necessary later but is not the best immediate response.

Full explanation →
341
Multi-Selectmedium

During a third-party risk management review, the organization is tiering its vendors based on risk. Which TWO of the following criteria are most relevant for determining vendor risk tier?

Select 2 answers
A.Criticality of service provided
B.Number of vendor employees
C.Level of data access the vendor has
D.Annual contract value
E.Vendor geographic location
AnswersA, C

Service criticality directly impacts business impact if disrupted.

Why this answer

The criticality of the service provided (A) directly determines the potential business impact if the vendor fails, making it a primary factor in risk tiering. Similarly, the level of data access (C) dictates the confidentiality and privacy risks, as vendors handling sensitive or regulated data (e.g., PII, PHI) pose higher inherent risk. Both criteria align with the ISACA risk management framework, which prioritizes impact and data sensitivity over financial or operational metrics.

Exam trap

ISACA often tests the misconception that financial metrics like contract value or vendor size directly correlate with risk, but the CRISC exam emphasizes that risk is driven by data sensitivity and business impact, not cost or scale.

Full explanation →
342
MCQmedium

An IT risk manager is preparing a quarterly risk report for the CISO. Which type of reporting structure does this represent?

A.Tactical risk reporting
B.Executive risk reporting
C.Operational risk reporting
D.Strategic risk reporting
AnswerA

Quarterly to CISO/CIO is tactical.

Why this answer

Quarterly reporting to the CISO/CIO is considered tactical risk reporting, focusing on decisions affecting the IT portfolio.

Full explanation →
343
MCQeasy

During a risk assessment, a risk owner is unsure about the likelihood rating for a specific threat. Which of the following is the BEST source of information to determine the likelihood?

A.Vendor documentation
B.The risk owner's personal opinion
C.The organization's financial statements
D.Historical incident data from industry reports
AnswerD

Provides objective data on actual occurrences.

Why this answer

Historical incident data from industry reports provides empirical evidence of threat frequency and impact across similar environments, making it the most objective and reliable source for determining likelihood. Unlike subjective opinions or unrelated financial data, industry reports aggregate real-world occurrences, enabling a data-driven risk assessment that aligns with the organization's threat landscape.

Exam trap

ISACA often tests the misconception that the risk owner's personal experience or vendor claims are sufficient for likelihood determination, but the correct approach relies on objective, historical data from industry sources to avoid bias and ensure repeatable risk scoring.

How to eliminate wrong answers

Option A is wrong because vendor documentation typically focuses on product capabilities, configurations, and known vulnerabilities, not on the frequency or probability of threat events in operational environments. Option B is wrong because the risk owner's personal opinion introduces subjective bias and lacks empirical evidence, which can lead to inaccurate likelihood ratings that do not reflect actual threat patterns. Option C is wrong because the organization's financial statements contain monetary data about assets and losses, but they do not provide historical frequency or probability metrics needed to assess threat likelihood.

Full explanation →
344
MCQmedium

A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?

A.Quantitative risk assessment using ALE and SLE
B.Application of the COSO ERM framework
C.Scenario analysis with a focus on likelihood and impact
D.Control self-assessment (CSA) against ISO 27001
AnswerC

Scenario analysis effectively evaluates specific threat scenarios like insider data exfiltration.

Why this answer

Scenario analysis is most appropriate because the risk of data exfiltration by a malicious insider at the cloud provider is a complex, low-frequency, high-impact threat that is difficult to quantify with historical data. This approach allows the risk manager to systematically evaluate specific attack paths (e.g., an insider with database access copying customer records) by focusing on likelihood and impact, which aligns with the qualitative nature of insider threat assessment in a cloud environment.

Exam trap

The trap here is that candidates often choose quantitative risk assessment (A) because it seems more rigorous, but they fail to recognize that insider threats at a cloud provider lack the historical data needed for ALE/SLE calculations, making scenario analysis the practical and most appropriate approach per CRISC best practices.

How to eliminate wrong answers

Option A is wrong because quantitative risk assessment using ALE and SLE requires reliable historical data on frequency and loss magnitude, which is typically unavailable for malicious insider threats at a cloud provider due to the rarity and variability of such events. Option B is wrong because the COSO ERM framework is an enterprise-level governance and internal control framework, not a specific risk assessment methodology for analyzing a discrete technical threat like data exfiltration by a cloud provider insider. Option D is wrong because control self-assessment (CSA) against ISO 27001 evaluates the effectiveness of existing controls against a standard, but it does not directly assess the likelihood and impact of a specific threat scenario like malicious insider data exfiltration.

Full explanation →
345
MCQhard

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

A.Violation of electronic security perimeter (ESP) requirements
B.Latency issues affecting real-time control
C.Increased bandwidth costs for WAN connectivity
D.Incompatibility with legacy serial protocols
AnswerA

NERC CIP mandates ESPs to protect critical cyber assets; any connection must be controlled and monitored.

Why this answer

NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

Full explanation →
346
MCQmedium

A control owner reports that a control is operating effectively, but the internal audit found a deficiency. What should the risk manager do?

A.Re-test the control independently.
B.Update the control description.
C.Remove the control from monitoring.
D.Accept audit's finding.
AnswerA

Independent testing provides objective evidence to resolve the discrepancy.

Why this answer

When a control owner asserts effectiveness but internal audit identifies a deficiency, the risk manager must independently re-test the control to resolve the conflict. This ensures objective evidence is gathered, eliminating bias from the control owner's self-assessment. Re-testing validates whether the control is truly operating as designed or if the audit finding is accurate.

Exam trap

The trap here is that candidates assume the audit finding is always correct and choose 'Accept audit's finding,' but CRISC emphasizes that the risk manager must independently validate conflicting evidence rather than deferring to either party's assertion.

How to eliminate wrong answers

Option B is wrong because updating the control description does not address the factual discrepancy between the owner's claim and audit's finding; it merely changes documentation without verifying actual control performance. Option C is wrong because removing the control from monitoring would ignore a potential risk exposure and violate the principle of continuous monitoring; the control must remain in scope until its effectiveness is objectively confirmed. Option D is wrong because accepting the audit's finding without independent verification cedes the risk manager's responsibility to corroborate evidence and could lead to incorrect risk decisions if the audit finding itself is flawed.

Full explanation →
347
MCQeasy

Which of the following is the BEST indicator that a control is effective in mitigating a risk?

A.Regular testing shows the control consistently reduces the risk to the desired level
B.The control is automated and runs daily
C.The control is documented in a policy
D.The cost of the control is lower than the potential loss
AnswerA

Testing provides evidence that the control is achieving its objective.

Why this answer

The effectiveness of a control is ultimately measured by its ability to consistently reduce residual risk to the organization's defined risk appetite. Regular testing provides empirical evidence that the control is operating as intended and achieving the desired risk mitigation outcome, which is the primary goal of risk treatment.

Exam trap

The trap here is that candidates often confuse control attributes (automation, documentation, cost) with direct evidence of effectiveness, but only regular testing provides the empirical proof that the control is actually reducing risk to the desired level.

How to eliminate wrong answers

Option B is wrong because automation and frequency of execution do not guarantee that the control is actually reducing risk to the desired level; a control can run daily but still be misconfigured or ineffective. Option C is wrong because documentation in a policy only indicates intent or design, not operational effectiveness; a control may be well-documented yet never implemented or poorly executed. Option D is wrong because cost-benefit analysis (cost of control vs. potential loss) is a factor in control selection and justification, not a direct measure of its effectiveness in mitigating risk; a low-cost control can still be ineffective.

Full explanation →
348
MCQhard

A power utility must comply with NERC CIP standards. Which of the following is a key requirement under these standards?

A.Implementing IEC 62443 for all control systems
B.Identifying and securing Critical Cyber Assets (CCAs)
C.Deploying AI for threat detection
D.Using only air-gapped networks
AnswerB

NERC CIP focuses on CCAs and their protection.

Why this answer

NERC CIP requires identification and protection of Critical Cyber Assets, including security controls for assets essential to bulk electric system reliability.

Full explanation →
349
Multi-Selecthard

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Select 3 answers
A.Expanded attack surface due to numerous connected devices
B.Vendor lock-in due to proprietary protocols
C.Lack of firmware update capabilities for security patches
D.Data sovereignty issues for sensor data
E.Use of legacy components with known vulnerabilities
AnswersA, C, E

More devices mean more entry points.

Why this answer

IoT devices significantly expand the attack surface due to their sheer number and network connectivity (option A). They often lack mechanisms for firmware updates, leaving them vulnerable to unpatched exploits (option C). Additionally, many IoT devices use legacy components with known vulnerabilities that cannot be easily remediated (option E).

Options B and D are not considered primary security risks: vendor lock-in is a business risk, and data sovereignty is less critical for non-sensitive environmental data.

Full explanation →
350
MCQhard

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

A.Reduces the need for security staff
B.Is less expensive than periodic testing
C.Eliminates all false positives
D.Provides real-time detection of security events
AnswerD

SIEM rules enable continuous, real-time monitoring and alerting.

Why this answer

Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Exam trap

The trap here is that candidates may confuse 'continuous monitoring' with 'automated response' or assume it reduces staffing needs, but the CRISC exam emphasizes that the primary benefit is real-time detection, not cost savings or elimination of human oversight.

How to eliminate wrong answers

Option A is wrong because continuous monitoring does not eliminate the need for security staff; it augments their capabilities but still requires analysts to investigate alerts, tune rules, and respond to incidents. Option B is wrong because continuous monitoring often involves higher upfront and ongoing costs for SIEM infrastructure, licensing, and staffing compared to periodic manual testing. Option C is wrong because SIEM rules can produce false positives due to misconfigurations, noisy data sources, or overly broad rule logic; they do not eliminate all false positives.

Full explanation →
351
MCQhard

An organization is evaluating threat intelligence feeds to improve IT risk identification. Which of the following criteria should be given the HIGHEST priority when selecting a feed?

A.Relevance to the organization's industry and technology stack
B.Ease of integration with existing security tools
C.The feed's update frequency
D.The number of indicators provided per day
AnswerA

Intelligence that is not relevant will lead to false positives and wasted resources.

Why this answer

Relevance to the organization's industry and technology stack is the highest priority because threat intelligence that does not align with the specific attack surface, software versions, and threat actors targeting that industry will generate excessive false positives and irrelevant alerts. For example, a healthcare organization using Epic EHR would prioritize feeds covering healthcare-specific ransomware (e.g., Ryuk) and medical device vulnerabilities over generic indicators, ensuring risk identification is actionable and contextually accurate.

Exam trap

The trap here is that candidates prioritize operational metrics like integration ease or update frequency over the strategic requirement of contextual relevance, confusing efficiency with effectiveness in risk identification.

How to eliminate wrong answers

Option B is wrong because ease of integration, while operationally convenient, does not address the core requirement of improving risk identification; a feed that integrates easily but provides irrelevant data will not reduce risk. Option C is wrong because update frequency alone is meaningless if the indicators are not relevant; a feed updated every 5 minutes with generic IPs from unrelated sectors adds noise and degrades detection fidelity. Option D is wrong because the number of indicators per day is a vanity metric; high volume often includes low-quality or outdated indicators (e.g., stale C2 IPs) that increase false positives without improving risk identification accuracy.

Full explanation →
352
Drag & Dropmedium

Order the steps for implementing a risk treatment plan.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Full explanation →
353
MCQmedium

An organization is developing an IT risk universe. Which of the following is the PRIMARY purpose of creating a comprehensive IT risk universe?

A.To ensure all potential IT risks are considered and documented
B.To prioritize risks based on their financial impact
C.To assign risk owners to each identified risk
D.To calculate the aggregated risk exposure for the organization
AnswerA

Why this answer

The IT risk universe captures all potential IT-related risks across the enterprise, ensuring that no significant risk area is overlooked during the risk identification process.

Full explanation →
354
MCQmedium

A company has identified a risk of data exfiltration through an outdated encryption protocol. The risk assessment team determines that the likelihood is low, but the impact is very high. The company decides to update the encryption protocol. This risk response is an example of:

A.Risk transfer
B.Risk acceptance
C.Risk mitigation
D.Risk avoidance
AnswerC

Updating the encryption reduces the vulnerability, mitigating the risk.

Why this answer

Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Exam trap

The trap here is confusing risk mitigation with risk avoidance: candidates often think that updating a protocol 'avoids' the risk, but avoidance requires ceasing the risky activity entirely, whereas mitigation reduces the risk while continuing the activity.

How to eliminate wrong answers

Option A is wrong because risk transfer involves shifting the financial burden of a loss to a third party (e.g., cyber insurance or outsourcing), not updating a technical control like an encryption protocol. Option B is wrong because risk acceptance means formally acknowledging the risk and choosing to take no action, which contradicts the decision to update the protocol. Option D is wrong because risk avoidance would mean eliminating the activity that introduces the risk (e.g., discontinuing the use of the system or data transmission entirely), not updating the encryption to make it secure.

Full explanation →
355
MCQeasy

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

A.Perform a vulnerability scan on the CRM server.
B.Conduct a threat modeling workshop with the development team.
C.Run a penetration test against the CRM application.
D.Review the business impact analysis for the CRM.
AnswerB

Threat modeling systematically identifies potential threats.

Why this answer

Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Exam trap

ISACA often tests the distinction between threat identification (proactive, design-focused) and vulnerability assessment (reactive, implementation-focused), leading candidates to choose a technical test like a penetration test over a collaborative workshop.

How to eliminate wrong answers

Option A is wrong because a vulnerability scan only identifies known technical weaknesses (e.g., missing patches, misconfigurations) on the CRM server, not the broader set of threats like business logic flaws, insider threats, or data leakage through API endpoints. Option C is wrong because penetration testing validates exploitability of existing vulnerabilities but is a reactive, point-in-time test that misses threats not yet present in the code or configuration. Option D is wrong because a business impact analysis (BIA) assesses the consequences of disruption (e.g., financial loss, reputational damage) but does not identify specific threat sources or threat events targeting the CRM.

Full explanation →
356
MCQeasy

A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?

A.Document the vulnerability and assess the associated risk in the risk register
B.Apply a virtual patch via an intrusion prevention system
C.Isolate the application from the network
D.Notify the application owner and request an emergency patch
AnswerA

Proper risk identification and documentation precede treatment decisions.

Why this answer

The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

Exam trap

The trap here is that candidates often jump to a technical control (like applying a virtual patch or isolating the application) because it seems immediate and effective, but the CRISC exam consistently tests that risk assessment and documentation must come first before any control implementation.

How to eliminate wrong answers

Option B is wrong because applying a virtual patch via an intrusion prevention system (IPS) is a compensating control that should only be selected after the risk has been assessed and documented; jumping to a technical fix without risk evaluation bypasses the risk management process. Option C is wrong because isolating the application from the network is a drastic technical control that may disrupt business operations and should be considered only after the risk assessment determines that the vulnerability's impact exceeds the organization's risk appetite. Option D is wrong because notifying the application owner and requesting an emergency patch is a reactive step that assumes a patch is feasible, but the scenario explicitly states the application cannot be patched immediately, making this action premature and potentially futile without first assessing the risk.

Full explanation →
357
MCQeasy

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

A.To determine the criticality and recovery time objectives of business processes
B.To identify vulnerabilities in IT systems
C.To identify potential threat actors
D.To inventory all IT assets
AnswerA

BIA focuses on business impact.

Why this answer

The primary purpose of a business impact analysis (BIA) is to identify critical business processes, determine their recovery priorities, and establish recovery time objectives (RTOs) and recovery point objectives (RPOs). Option B is incorrect because identifying vulnerabilities is part of a vulnerability assessment, not a BIA. Option C is incorrect because identifying potential threat actors is part of threat modeling.

Option D is incorrect because inventorying IT assets is part of asset management, not the primary goal of a BIA.

Full explanation →
358
Multi-Selectmedium

Which TWO of the following are examples of risk avoidance?

Select 2 answers
A.Implementing a firewall
B.Purchasing cyber insurance
C.Accepting the risk
D.Migrating to a different technology platform
E.Discontinuing a high-risk business process
AnswersD, E

Changing platforms can avoid risks of the old platform.

Why this answer

Migrating to a different technology platform (Option D) is a risk avoidance strategy because it eliminates the risk entirely by moving away from the vulnerable or high-risk technology. For example, if an organization uses an outdated operating system with known unpatched vulnerabilities, migrating to a modern, supported platform removes the attack surface, avoiding the risk rather than mitigating or transferring it.

Exam trap

The trap here is that candidates confuse risk mitigation (e.g., implementing controls like firewalls) with risk avoidance, failing to recognize that avoidance requires completely eliminating the risk source, not just reducing it.

Full explanation →
359
Multi-Selectmedium

Which TWO of the following are characteristics of an effective key risk indicator (KRI)?

Select 2 answers
A.Leading indicators that provide early warning.
B.Large number of indicators to cover all risks.
C.Measurable and quantifiable metrics.
D.Lagging indicators that confirm past events.
E.Qualitative assessments based on expert opinion.
AnswersA, C

Leading indicators are predictive.

Why this answer

Effective KRIs are leading indicators that provide early warning signals of increasing risk exposure, enabling proactive risk mitigation before an adverse event occurs. This aligns with the CRISC focus on forward-looking metrics that trigger preemptive actions, rather than merely reporting on past outcomes.

Exam trap

The trap here is that candidates often confuse KRIs with KPIs or assume that more indicators provide better coverage, but the CRISC exam emphasizes that effective KRIs are leading, measurable, and limited in number to focus on the most significant risks.

Full explanation →
360
MCQmedium

A risk manager decides to accept a risk because the cost of controls exceeds the potential loss. Which of the following is required for this risk treatment option?

A.Elimination of the business process
B.Transfer of risk via insurance
C.Implementation of compensating controls
D.Formal sign-off by the risk owner
AnswerD

Acceptance requires documented acceptance by the risk owner.

Why this answer

When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

Exam trap

The trap here is that candidates confuse risk acceptance with risk mitigation or transfer, assuming that any decision involving cost analysis must lead to controls or insurance, but the question explicitly states the cost of controls exceeds the potential loss, making formal acceptance the correct treatment option.

How to eliminate wrong answers

Option A is wrong because elimination of the business process is a risk avoidance strategy, not acceptance; it would remove the risk entirely by discontinuing the activity, which is a different treatment option. Option B is wrong because transfer of risk via insurance shifts the financial impact to a third party, but the question specifies acceptance due to cost-benefit analysis, not transfer. Option C is wrong because implementation of compensating controls is a risk mitigation strategy that reduces risk to an acceptable level, whereas acceptance involves no additional controls and relies on the existing risk level being tolerated.

Full explanation →
361
MCQeasy

A risk practitioner is facilitating a workshop to identify IT risks for a new product launch. Which technique BEST encourages participants to think about risks from different perspectives?

A.Using a structured framework such as STRIDE or OCTAVE.
B.Asking each participant to write risks individually.
C.Using a checklist of common IT risks.
D.Brainstorming without any predefined categories.
AnswerA

Structured frameworks guide thinking across risk categories.

Why this answer

A structured framework like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) or OCTAVE provides predefined threat categories that force participants to systematically consider risks from multiple angles—such as security, operational, and compliance perspectives—rather than relying on ad hoc thinking. This ensures comprehensive coverage of the attack surface for the new product launch, including often-overlooked areas like repudiation or elevation of privilege in cloud-based microservices.

Exam trap

ISACA often tests the misconception that unstructured brainstorming (Option D) is the most creative approach, but the trap is that without a framework, participants miss systematic threat categories and the workshop fails to identify risks like elevation of privilege or repudiation that require structured prompting.

How to eliminate wrong answers

Option B is wrong because asking each participant to write risks individually lacks the collaborative cross-pollination of ideas needed to surface diverse perspectives; it tends to produce siloed, homogeneous viewpoints based on each person's limited experience. Option C is wrong because a checklist of common IT risks is static and retrospective, focusing on known issues (e.g., SQL injection, misconfigured firewalls) and missing novel or product-specific threats that emerge from the unique architecture of the new launch. Option D is wrong because brainstorming without any predefined categories often leads to groupthink, anchoring on the loudest voice, and missing entire threat categories like denial-of-service or privilege escalation that require structured prompting.

Full explanation →
362
MCQeasy

You are the risk manager at a financial institution that processes online transactions. The organization relies on a legacy system for transaction authorization, which is monitored via manual log reviews performed weekly by a junior analyst. Recently, the internal audit team identified that several unauthorized transactions were not detected for over two weeks. The logs showed that the authorization control failed intermittently due to a known software bug, but the bug had been documented in the risk register with a low residual risk rating. The CRO asks you to recommend the most effective improvement to the control monitoring process. Which of the following would be the BEST course of action?

A.Implement an automated real-time monitoring tool that alerts on authorization failures.
B.Increase the frequency of log reviews to daily.
C.Update the risk register to increase the residual risk rating for the bug.
D.Retrain the junior analyst on log analysis techniques.
AnswerA

Automated monitoring provides immediate detection and reduces reliance on manual reviews.

Why this answer

Implementing an automated real-time monitoring tool that alerts on authorization failures directly addresses the root cause: the detection delay caused by manual weekly log reviews. Unlike manual reviews, automated monitoring provides immediate notification of control failures, enabling rapid response to intermittent software bugs and reducing the window of exposure for unauthorized transactions.

Exam trap

The trap here is that candidates often choose to increase review frequency (Option B) because it seems like a direct improvement, but they fail to recognize that manual reviews, regardless of frequency, still suffer from human delay and cannot match the immediacy of automated monitoring for intermittent control failures.

How to eliminate wrong answers

Option B is wrong because increasing log review frequency to daily still relies on manual analysis, which introduces human latency and potential oversight; it does not eliminate the detection gap for intermittent failures that occur between reviews. Option C is wrong because updating the risk register to increase the residual risk rating is a documentation change that does not improve the actual monitoring or detection capability; it merely acknowledges the problem without fixing it. Option D is wrong because retraining the junior analyst on log analysis techniques does not address the fundamental issue of manual review latency and the inability to detect failures in near real-time; even a highly skilled analyst cannot overcome the delay inherent in periodic manual checks.

Full explanation →
363
Multi-Selecteasy

In a qualitative risk assessment, which TWO elements are typically used to determine the risk rating?

Select 2 answers
A.Likelihood
B.Impact
C.Risk appetite
D.Cost of mitigation
E.Control effectiveness
AnswersA, B

Likelihood is one dimension of risk.

Why this answer

In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Exam trap

The trap here is that candidates often confuse the inputs for inherent risk rating (likelihood and impact) with factors used in residual risk calculation or risk treatment decisions, such as control effectiveness or cost of mitigation.

Full explanation →
364
MCQmedium

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

A.Purchase business interruption insurance
B.Move all operations to a cloud provider
C.Implement flood barriers and redundant cooling systems
D.Accept the risk and document it in the risk register
AnswerC

This is a mitigation action.

Why this answer

Implementing flood barriers and redundant cooling systems directly reduces the likelihood and impact of a flood event on the data center's physical infrastructure. This is a risk mitigation strategy that proactively addresses the root cause of the risk (flooding) by hardening the facility, which is the most effective treatment for a high-probability, high-impact physical threat.

Exam trap

The trap here is that candidates often confuse risk transfer (insurance) with risk mitigation, failing to recognize that insurance does not prevent operational downtime or data loss, whereas physical controls directly reduce the risk's likelihood and impact.

How to eliminate wrong answers

Option A is wrong because purchasing business interruption insurance is a risk transfer strategy that only compensates for financial loss after an incident, but does not reduce the probability or impact of the flood itself; it leaves the organization's operations vulnerable to downtime. Option B is wrong because moving all operations to a cloud provider is a risk avoidance strategy that may be overly drastic and costly, and it does not address the underlying risk assessment of the existing data center; it also introduces new risks such as vendor lock-in and data sovereignty issues. Option D is wrong because accepting the risk without any active controls is inappropriate for a flood-prone location with high potential for catastrophic damage; risk acceptance is typically reserved for low-impact or low-probability risks, not for a clearly identified physical threat that can be mitigated.

Full explanation →
365
Multi-Selectmedium

During a risk identification workshop, the team identifies several vulnerabilities. Which TWO of the following are examples of operational vulnerability identification? (Select two.)

Select 2 answers
A.Inadequate access control review process
B.Outdated firewall firmware
C.Missing security patches on servers
D.Weak password policy enforcement
E.SQL injection vulnerability in the web application
AnswersA, D

A process gap is an operational vulnerability.

Why this answer

Operational vulnerabilities include process gaps, training gaps, and control weaknesses. Configuration issues and software flaws are technical vulnerabilities.

Full explanation →
366
MCQeasy

In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

A.Detect
B.Protect
C.Recover
D.Identify
AnswerB

Protect includes access control, awareness training, and data security safeguards.

Why this answer

The Protect function of the NIST CSF focuses on safeguards to limit or contain the impact of cybersecurity events.

Full explanation →
367
MCQmedium

A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?

A.Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.
B.Implement additional logging on all firewall devices to capture configuration changes.
C.Conduct a penetration test targeting all regional office networks to identify vulnerabilities.
D.Update the risk register to include the incidents and assign risk owners.
AnswerA

Root cause analysis systematically identifies the fundamental reason for the misconfigurations, such as inadequate change management.

Why this answer

Performing a root cause analysis on the firewall misconfigurations will help identify the underlying process weaknesses, such as deficiencies in change management or configuration review procedures, that allowed the misconfigurations to occur. This directly addresses the root cause of the risk. Option B is incorrect because although logging is valuable, it only captures changes and does not analyze the reasons behind the misconfigurations.

Option C is incorrect because penetration testing identifies vulnerabilities but does not determine why the firewall rules were misconfigured in the first place. Option D is incorrect because updating the risk register is a subsequent step after identifying the root cause, not a method to discover it.

Full explanation →
368
MCQeasy

According to COBIT 2019, which governance objective is primarily concerned with evaluating, directing, and monitoring the management of IT risk?

A.EDM03 — Ensure Risk Optimization
B.EDM02 — Ensure Benefits Delivery
C.EDM04 — Ensure Resource Optimization
D.EDM01 — Ensure Governance Framework Setting and Maintenance
AnswerA

This is the correct governance objective for IT risk management oversight.

Why this answer

EDM03 — Ensure Risk Optimization is the governance objective that focuses on evaluating, directing, and monitoring risk management to ensure the enterprise's risk appetite and risk tolerance are understood and articulated.

Full explanation →
369
Multi-Selecthard

An organization is updating its IT risk universe to include emerging threats. The CISO wants to ensure the risk register captures realistic risk scenarios. Which THREE components are essential for constructing a complete risk scenario according to ISACA's risk scenario template?

Select 3 answers
A.Event
B.Actor
C.Threat type
D.Timing
E.Detection
AnswersA, B, C

The event describes the action or occurrence (e.g., data exfiltration) that leads to impact.

Why this answer

A complete risk scenario includes actor (who), threat type (what), event (how), and asset/resource (what is affected). Timing, detection, and response are additional elements but not part of the core template.

Full explanation →
370
Multi-Selecthard

Which THREE of the following should be included in a board-level risk report to effectively communicate the organization's risk profile?

Select 3 answers
A.Emerging risks and trend analysis of key risk indicators over the past quarter.
B.A list of the most recent security incidents with root cause analysis.
C.Detailed descriptions of all controls mitigating the top risks.
D.A risk heat map showing the current likelihood and impact of top risks.
E.A summary of current risk exposure relative to the board-approved risk appetite.
AnswersA, D, E

Trends and emerging risks support proactive oversight.

Why this answer

A board-level risk report must include forward-looking information such as emerging risks and trend analysis of key risk indicators (KRIs) over the past quarter. This enables the board to understand not only the current risk posture but also the direction and velocity of risk changes, which is essential for strategic oversight and proactive decision-making.

Exam trap

The trap here is that candidates confuse the operational detail needed for management-level reports (e.g., incident root causes or control descriptions) with the strategic, summarized, and risk-appetite-focused content required for board-level communication.

Full explanation →
371
MCQmedium

During a risk assessment, a financial institution identifies that its online banking application uses an outdated encryption protocol. The likelihood of exploitation is high, and the impact is moderate. What should the risk owner do FIRST?

A.Implement a compensating control to mitigate the risk
B.Validate the risk rating with additional data
C.Transfer the risk via cyber insurance
D.Accept the risk as low priority
AnswerB

Validation ensures correct prioritization.

Why this answer

The risk owner's first responsibility is to ensure the risk assessment is accurate before deciding on a response. Validating the risk rating with additional data (option B) confirms that the high likelihood and moderate impact are correctly assessed, which is a prerequisite for selecting an appropriate treatment. Jumping to implement controls, transfer, or accept the risk without validation could lead to misallocation of resources or inadequate mitigation.

Exam trap

The trap here is that candidates often jump to selecting a risk treatment option (like implementing a control or transferring risk) without recognizing that the risk owner must first validate the risk rating to ensure the assessment is accurate and actionable.

How to eliminate wrong answers

Option A is wrong because implementing a compensating control is a risk treatment decision that should only occur after the risk rating is validated and a response strategy is chosen; acting prematurely may result in unnecessary or ineffective controls. Option C is wrong because transferring risk via cyber insurance is a specific treatment option that requires a validated risk rating to determine if transfer is cost-effective and appropriate; it is not the first step. Option D is wrong because accepting the risk as low priority contradicts the assessment's high likelihood and moderate impact, and acceptance should only be considered after validation confirms the rating and the risk is within the organization's appetite.

Full explanation →
372
MCQmedium

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

A.Protect the bulk power system from cybersecurity threats
B.Reduce energy consumption through efficient IT operations
C.Ensure interoperability between different vendors' SCADA systems
D.Standardize industrial control protocols
AnswerA

Correct. NERC CIP focuses on cybersecurity to maintain grid reliability.

Why this answer

NERC CIP standards are designed to protect the reliability of the bulk power system against cybersecurity threats that could cause widespread outages.

Full explanation →
373
MCQhard

Based on the firewall log exhibit, which of the following conclusions is MOST appropriate for risk identification?

A.External server 198.51.100.20 is attempting to exploit host 10.0.1.10
B.Host 10.0.1.15 is successfully communicating with external server 203.0.113.50
C.The firewall is functioning correctly with no security incidents
D.There is evidence of a potential reverse shell or malware beaconing from host 10.0.1.15
AnswerD

Denied outbound traffic from internal host to external IP on common malware ports indicates possible compromise.

Why this answer

The firewall log shows an outbound connection from internal host 10.0.1.15 to external server 203.0.113.50 on a high ephemeral port (e.g., 4444), which is commonly associated with reverse shell payloads or malware command-and-control (C2) beaconing. This pattern indicates that the internal host may have been compromised and is establishing an outbound channel to an external attacker, bypassing typical inbound firewall rules. Such behavior is a critical risk indicator for IT risk identification, as it suggests active malicious activity within the network.

Exam trap

The trap here is that candidates focus on the source/destination IPs and assume any outbound connection is benign, overlooking the significance of the destination port (4444) as a common reverse shell indicator, which ISACA often uses to test understanding of outbound threat patterns versus simple inbound attack detection.

How to eliminate wrong answers

Option A is wrong because the log shows traffic from external server 198.51.100.20 to host 10.0.1.10 on port 80 (HTTP), which is typical web traffic and not indicative of an exploit unless accompanied by attack signatures or payload anomalies; the log alone does not confirm exploitation. Option B is wrong because while host 10.0.1.15 is indeed communicating with external server 203.0.113.50, the log shows a connection to a high port (4444) rather than a standard service port, making this communication suspicious rather than 'successful' in a benign sense. Option C is wrong because the presence of an outbound connection to a high, non-standard port from an internal host is a security incident indicator, contradicting the claim that the firewall is functioning correctly with no incidents.

Full explanation →
374
MCQeasy

Which of the following is a Key Control Indicator (KCI) that measures the effectiveness of a firewall?

A.Number of security incidents reported
B.Number of blocked intrusion attempts
C.Average time to patch vulnerabilities
D.Percentage of employees who completed security training
AnswerB

This directly reflects the firewall's ability to prevent attacks.

Why this answer

A KCI measures the performance or effectiveness of a control. The number of blocked intrusion attempts is a direct measure of the firewall's preventive effectiveness.

Full explanation →
375
MCQmedium

Which of the following is a key element of promoting a risk-aware culture within an IT department?

A.Establishing an anonymous incident reporting system
B.Outsourcing risk management to a third party
C.Conducting annual performance reviews
D.Requiring employees to sign non-disclosure agreements
AnswerA

Anonymity encourages reporting without blame.

Why this answer

A risk-aware culture encourages employees to report incidents and near-misses without fear of blame, fostering learning and improvement.

Full explanation →
Page 4

Page 5 of 14

Page 6

All pages

1234567891011121314

Practice CRISC by domain

Target a specific domain to shore up weak areas.

IT Risk IdentificationIT Risk AssessmentRisk Response and ReportingInformation Technology and SecurityRisk Response and Mitigation
See all domains with question counts →