How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the CRISC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CRISC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified in Risk and Information Systems Control CRISC questions

Scenario-based practice

Hard Difficulty Questions

Practise Certified in Risk and Information Systems Control CRISC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CRISC

exam code

ISACA

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

During a third-party risk assessment, a vendor is classified as 'critical' due to its access to sensitive customer data. According to the organization's vendor risk appetite, what is the minimum security requirement for this vendor?

A
SOC 2 Type II report
Correct. This is a common requirement for high-risk vendors.
B
Annual compliance attestation
Why wrong: Less rigorous than SOC 2.
C
Penetration test results from the vendor
Why wrong: May be additional but not the minimum per the scenario.
D
Self-assessment questionnaire only
Why wrong: Not sufficient for critical vendors.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related CRISC topic practice pages

IT Risk Identification practice questions

IT Risk Assessment practice questions

Risk Response and Reporting practice questions

Information Technology and Security practice questions

Risk Response and Mitigation practice questions

CRISC fundamentals practice questions

CRISC scenario practice questions

CRISC troubleshooting practice questions

Practice scenarios

During a third-party risk assessment, a vendor is classified as 'critical' due to its access to sensitive customer data. According to the organization's vendor risk appetite, what is the minimum security requirement for this vendor?

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Exhibit

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Exhibit

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Which THREE factors should be considered when determining the inherent risk level of a new IT project prior to any controls?

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Which THREE factors should be considered when determining the likelihood of a threat exploiting a vulnerability?

Which THREE of the following are effective risk treatment strategies?

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)