Courseiva
← Back to Certified in Risk and Information Systems Control CRISC questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Certified in Risk and Information Systems Control CRISC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
CRISC
exam code
ISACA
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related CRISC topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

IT Risk Identification practice questions

Sharpen your CRISC knowledge of IT Risk Identification.

IT Risk Assessment practice questions

Practise CRISC questions linked to IT Risk Assessment.

Risk Response and Reporting practice questions

Sharpen your CRISC knowledge of Risk Response and Reporting.

Information Technology and Security practice questions

Practise CRISC questions linked to Information Technology and Security.

Risk Response and Mitigation practice questions

Work through CRISC questions on Risk Response and Mitigation.

CRISC fundamentals practice questions

Targeted CRISC practice covering CRISC fundamentals.

CRISC scenario practice questions

CRISC scenario practice questions for CRISC.

CRISC troubleshooting practice questions

Sharpen your CRISC knowledge of CRISC troubleshooting.

Practice set

Practice scenarios

Question 1easymultiple choice
Full question →

Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?

Exhibit

KRI: Unauthorized Access Attempts
Threshold: 10 per day (Green), 10-20 (Amber), >20 (Red)
Current Week Data: Mon:5, Tue:8, Wed:12, Thu:15, Fri:9
Question 2hardmultiple choice
Full question →

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Exhibit

Refer to the exhibit.

Exhibit: Error log from a web application

```
2024-07-22 14:23:45 ERROR: org.hibernate.exception.ConstraintViolationException: could not execute statement
2024-07-22 14:23:45 ERROR: java.sql.SQLException: Duplicate entry 'admin' for key 'username'
2024-07-22 14:23:46 INFO: User 'admin' login successful
```
Question 3mediummultiple choice
Full question →

Based on the exhibit, which risk response should be prioritized?

Exhibit

Refer to the exhibit.

SIEM alert log:
Time: 2025-03-20 14:23:45
Source IP: 10.0.1.50
Destination: server1.company.local (192.168.1.10)
Event: Multiple failed logins (15 attempts in 30 seconds)
Current state: No account lockout policy enabled.
Question 4easymultiple choice
Study the full ACL explanation →

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Exhibit

Refer to the exhibit.

Access List: ACL-01
10 deny ip host 10.1.1.10 any
20 permit tcp 10.1.1.0 0.0.0.255 any eq 443
30 permit udp 10.1.1.0 0.0.0.255 any eq 53
40 deny ip any any
Question 5easymultiple choice
Full question →

Based on the exhibit, which of the following is the MOST likely risk scenario?

Exhibit

Refer to the exhibit.

syslog output:
```
Jan 15 14:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Jan 15 14:23:50 server01 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Jan 15 14:23:55 server01 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
```
Question 6hardmultiple choice
Full question →

Based on the exhibit, which of the following poses the HIGHEST risk to the environment?

Exhibit

Refer to the exhibit.

Architecture description:
The organization has a three-tier web application: web servers (public subnet), application servers (private subnet), and database servers (private subnet). The web servers communicate with application servers via HTTPS. Application servers query the database using SQL with embedded credentials. The database has direct internet access for remote administration via SSH, but access is restricted to a single IP address of the DBA's home office.
Question 7mediummultiple choice
Full question →

Refer to the exhibit. What does this log entry indicate about the monitoring process?

Exhibit

ALERT: SQL Injection Attempt detected from IP 10.0.0.5 to server DB01 at 14:23:45
Action: Blocked by WAF. Alert escalated to SOC. SOC analyst reviewed and determined false positive. Alert closed.
Question 8mediummultiple choice
Full question →

Based on the exhibit, which aspect of risk monitoring is MOST concerning?

Exhibit

Refer to the exhibit.

---
Vulnerability Scan Report Excerpt
Target: 192.168.1.100
Vulnerability: CVE-2023-XXXX
Severity: Critical
Status: Open (first detected: 2024-01-15)
Last scan: 2024-04-10
Patches available: Yes
Risk accepted: Yes (by system owner on 2024-02-01)
---
Question 9hardmultiple choice
Full question →

Refer to the exhibit. A risk manager is reviewing IAM policies for an S3 bucket used for sensitive data. This policy allows which of the following?

Exhibit

Refer to the exhibit.

=== AWS IAM Policy (JSON) ===
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::company-data/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
=== End of Policy ===
Question 10mediummultiple choice
Full question →

Refer to the exhibit. What risk is most directly indicated by this log entry?

Exhibit

Firewall log:
2025-03-15 14:23:45 src=10.0.1.100 dst=192.168.2.50 port=3389 action=deny
Question 11easymultiple choice
Full question →

Based on the exhibit, which key risk indicator (KRI) would this log data be MOST useful for calculating?

Exhibit

Refer to the exhibit.

---
Syslog Message:
Mar 15 09:45:23 auth-server sshd[1234]: Failed password for admin from 10.0.0.5 port 22 ssh2
Mar 15 09:46:10 auth-server sshd[1234]: Failed password for admin from 10.0.0.5 port 22 ssh2
Mar 15 09:46:55 auth-server sshd[1234]: Failed password for admin from 10.0.0.5 port 22 ssh2
---
Question 12mediummultiple choice
Full question →

Based on the exhibit, which vulnerability poses the HIGHEST risk to the organization?

Exhibit

Refer to the exhibit.

=== Vulnerability Scan Report (Excerpt) ===
Host: 10.0.1.25 (Critical Server)
Vulnerability: CVE-2023-1234 (Remote Code Execution)
Severity: Critical (CVSS 9.8)
Status: Unpatched

Host: 10.0.2.10 (Web Server)
Vulnerability: CVE-2023-5678 (SQL Injection)
Severity: High (CVSS 7.5)
Status: Patched

Host: 10.0.3.50 (File Server)
Vulnerability: CVE-2022-9876 (Privilege Escalation)
Severity: Medium (CVSS 5.0)
Status: Compensating Control in Place

=== End of Exhibit ===
Question 13mediummultiple choice
Full question →

The exhibit shows a control monitoring configuration in JSON format. Which of the following is the MOST critical gap in this monitoring setup?

Exhibit

Refer to the exhibit.

```
JSON Policy - Control Monitoring Configuration
{
  "controlId": "C-102",
  "monitoringType": "automated",
  "frequency": "daily",
  "dataSource": "transaction_log",
  "threshold": 1000,
  "alertRecipients": ["riskteam@company.com"],
  "escalationLevels": [
    {"level": 1, "condition": "breach_duration > 1 hour", "action": "email"},
    {"level": 2, "condition": "breach_duration > 4 hours", "action": "sms"}
  ],
  "lastTested": "2024-08-15",
  "owner": "Risk Owner"
}
```
Question 14mediummultiple choice
Read the full VPN explanation →

Refer to the exhibit. A security analyst reviews firewall logs and sees repeated authentication failures for VPN tunnel attempts between two IP addresses. What is the MOST appropriate action?

Exhibit

Feb 15 09:23:45 fw01 %ASA-4-722041: Tunnel negotiation failed to/from IP 203.0.113.5 to 198.51.100.20 due to authentication failure.
Feb 15 09:24:12 fw01 %ASA-4-722041: Tunnel negotiation failed to/from IP 203.0.113.5 to 198.51.100.20 due to authentication failure.
Feb 15 09:24:50 fw01 %ASA-4-722041: Tunnel negotiation failed to/from IP 203.0.113.5 to 198.51.100.20 due to authentication failure.
Question 15easymultiple choice
Full question →

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

Exhibit

Refer to the exhibit.

Firewall policy excerpt:
access-list 100 deny ip 203.0.113.0 0.0.0.255 any
deny ip 198.51.100.0 0.0.0.255 any
permit ip any any

These CRISC practice questions are part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style CRISC questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.