Certified in Risk and Information Systems Control (CRISC) — Questions and Answers

Question 1: What is the purpose of data masking in information systems control?

To prevent unauthorized access to physical storage media
To encrypt production data for backup storage
To replace sensitive data with realistic but fictitious values, protecting confidentiality in non-production environments (Correct answer)
To permanently delete sensitive data after its retention period expires

Correct answer: To replace sensitive data with realistic but fictitious values, protecting confidentiality in non-production environments

Data masking protects sensitive information by substituting real values with masked equivalents in test and development environments, preventing exposure of production data.

Question 2: Which risk governance document defines the boundaries within which business units must manage their risk?

Risk policy (Correct answer)
Business impact analysis
Vulnerability assessment report
Risk register

Correct answer: Risk policy

A risk policy establishes the organization's overall approach, boundaries, and mandates for how risk must be managed across all business units.

Question 3: The principle of least privilege in access control design means that users should be granted:

Read-only access to all organizational data
Only the minimum permissions needed to perform their job functions (Correct answer)
Administrative rights to enable self-service IT tasks
Access to all systems to support business continuity

Correct answer: Only the minimum permissions needed to perform their job functions

Least privilege limits each user's access to only what is required for their role, reducing the attack surface if credentials are compromised.

Question 4: Which control ensures that only tested and approved software is deployed in the production environment?

Using the same credentials across all environments
Allowing direct code deployment without peer review
Separation of development, testing, and production environments (Correct answer)
Full access for developers to the production environment

Correct answer: Separation of development, testing, and production environments

Maintaining separate environments ensures that code is tested in a controlled setting before reaching production, preventing untested changes from causing incidents.

Question 5: A risk scenario is MOST useful in risk assessment because it:

Provides a realistic narrative linking threats, vulnerabilities, and business impacts (Correct answer)
Defines the organizational risk appetite in measurable terms
Documents the cost of implementing specific security controls
Lists all technical vulnerabilities identified by scanning tools

Correct answer: Provides a realistic narrative linking threats, vulnerabilities, and business impacts

Risk scenarios connect threat actors, vulnerabilities, and business impacts into a coherent story that helps stakeholders understand and prioritize risks.

Question 6: A company's IT risk governance structure is WEAK when which condition exists?

Risk owners are assigned for each identified risk
Risk assessments are conducted annually
Risk appetite is documented and communicated
Risk decisions are made without senior management involvement (Correct answer)

Correct answer: Risk decisions are made without senior management involvement

When risk decisions lack senior management involvement, governance is weak because strategic alignment and accountability are absent.

Question 7: Which characteristic distinguishes a HIGH-QUALITY KRI from a poorly designed one?

It is complex enough to require specialized analysis tools
It is measurable, timely, and directly correlated to a specific risk (Correct answer)
It is reported on an annual basis to maintain relevance
It captures the largest number of risk events over time

Correct answer: It is measurable, timely, and directly correlated to a specific risk

Effective KRIs must be quantifiable, available in time to act, and have a proven correlation to the risk they are monitoring.

Question 8: Which approach BEST ensures that a risk assessment remains relevant over time?

Annual penetration testing by external consultants
Periodic reassessment triggered by significant changes in the environment (Correct answer)
Continuous automated vulnerability scanning of all systems
A one-time comprehensive assessment stored in a risk register

Correct answer: Periodic reassessment triggered by significant changes in the environment

Risk assessments must be refreshed whenever significant changes occur (new systems, threats, regulations) to remain accurate and actionable.

Question 9: Which of the following BEST describes an effective incident response training program?

Decreased number of password resets
Increased reporting of security incidents to the response team (Correct answer)
Increased number of identified system vulnerabilities
Decreased reporting of security incidents to the response team

Correct answer: Increased reporting of security incidents to the response team

An effective incident response training program empowers employees to recognize and report security incidents promptly. Increased reporting indicates that staff are better trained to identify potential threats and understand the importance of escalating them, leading to faster detection and response. This proactive behavior is a key sign of a successful training program.

Question 10: A risk appetite statement should PRIMARILY be approved by which organizational body?

IT Steering Committee
Board of Directors (Correct answer)
Internal Audit Committee
Chief Information Officer

Correct answer: Board of Directors

The Board of Directors is ultimately accountable for setting and approving the organization's risk appetite at the highest governance level.

Question 11: Which standard provides a framework specifically for information security requirements in supplier relationships?

ISO/IEC 27036 (Information Security for Supplier Relationships) (Correct answer)
ISO 22000 (Food Safety Management)
ISO 14001 (Environmental Management)
ISO 45001 (Occupational Health and Safety)

Correct answer: ISO/IEC 27036 (Information Security for Supplier Relationships)

ISO/IEC 27036 is specifically designed to address information security risks in supplier and customer relationships, providing guidance on policies, controls, and assessment.

Question 12: Which element of IT risk governance ensures that risk decisions are transparent and auditable?

Documentation and record-keeping of risk decisions (Correct answer)
Deployment of intrusion detection systems
Monthly risk committee meetings
Use of qualitative risk assessment methods

Correct answer: Documentation and record-keeping of risk decisions

Documenting risk decisions creates a transparent audit trail that demonstrates accountability and supports governance review activities.

Question 13: What is the purpose of a Data Processing Agreement (DPA) in vendor contracts?

To establish vendor employee training schedules
To define terms under which a vendor may process personal data on behalf of the organization (Correct answer)
To allocate hardware procurement responsibilities between parties
To specify the technical architecture the vendor must use

Correct answer: To define terms under which a vendor may process personal data on behalf of the organization

A DPA legally defines the terms of personal data processing by a vendor acting as a data processor, a requirement under frameworks like GDPR and CCPA.

Question 14: Which stakeholder group is most critical to engage during IT risk identification?

External auditors exclusively
The marketing department
Only the IT security team
Business process owners who understand operational dependencies and critical assets (Correct answer)

Correct answer: Business process owners who understand operational dependencies and critical assets

Business process owners have the deepest understanding of operational workflows, critical assets, and dependencies, making them essential partners in risk identification.

Question 15: Which statement about risk acceptance is TRUE?

It means the organization is ignoring the risk without review
It must be a deliberate, documented decision made by an authorized risk owner (Correct answer)
It is only appropriate for risks below a certain dollar threshold
It eliminates the need to monitor the accepted risk going forward

Correct answer: It must be a deliberate, documented decision made by an authorized risk owner

Risk acceptance requires a conscious, documented choice by an authorized person — it is not passive neglect and must be periodically reviewed.

Question 16: What is the purpose of input validation controls in application systems?

To encrypt data at rest in the database
To log all user activity for audit trail purposes
To restrict physical access to server hardware
To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data (Correct answer)

Correct answer: To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data

Input validation controls check that data conforms to expected format, type, and range before processing, preventing issues like SQL injection, data corruption, and processing errors.

Question 17: When a critical vendor announces it is going out of business, the organization should FIRST:

Wait to see if the vendor finds a buyer before taking action
Immediately notify regulators without assessing impact
Activate contingency or exit plans and identify alternative vendors (Correct answer)
Stop all payments to the vendor immediately

Correct answer: Activate contingency or exit plans and identify alternative vendors

Activating exit and contingency plans ensures business continuity by transitioning to alternative vendors or in-house capabilities before service disruption occurs.

Question 18: Which principle is MOST critical when integrating IT risk management into corporate governance?

Alignment of IT risk with business objectives (Correct answer)
Quarterly reporting of all identified risks
Use of automated risk assessment tools
Separation of IT operations from risk management

Correct answer: Alignment of IT risk with business objectives

IT risk management must be aligned with business objectives to ensure governance decisions support the organization's overall strategic direction.

Question 19: What is the purpose of a configuration management database (CMDB)?

To hold copies of all application source code
To track employee IT training completions
To store user credentials for authentication purposes
To maintain a centralized record of all IT assets and their relationships, supporting change and incident management (Correct answer)

Correct answer: To maintain a centralized record of all IT assets and their relationships, supporting change and incident management

A CMDB provides a comprehensive inventory of IT assets and their interdependencies, enabling better change impact analysis and faster incident resolution.

Question 20: What is the purpose of a control self-assessment (CSA)?

To automatically remediate control deficiencies using AI tools
To replace external audits entirely
To assign blame for security incidents to specific teams
To allow process owners to evaluate the effectiveness of controls over their own activities (Correct answer)

Correct answer: To allow process owners to evaluate the effectiveness of controls over their own activities

CSA empowers process owners to assess whether controls in their area are operating effectively, promoting ownership and often uncovering issues before formal audits.

Question 21: An organization terminates its relationship with a cloud vendor. Which action is MOST critical from a risk management perspective?

Issuing a final invoice for outstanding payments
Ensuring all organizational data is securely retrieved and deleted from vendor systems (Correct answer)
Publishing an announcement to notify stakeholders
Sending a formal termination letter with 30-day notice

Correct answer: Ensuring all organizational data is securely retrieved and deleted from vendor systems

Secure data retrieval and certified deletion prevents residual data exposure, which is the primary risk when offboarding a cloud vendor.

Question 22: COBIT 2019 supports CRISC practitioners PRIMARILY by providing which capability?

A methodology for software development
A technical standard for network security
A database of known vulnerabilities
A governance and management framework for enterprise IT (Correct answer)

Correct answer: A governance and management framework for enterprise IT

COBIT 2019 provides an enterprise IT governance and management framework that aligns IT objectives with business goals and risk management.

Question 23: Which control design principle ensures that no single individual can complete a sensitive transaction without involvement of another person?

Least privilege
Defense in depth
Segregation of duties (Correct answer)
Need to know

Correct answer: Segregation of duties

Segregation of duties divides critical tasks among multiple people, preventing any single person from committing and concealing fraud or error.

Question 24: What role does internal audit play in the risk monitoring process?

Approving all risk treatment plans before implementation
Setting the organization's risk appetite and tolerance levels
Directly managing IT risks on behalf of the risk function
Providing independent assurance that risk management processes and controls are operating effectively (Correct answer)

Correct answer: Providing independent assurance that risk management processes and controls are operating effectively

Internal audit provides objective, independent validation that the risk management framework and controls are functioning as intended, without conflicts of interest.

Question 25: What is change management control, and why is it important in IT risk management?

A method for tracking vendor contract renewals
A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes (Correct answer)
An HR process for managing employee role transitions
A financial process for approving IT budget requests

Correct answer: A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes

Change management controls prevent unauthorized, untested, or poorly planned changes from introducing new vulnerabilities or disruptions to IT systems.

Question 26: What is the purpose of tracking risk trends over time?

To identify whether risks are increasing, decreasing, or stable so that responses can be adjusted accordingly (Correct answer)
To provide evidence of compliance with regulatory requirements only
To replace the need for periodic risk assessments
To justify the IT security budget to the CFO

Correct answer: To identify whether risks are increasing, decreasing, or stable so that responses can be adjusted accordingly

Trend analysis reveals the direction risk is moving, enabling proactive adjustments to risk responses before situations deteriorate beyond acceptable thresholds.

Question 27: In IT risk assessment, exposure factor (EF) represents:

The annual frequency at which a threat is expected to occur
The total value of all assets at risk
The percentage of an asset's value lost if a threat event occurs (Correct answer)
The cost of implementing a compensating control

Correct answer: The percentage of an asset's value lost if a threat event occurs

The exposure factor is the percentage of an asset's value that would be lost in a single threat event, used to calculate Single Loss Expectancy.

Question 28: When conducting a business impact analysis (BIA), which output is MOST directly used in IT risk assessment?

A technical architecture diagram of IT systems
Recovery time objectives and critical process dependencies (Correct answer)
A list of all software licenses in use
The organization's disaster recovery plan

Correct answer: Recovery time objectives and critical process dependencies

RTOs and critical process dependencies from a BIA directly inform which IT risks have the highest business impact, guiding prioritization.

Question 29: Which principle requires that no single individual has control over all phases of a critical process?

Defense in depth
Segregation of duties (SoD) (Correct answer)
Least privilege
Need to know

Correct answer: Segregation of duties (SoD)

Segregation of duties ensures that fraud or error requires collusion by splitting critical tasks across multiple individuals so no single person can complete a harmful act alone.

Question 30: A control that automatically locks a user account after five failed login attempts is BEST classified as:

Preventive technical control (Correct answer)
Corrective physical control
Compensating logical control
Detective administrative control

Correct answer: Preventive technical control

An account lockout policy is a preventive technical control that automatically blocks brute-force login attempts.

Question 31: Which scenario BEST illustrates effective use of a KRI in practice?

An annual risk assessment reveals that encryption is not used for backup data
A post-incident report identifies the root cause of a data breach after it occurred
An alert fires when failed login attempts exceed 500 per hour, prompting investigation before a breach occurs (Correct answer)
A quarterly audit finds that access rights have not been reviewed as required

Correct answer: An alert fires when failed login attempts exceed 500 per hour, prompting investigation before a breach occurs

A KRI threshold triggering proactive investigation before a breach is the ideal use of KRIs — early warning enabling intervention before loss.

Question 32: What does a risk dashboard primarily provide to stakeholders?

A real-time or near-real-time visual summary of the organization's risk posture and KRI status (Correct answer)
A complete audit trail of all system changes
Detailed technical vulnerability scan results
Vendor contract performance metrics

Correct answer: A real-time or near-real-time visual summary of the organization's risk posture and KRI status

A risk dashboard aggregates KRIs and risk metrics into a visual format that enables quick understanding of the current risk posture without requiring detailed analysis.

Question 33: What is the primary objective of designing information systems controls?

To achieve zero risk across all IT systems and processes
To satisfy external auditor requirements exclusively
To reduce risk to an acceptable level while enabling business operations to continue efficiently (Correct answer)
To maximize the technical complexity of the security architecture

Correct answer: To reduce risk to an acceptable level while enabling business operations to continue efficiently

Controls must balance risk reduction with operational efficiency — overly restrictive controls can impede business processes as much as the risks they are meant to prevent.

Question 34: What is the significance of control testing in the SDLC?

Control testing is only necessary after a system has experienced a security incident
Testing controls during development ensures security requirements are met before systems are deployed to production (Correct answer)
Controls should be tested only after the system has been running for at least one year
Testing is the sole responsibility of the quality assurance team, not the risk function

Correct answer: Testing controls during development ensures security requirements are met before systems are deployed to production

Incorporating control testing into the SDLC identifies weaknesses before deployment, when fixes are cheapest and least disruptive, rather than after production rollout.

Question 35: What is the principle of least privilege in information systems control?

Users and systems should have only the minimum access rights required to perform their authorized functions (Correct answer)
Systems should deny all access by default and never grant permissions
Access should be granted based on seniority rather than job function
All users should have administrative rights to ensure productivity

Correct answer: Users and systems should have only the minimum access rights required to perform their authorized functions

Least privilege limits access to the minimum necessary for each role, reducing the attack surface and limiting the damage that can be caused by compromised accounts or insider threats.

Question 36: What does the term 'risk universe' mean in CRISC?

The most critical single risk identified in an assessment
A database of historical incidents
The complete set of risks that an organization could potentially face (Correct answer)
The industry standard list of cybersecurity threats

Correct answer: The complete set of risks that an organization could potentially face

The risk universe encompasses all possible risks an organization might face, providing a comprehensive view from which prioritization can occur.

Question 37: Which risk assessment scope consideration is UNIQUE to IT environments compared to general business risk?

Financial impact of operational disruptions
Regulatory compliance requirements
Interdependencies between interconnected systems and platforms (Correct answer)
Reputational impact of risk events on customers

Correct answer: Interdependencies between interconnected systems and platforms

IT risk assessments must uniquely account for cascading failures across interconnected systems, which is more complex than assessing independent business units.

Question 38: Residual risk that remains after mitigation controls are applied should be compared against which benchmark?

The cost of additional controls
The organization's defined risk tolerance (Correct answer)
The industry average residual risk level
The initial inherent risk score

Correct answer: The organization's defined risk tolerance

Residual risk must be compared to the organization's risk tolerance to determine whether it has been reduced to an acceptable level.

Question 39: Which of the following best describes the concept of risk aggregation in CRISC?

Documenting risks in a centralized register
Combining multiple smaller risks that together create a significant overall risk (Correct answer)
Reducing risk by distributing it across multiple departments
Eliminating risks through redundant controls

Correct answer: Combining multiple smaller risks that together create a significant overall risk

Risk aggregation refers to the process of recognizing how multiple lower-level risks can combine to create a larger, more significant enterprise risk.

Question 40: What is the purpose of encryption as an information systems control?

To protect data confidentiality by making it unreadable to unauthorized parties, both at rest and in transit (Correct answer)
To ensure data is available when needed
To provide an audit trail of who accessed data
To prevent unauthorized changes to data

Correct answer: To protect data confidentiality by making it unreadable to unauthorized parties, both at rest and in transit

Encryption transforms data into an unreadable format, protecting confidentiality so that even if data is intercepted or accessed without authorization, it cannot be understood.

Question 41: Which activity is MOST critical to maintaining an accurate risk register over time?

Automated import of vulnerability scan data into the register
Annual recertification of all risks by IT management
Regular review and update based on changes in threats, controls, and business context (Correct answer)
Archiving old risks to keep the register manageable

Correct answer: Regular review and update based on changes in threats, controls, and business context

A risk register must be actively maintained by updating it as threats evolve, controls change, and business conditions shift to remain a reliable risk management tool.

Question 42: When integrating risk monitoring into IT operations, which approach BEST supports continuous assurance?

Requiring manual control reviews by risk managers monthly
Embedding automated control monitoring into operational workflows (Correct answer)
Conducting annual third-party IT audits
Relying on incident reports as the primary source of risk data

Correct answer: Embedding automated control monitoring into operational workflows

Continuous assurance requires automated monitoring embedded in operations so that control status is constantly evaluated rather than periodically checked.

Question 43: Which of the following approaches is BEST for ensuring contract programmers abide by organizational security guidelines?

Have the contractors acknowledge the security policies in writing
Explicitly refer to contractors in the security standards
Perform periodic security reviews of the contractors (Correct answer)
Create penalties for noncompliance in the contracting agreement

Correct answer: Perform periodic security reviews of the contractors

While contracts and acknowledgments are important, performing periodic security reviews provides ongoing assurance that contractors are actually adhering to security guidelines in practice. This active monitoring and verification are the most effective way to ensure continuous compliance and identify any deviations or vulnerabilities. It moves beyond a one-time agreement to continuous oversight.

Question 44: When aligning IT risk governance with enterprise risk management, the FIRST step is to:

Implement automated risk monitoring tools
Create a new IT-specific risk register
Train IT staff on risk assessment techniques
Understand the enterprise risk management framework already in place (Correct answer)

Correct answer: Understand the enterprise risk management framework already in place

Before aligning IT risk governance, practitioners must first understand the existing ERM framework to ensure consistent language, methodology, and objectives.

Question 45: When evaluating risk response options, which economic concept is MOST relevant?

Total cost of ownership for security tools
Net present value of IT assets
Return on investment for new technology
Cost-benefit analysis (Correct answer)

Correct answer: Cost-benefit analysis

Cost-benefit analysis compares the cost of implementing a risk response against the benefit of the risk reduction it provides, guiding optimal decisions.

Question 46: Which risk assessment technique uses historical data and probability distributions to simulate thousands of possible risk scenarios?

Delphi technique
SWOT analysis
Monte Carlo simulation (Correct answer)
Bowtie analysis

Correct answer: Monte Carlo simulation

Monte Carlo simulation runs large numbers of probabilistic simulations based on historical data to estimate the range of possible risk outcomes.

Question 47: When developing a risk governance framework, which element BEST ensures accountability for risk decisions?

Regular vulnerability scans
Automated risk monitoring tools
Comprehensive risk register
Defined RACI matrix for risk roles (Correct answer)

Correct answer: Defined RACI matrix for risk roles

A RACI matrix (Responsible, Accountable, Consulted, Informed) explicitly assigns accountability for each risk-related decision and activity.

Question 48: Which of the following best describes a threat actor in IT risk identification?

A risk register entry
Any entity that could exploit a vulnerability to cause harm (Correct answer)
A software patch that reduces system exposure
A business continuity plan

Correct answer: Any entity that could exploit a vulnerability to cause harm

A threat actor is any person, group, or system that could exploit vulnerabilities to negatively affect the organization.

Question 49: Which internationally recognized framework is MOST commonly used to align IT risk governance with enterprise risk management (ERM)?

ITIL v4
ISO 9001
PRINCE2
COSO ERM (Correct answer)

Correct answer: COSO ERM

COSO ERM provides an integrated framework that aligns IT risk management with broader enterprise risk governance objectives.

Question 50: Which condition indicates that a control monitoring program is INEFFECTIVE?

Control owners review monitoring reports and take corrective action
Control test results are documented and reported quarterly
Automated monitoring tools alert within minutes of a control failure
Control failures are only discovered after security incidents occur (Correct answer)

Correct answer: Control failures are only discovered after security incidents occur

Discovering control failures only after incidents indicates monitoring is reactive rather than proactive, meaning the monitoring program has failed its purpose.

Question 51: Which of the following indicates a control deficiency that requires immediate escalation?

A non-critical application lacks multi-factor authentication
A critical control has failed and the resulting risk now exceeds the organization's risk tolerance (Correct answer)
An internal policy has not been reviewed within the past 24 months
A low-priority system does not have a documented backup procedure

Correct answer: A critical control has failed and the resulting risk now exceeds the organization's risk tolerance

When a failed control causes risk to exceed tolerance, immediate escalation is required because the organization is operating outside its acceptable risk boundaries.

Question 52: The PRIMARY purpose of risk monitoring in the CRISC framework is to:

Provide technical metrics for the IT operations team
Detect changes in the risk environment that require updated risk responses (Correct answer)
Identify new vulnerabilities through automated scanning
Generate compliance reports for external regulators

Correct answer: Detect changes in the risk environment that require updated risk responses

Risk monitoring detects environmental changes — new threats, control failures, or shifting business conditions — that may require updates to risk responses.

Question 53: A threshold breach in a KRI should MOST immediately trigger:

An update to the annual risk assessment report
An external penetration test of related systems
Escalation to the risk owner and review of the associated control (Correct answer)
Immediate shutdown of the affected IT system

Correct answer: Escalation to the risk owner and review of the associated control

When a KRI threshold is breached, the risk owner must be notified immediately to review whether the associated controls need reinforcement or response.

Question 54: A CRISC practitioner identifies that a KRI has been consistently at its threshold for three months. The BEST response is to:

Report the situation in the next annual risk assessment cycle
Treat the elevated KRI as a signal to reassess the underlying risk and controls (Correct answer)
Raise the threshold so the KRI no longer appears at the boundary
Remove the KRI from the monitoring program as it is not escalating

Correct answer: Treat the elevated KRI as a signal to reassess the underlying risk and controls

A KRI persistently at threshold indicates that the risk environment is stressed, requiring reassessment of whether current controls are sufficient.

Question 55: Which CRISC domain is primarily responsible for identifying IT risk scenarios that could affect business objectives?

IT Risk Assessment
IT Risk Identification (Correct answer)
Risk and Control Monitoring
Risk Response and Mitigation

Correct answer: IT Risk Identification

The IT Risk Identification domain focuses on recognizing IT risk scenarios linked to business objectives and stakeholder requirements.

Question 56: In a risk governance framework, the risk owner is BEST described as the person who:

Reports risk metrics to the board
Performs the daily monitoring of risk controls
Is accountable for managing the risk to acceptable levels (Correct answer)
Identifies new risks during assessments

Correct answer: Is accountable for managing the risk to acceptable levels

The risk owner is accountable for ensuring a specific risk is managed within acceptable levels and that appropriate controls are in place.

Question 57: What is a Key Risk Indicator (KRI)?

A metric that provides early warning signals of increasing risk exposure (Correct answer)
A checklist used during security audits
A measure of how effective a specific control is operating
A financial report summarizing IT costs

Correct answer: A metric that provides early warning signals of increasing risk exposure

KRIs are forward-looking metrics designed to signal when risk levels are trending toward or beyond acceptable thresholds before an incident occurs.

Question 58: When a critical control fails, which response is MOST aligned with CRISC best practices?

Shut down the affected system until the control is restored
Report the failure to regulators within 24 hours
Immediately activate compensating controls and assess residual risk (Correct answer)
Document the failure and schedule repair in the next maintenance window

Correct answer: Immediately activate compensating controls and assess residual risk

When a primary control fails, compensating controls should be activated immediately to maintain protection while assessing and addressing the increased residual risk.

Question 59: Which approach to risk mitigation involves redesigning a business process to eliminate a risk entirely?

Risk acceptance with monitoring
Risk avoidance through process redesign (Correct answer)
Risk sharing with business partners
Risk transfer through outsourcing

Correct answer: Risk avoidance through process redesign

Redesigning a process to remove the conditions that create the risk is a form of risk avoidance that eliminates the root cause.

Question 60: A threat-vulnerability pairing is used in risk assessment to determine:

The likelihood that a specific threat will exploit a given vulnerability (Correct answer)
The organizational risk appetite for IT risks
The residual risk after controls are applied
The total cost of implementing a security control

Correct answer: The likelihood that a specific threat will exploit a given vulnerability

Pairing threats with vulnerabilities helps assessors determine the probability that a specific threat source will successfully exploit an existing weakness.

Question 61: Which document typically provides the foundational framework for IT risk identification activities?

Acceptable use policy
Software development lifecycle (SDLC) guide
IT risk management policy (Correct answer)
Incident response playbook

Correct answer: IT risk management policy

The IT risk management policy defines the scope, methodology, roles, and objectives that guide all risk identification activities.

Question 62: What is the MAIN benefit of including a 'business continuity' requirement in vendor contracts?

It eliminates the need for the organization to maintain its own BCP
It reduces the contract price by sharing risk with the vendor
It transfers all continuity responsibility to the vendor
It ensures the vendor has tested plans to maintain services during disruptions affecting your organization (Correct answer)

Correct answer: It ensures the vendor has tested plans to maintain services during disruptions affecting your organization

Requiring vendors to maintain and test business continuity plans ensures they can sustain service delivery during disruptions, reducing the risk to the organization's own operations.

Question 63: What role does a risk owner play in the IT risk identification process?

In charge of conducting penetration tests
Oversees the IT budget allocation
Responsible only for documenting risks in the register
Accountable for managing a specific risk and ensuring appropriate responses are taken (Correct answer)

Correct answer: Accountable for managing a specific risk and ensuring appropriate responses are taken

A risk owner is accountable for monitoring and managing a specific risk, including ensuring that responses are implemented and effective.

Question 64: What is the purpose of a threat landscape analysis in CRISC risk identification?

To design technical controls for known vulnerabilities
To understand current and emerging threats relevant to the organization's industry and environment (Correct answer)
To audit user access privileges
To create a disaster recovery plan

Correct answer: To understand current and emerging threats relevant to the organization's industry and environment

Threat landscape analysis surveys the external and internal environment to identify the types of threats most likely to affect the organization.

Question 65: A CRISC professional advising on governance would MOST likely recommend that risk reporting frequency to the board be based on:

A fixed quarterly schedule regardless of risk environment
The volume of incidents reported in the prior period
The availability of the Chief Risk Officer
The significance of risks and organizational risk appetite (Correct answer)

Correct answer: The significance of risks and organizational risk appetite

Board reporting frequency should be driven by the materiality of risks and how close the organization is to its risk appetite thresholds.

Question 66: A 'fourth-party risk' in vendor management refers to:

Risk from the organization's internal fourth department
Risk from the fourth item on the vendor contract
Risk arising from the fourth quarter of the fiscal year
Risk from subcontractors or suppliers used by your primary vendors (Correct answer)

Correct answer: Risk from subcontractors or suppliers used by your primary vendors

Fourth-party risk refers to the risk introduced by vendors that your direct (third-party) vendors rely upon, creating an extended supply chain risk.

Question 67: Supply chain risk management in IT focuses primarily on risks from:

Procurement department staffing levels
Hardware manufacturers, software vendors, and service providers across the entire IT supply chain (Correct answer)
Internal logistics and warehouse management systems
Physical transportation of hardware components only

Correct answer: Hardware manufacturers, software vendors, and service providers across the entire IT supply chain

IT supply chain risk encompasses risks from all parties in the chain of hardware, software, and services that ultimately deliver IT capabilities to the organization.

Question 68: A detective control would MOST appropriately be used when:

The risk has already been fully mitigated by preventive controls
The risk must be eliminated before it can cause any harm
Prevention is too costly and early identification of incidents is sufficient (Correct answer)
The organization wants to transfer the financial impact of a risk

Correct answer: Prevention is too costly and early identification of incidents is sufficient

When prevention is impractical or too expensive, detective controls provide early warning so the organization can respond before damage becomes catastrophic.

Question 69: A corrective control is MOST effective for:

Transferring risk liability to a third party
Detecting policy violations in real time
Preventing unauthorized access before it occurs
Minimizing damage and restoring normal operations after a risk event (Correct answer)

Correct answer: Minimizing damage and restoring normal operations after a risk event

Corrective controls reduce the impact of a risk that has already materialized by enabling recovery and restoration of normal business operations.

Question 70: Which technique involves reviewing process flows to identify where IT risks could emerge?

Change management review
Business process analysis (Correct answer)
Penetration testing
Capacity planning

Correct answer: Business process analysis

Business process analysis examines workflows step-by-step to pinpoint where threats or vulnerabilities could affect IT and business outcomes.

Question 71: Which technique is used to verify that a software application's controls function as designed before deployment to production?

Regression testing after deployment
Post-implementation review
User acceptance testing (UAT) (Correct answer)
Business continuity drill

Correct answer: User acceptance testing (UAT)

UAT verifies that an application's controls and functions meet business requirements and work as designed before the system goes live.

Question 72: What information should a risk report to senior management typically include?

Detailed firewall configuration settings
Only a list of all identified risks without prioritization
Technical details of every vulnerability found during the period
Current risk status, changes since last reporting period, KRI trends, and recommendations for action (Correct answer)

Correct answer: Current risk status, changes since last reporting period, KRI trends, and recommendations for action

Executive risk reports should summarize the risk landscape in business terms, highlight changes and trends, and provide actionable recommendations.

Question 73: A preventive control that stops a database administrator from accessing production data without a second approver is an example of:

Access logging
Least privilege
Dual control (Correct answer)
Network segmentation

Correct answer: Dual control

Dual control requires two authorized individuals to act together to access sensitive resources, preventing single-person abuse of privileged access.

Question 74: When a risk cannot be fully mitigated, the BEST course of action is to:

Document the risk and take no further action
Formally accept the residual risk with senior management approval (Correct answer)
Escalate immediately to external regulators
Implement additional controls regardless of cost

Correct answer: Formally accept the residual risk with senior management approval

Formal acceptance of residual risk by senior management ensures that the decision is deliberate, documented, and appropriately authorized.

Question 75: A risk dashboard that shows risks trending toward the red zone is MOST useful for which purpose?

Identifying which employees need additional security training
Triggering proactive risk response before the risk reaches critical levels (Correct answer)
Documenting post-incident lessons learned
Justifying the IT security budget to senior management

Correct answer: Triggering proactive risk response before the risk reaches critical levels

A worsening trend visible on a risk dashboard gives risk owners advance warning to act before a risk breaches tolerance thresholds.

Question 76: What is a risk scenario in the context of CRISC?

A technical vulnerability found during a penetration test
A financial projection for IT spending
A compliance checklist used by auditors
A documented description of a threat that could negatively impact business objectives (Correct answer)

Correct answer: A documented description of a threat that could negatively impact business objectives

A risk scenario describes a threat event, its cause, and its potential impact on IT and business objectives.

Question 77: What is the difference between a vulnerability and a threat in IT risk identification?

A threat is a weakness; a vulnerability is the probability of exploitation
A vulnerability is always human-caused; a threat is always technical
Both terms are interchangeable in CRISC
A vulnerability is a weakness that can be exploited; a threat is a potential event that could exploit it (Correct answer)

Correct answer: A vulnerability is a weakness that can be exploited; a threat is a potential event that could exploit it

A vulnerability is a weakness in a system or process, while a threat is an event or actor that could exploit that weakness to cause harm.

Question 78: In a qualitative risk assessment, risks are PRIMARILY evaluated using:

Dollar value of potential losses
Statistical probability distributions
Descriptive scales such as High, Medium, and Low (Correct answer)
Return on security investment calculations

Correct answer: Descriptive scales such as High, Medium, and Low

Qualitative risk assessment uses descriptive scales rather than numerical values to rate likelihood and impact of risks.

Question 79: What is the primary purpose of exception reporting in IT risk management?

To provide a complete inventory of all IT assets
To document all routine control activities regardless of performance
To satisfy annual compliance reporting requirements
To immediately highlight instances where risk or control metrics fall outside acceptable thresholds (Correct answer)

Correct answer: To immediately highlight instances where risk or control metrics fall outside acceptable thresholds

Exception reporting focuses management attention on deviations from expected performance, ensuring that issues requiring action are visible and not buried in routine reports.

Question 80: What is the purpose of an IT general control (ITGC) review?

To evaluate the performance of individual business applications
To verify user satisfaction with IT services
To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems (Correct answer)
To conduct a security assessment of external-facing web applications

Correct answer: To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems

ITGC reviews examine controls like change management, access administration, and operations management that underpin all systems and are fundamental to reliable financial and operational reporting.

Question 81: The PRIMARY advantage of quantitative risk assessment over qualitative is:

It is faster to perform and requires less data
It is easier to communicate to non-technical stakeholders
It eliminates subjectivity completely from the process
It provides dollar-value estimates that support financial decision-making (Correct answer)

Correct answer: It provides dollar-value estimates that support financial decision-making

Quantitative risk assessment produces financial estimates (e.g., ALE) that directly support cost-benefit analysis and budget decisions.

Question 82: You are in charge of the GHT project. On your project, you've identified a risk event that, if it materializes, might prevent $100,000 in project expenditures. Which of the following best sums up this risky event?

This is a risk event that should be accepted because the rewards outweigh the threat to the project.
This risk event should be avoided to take full advantage of the potential savings.
This risk event is an opportunity for the project and should be exploited. (Correct answer)
This risk event should be mitigated to take advantage of the savings.

Correct answer: This risk event is an opportunity for the project and should be exploited.

A risk event that prevents $100,000 in project expenditures is a positive outcome, as it represents a cost saving. In risk management, positive risks are referred to as opportunities. The appropriate response strategy for an opportunity with significant potential benefit, like this one, is often to 'exploit' it, meaning to take proactive steps to ensure the opportunity materializes and its benefits are fully realized.

Question 83: When designing controls for a high-risk IT process, which approach provides the GREATEST assurance?

Deploying a single comprehensive control covering all risk scenarios
Implementing both preventive and detective controls in combination (Correct answer)
Relying solely on the most advanced preventive control available
Using only automated controls to eliminate human error

Correct answer: Implementing both preventive and detective controls in combination

Combining preventive controls (to stop threats) with detective controls (to catch what gets through) provides layered assurance for high-risk processes.

Question 84: Which formula correctly represents Annualized Loss Expectancy (ALE)?

ALE = ARO / SLE
ALE = SLE × ARO (Correct answer)
ALE = SLE + ARO
ALE = AV × EF + ARO

Correct answer: ALE = SLE × ARO

ALE is calculated by multiplying Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO) to estimate annual risk cost.

Question 85: Which of the following justifications for keeping key risk indicators (KRIs) is the MOST crucial?

Risk reports need to be timely
Complex metrics require fine-tuning
Threats and vulnerabilities change over time (Correct answer)
In order to avoid risk

Correct answer: Threats and vulnerabilities change over time

Key Risk Indicators (KRIs) are crucial because the risk landscape is dynamic; threats, vulnerabilities, and business contexts constantly evolve. Monitoring KRIs allows organizations to detect changes in their risk exposure in real-time or near real-time, enabling proactive adjustments to risk management strategies before incidents occur. This continuous monitoring is essential for adapting to an ever-changing threat environment.

Question 86: Which governance principle requires that those who own risk decisions also bear the consequences of those decisions?

Independence
Segregation of duties
Accountability (Correct answer)
Transparency

Correct answer: Accountability

Accountability in governance means that risk decision-makers are responsible for the outcomes of their decisions, incentivizing sound risk management.

Question 87: Which control type is designed to reduce the severity of an incident after it has occurred?

Deterrent control
Preventive control
Detective control
Corrective control (Correct answer)

Correct answer: Corrective control

Corrective controls restore systems and processes to normal after an incident, such as disaster recovery procedures, patch management, and incident response plans.

Question 88: Which type of control reduces the likelihood of a risk event occurring?

Corrective control
Preventive control (Correct answer)
Compensating control
Detective control

Correct answer: Preventive control

Preventive controls are designed to reduce the probability that a threat event will occur by blocking or discouraging the threat.

Question 89: Which of the following is an example of an internal threat source?

A nation-state hacking group
A third-party vendor malware campaign
A disgruntled employee with access to sensitive systems (Correct answer)
A natural disaster such as a flood

Correct answer: A disgruntled employee with access to sensitive systems

Internal threat sources originate from within the organization, such as employees, contractors, or insiders with system access.

Question 90: A risk assessment that evaluates risks AFTER controls are applied is measuring:

Detection risk
Residual risk (Correct answer)
Control risk
Inherent risk

Correct answer: Residual risk

Residual risk is the level of risk remaining after controls have been implemented, representing the organization's actual remaining exposure.

Question 91: Concentration risk in third-party management occurs when:

An organization diversifies across too many vendors
Multiple vendors compete for the same contract
A single vendor provides services to multiple business units or critical functions (Correct answer)
A vendor concentrates solely on one industry vertical

Correct answer: A single vendor provides services to multiple business units or critical functions

Concentration risk arises when over-reliance on a single vendor means their failure could simultaneously disrupt multiple critical organizational functions.

Question 92: Under the shared responsibility model for cloud services, who is responsible for classifying and protecting customer data stored in the cloud?

The customer organization (Correct answer)
The cloud service provider exclusively
The regulatory authority overseeing the organization
A jointly appointed data governance committee

Correct answer: The customer organization

Under the shared responsibility model, the customer organization retains responsibility for data classification, access control, and data protection even when data resides in the cloud.

Question 93: Which risk monitoring technique involves comparing actual control performance against defined benchmarks?

Vulnerability scanning
Threat intelligence gathering
Risk scenario analysis
Control effectiveness testing (Correct answer)

Correct answer: Control effectiveness testing

Control effectiveness testing measures whether controls are performing as intended by comparing actual performance to expected benchmarks.

Question 94: Which of the following is a key input to the IT risk identification process?

Only historical incident logs
External audit reports exclusively
Organizational strategy, objectives, and existing IT asset inventory (Correct answer)
Vendor pricing contracts

Correct answer: Organizational strategy, objectives, and existing IT asset inventory

Understanding organizational strategy and having an accurate IT asset inventory ensures that risk identification is comprehensive and aligned with business priorities.

Question 95: Which characteristic distinguishes a mature IT risk governance program from an immature one?

Risk assessments are performed after incidents occur
IT risk is managed solely by the IT department
Risk management is proactive and integrated into decision-making (Correct answer)
Risk policies are reviewed every five years

Correct answer: Risk management is proactive and integrated into decision-making

Mature IT risk governance integrates risk considerations proactively into all business decisions rather than reacting to incidents after the fact.

Question 96: What is an access control matrix?

A list of all user accounts ordered by their access level
A physical keycard reader installed at server room entrances
A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination (Correct answer)
A network diagram showing firewall rule configurations

Correct answer: A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination

An access control matrix provides a structured view of who or what can access which resources and what actions they are permitted to perform, supporting the principle of least privilege.

Question 97: Which metric would BEST serve as a KRI for the risk of insider data theft?

Total number of data records in the organization's databases
Average time to complete employee security awareness training
Number of external security incidents reported monthly
Number of employees accessing data outside normal business hours (Correct answer)

Correct answer: Number of employees accessing data outside normal business hours

Unusual access patterns such as off-hours data access are leading indicators of potential insider threat activity and directly correlate to insider theft risk.

Question 98: Which risk assessment approach is MOST appropriate when limited historical data is available?

Quantitative assessment using actuarial data
Regression analysis
Qualitative assessment using expert judgment (Correct answer)
Monte Carlo simulation

Correct answer: Qualitative assessment using expert judgment

Qualitative assessment using expert judgment is most practical when historical data is insufficient for statistical or quantitative analysis.

Question 99: Which of the following applications of KRIs is THE MOST crucial?

Providing a backward-looking view on risk events that have occurred
Providing an early warning signal (Correct answer)
Enabling the documentation and analysis of trends
Providing an indication of the enterprise's risk appetite and tolerance

Correct answer: Providing an early warning signal

Key Risk Indicators (KRIs) are crucial because they provide an early warning signal of increasing risk exposure. They are forward-looking metrics designed to help organizations anticipate potential problems before they escalate into actual incidents or losses. This proactive insight allows for timely intervention and risk mitigation, making the early warning signal their most critical application.

Question 100: A company decides to discontinue an e-commerce feature because its security risks are too high. This is an example of:

Risk transfer
Risk acceptance
Risk avoidance (Correct answer)
Risk mitigation

Correct answer: Risk avoidance

Risk avoidance eliminates the risk entirely by choosing not to engage in the activity that creates the risk.

Question 101: Which IS control framework is MOST widely used for evaluating and designing controls in IT environments?

TOGAF
PMBOK
COBIT (Correct answer)
SAFe

Correct answer: COBIT

COBIT is the leading framework for IT governance and control design, providing a comprehensive set of processes and control objectives.

Question 102: The concept of 'privacy by design' in IS control design means that:

Privacy controls are built into systems from the start rather than added later (Correct answer)
Privacy audits are conducted quarterly by external reviewers
All user data is encrypted at rest and in transit
Privacy policies are displayed on all public-facing web pages

Correct answer: Privacy controls are built into systems from the start rather than added later

Privacy by design embeds privacy protections into system architecture and processes from inception, making privacy an inherent feature rather than an afterthought.

Question 103: What is the significance of establishing control thresholds in risk monitoring?

Thresholds determine the maximum IT budget for a fiscal year
Thresholds are used only for financial controls, not IT controls
They eliminate the need for human review of control performance
Thresholds define the acceptable performance range for controls, triggering alerts when breached (Correct answer)

Correct answer: Thresholds define the acceptable performance range for controls, triggering alerts when breached

Control thresholds define the boundary of acceptable performance; when a metric crosses the threshold, it signals that human review and potential escalation are needed.

Question 104: Which control type is MOST appropriate for enforcing compliance with data retention policies?

Physical control (locked storage rooms)
Directive control (policy and procedure)
Both directive and technical controls together (Correct answer)
Technical control (automated data deletion)

Correct answer: Both directive and technical controls together

Effective data retention requires both a directive control (policy defining retention periods) and a technical control (automated deletion/archiving) to ensure consistent enforcement.

Question 105: What is the PRIMARY purpose of a Service Level Agreement (SLA) in vendor risk management?

To set measurable performance and availability expectations that can be monitored (Correct answer)
To establish the vendor's financial responsibility for data breaches
To outline the marketing obligations of each party
To define ownership of intellectual property created during the engagement

Correct answer: To set measurable performance and availability expectations that can be monitored

SLAs define specific, measurable service performance targets, enabling the organization to monitor vendor compliance and hold vendors accountable.

Question 106: What is the significance of understanding business objectives when identifying IT risks?

It allows the IT team to bypass compliance requirements
It ensures identified risks are relevant to what the organization is trying to achieve (Correct answer)
It replaces the need for a risk assessment
It focuses attention solely on technical vulnerabilities

Correct answer: It ensures identified risks are relevant to what the organization is trying to achieve

Linking IT risk identification to business objectives ensures that the risks assessed are meaningful and prioritized based on organizational impact.

Question 107: When assessing the impact of a risk, a CRISC practitioner should consider which dimension FIRST?

The number of systems affected by the risk
Business impact rather than technical impact (Correct answer)
The technical severity score from a scanning tool
The cost of the exploited vulnerability patch

Correct answer: Business impact rather than technical impact

Business impact (financial, reputational, operational) should be the primary consideration because it directly connects risk to organizational objectives.

Question 108: What is the BEST approach for managing vendor risk when a vendor refuses to allow direct audits?

Reduce the contract value to reflect the increased risk
Terminate the vendor immediately regardless of the business relationship
Accept the vendor's word that their controls are adequate
Require the vendor to provide third-party audit reports such as SOC 2 Type II (Correct answer)

Correct answer: Require the vendor to provide third-party audit reports such as SOC 2 Type II

Independent third-party audit reports like SOC 2 Type II provide objective assurance of vendor control effectiveness when direct audits are not permitted.

Question 109: Which of the following BEST describes a vendor risk appetite statement?

A budget allocation for vendor risk management activities
A formal declaration of the level and type of third-party risk the organization is willing to accept (Correct answer)
A list of vendors who have been approved for all risk categories
A description of all risks the organization wishes to transfer to vendors

Correct answer: A formal declaration of the level and type of third-party risk the organization is willing to accept

A vendor risk appetite statement formally defines how much and what types of third-party risk the organization will tolerate, guiding vendor selection and management decisions.

Question 110: Which CRISC domain focuses on ensuring that risk management activities are integrated into the enterprise governance structure?

Risk Response and Reporting
IT Risk Assessment
IT Risk Identification
IT Risk Governance (Correct answer)

Correct answer: IT Risk Governance

The IT Risk Governance domain ensures risk management is embedded in the enterprise governance structure and aligned with business objectives.

Question 111: Which CRISC concept refers to the combination of likelihood and impact of a risk?

Risk level (Correct answer)
Control objective
Risk appetite
Residual risk

Correct answer: Risk level

Risk level is the overall measure of a risk derived from its likelihood of occurrence multiplied by its potential impact on the organization.

Question 112: An anti-malware system has been installed by an IT company to lower risk. Which of the following statements BEST explains how this control lowers risk, assuming it is operating within the parameters set?

The control reduces the impact of malware on company computers but does not reduce the probability of those attacks (Correct answer)
The control reduces neither probability nor impact of malware on company computers
The control reduces the probability of malware on company computers but does not reduce the impact of those attacks
The control reduces the probability and impact of malware on company computers

Correct answer: The control reduces the impact of malware on company computers but does not reduce the probability of those attacks

An anti-malware system primarily functions to detect and neutralize malware *after* it has attempted to infect a system. While it doesn't prevent the *probability* of an attack attempt (e.g., someone clicking a malicious link), it significantly reduces the *impact* by preventing successful infection, data corruption, or system compromise. Thus, it reduces the impact, not the probability of the initial attack.

Question 113: A security control that limits access to sensitive data based on job function is an example of which type of control?

Corrective administrative control
Detective physical control
Compensating technical control
Preventive logical control (Correct answer)

Correct answer: Preventive logical control

Role-based access control is a preventive logical control that prevents unauthorized access by restricting data access to job-relevant functions.

Question 114: Which control is MOST effective at preventing unauthorized changes to production systems?

Quarterly vulnerability assessment
Automated patch deployment system
Continuous monitoring of system logs
Change management process with formal approval workflow (Correct answer)

Correct answer: Change management process with formal approval workflow

A formal change management process requiring approvals before changes reach production prevents unauthorized modifications through procedural controls.

Question 115: An application that generates an audit log of all privileged user actions is implementing which type of control?

Preventive control
Detective control (Correct answer)
Corrective control
Directive control

Correct answer: Detective control

Audit logging is a detective control that creates a record of activities, enabling identification and investigation of unauthorized or suspicious actions.

Question 116: The THREE lines of defense model assigns IT risk oversight responsibility to which line?

First line (operational management)
Second line (risk management function) (Correct answer)
Fourth line (external audit)
Third line (internal audit)

Correct answer: Second line (risk management function)

The second line of defense — the risk management function — is responsible for overseeing and monitoring IT risk across the organization.

Question 117: A vendor risk scoring model should incorporate which combination of factors?

Geographic proximity, account manager tenure, and pricing model
Inherent risk level, control effectiveness, and residual risk rating (Correct answer)
Contract value, payment history, and vendor size
Vendor age, headquarters location, and number of clients

Correct answer: Inherent risk level, control effectiveness, and residual risk rating

Effective vendor risk scoring combines inherent risk (potential exposure) with control effectiveness to derive residual risk, enabling prioritized oversight and resource allocation.

Question 118: A compensating control is BEST described as:

A detective control that identifies when a risk has materialized
An alternative control used when a primary control cannot be implemented (Correct answer)
A control that provides additional layers on top of existing controls
A control automatically triggered by a monitoring system

Correct answer: An alternative control used when a primary control cannot be implemented

A compensating control substitutes for a primary control when the primary control is impractical or not feasible to implement in a given context.

Question 119: What is the concept of 'privacy by design' in information systems control?

Installing privacy software after a system is already deployed
Documenting privacy policies without implementing technical controls
Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later (Correct answer)
Restricting system access to only the privacy officer

Correct answer: Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later

Privacy by design embeds privacy protections into the architecture and processes of systems from the ground up, making privacy a default feature rather than an afterthought.

Question 120: Which risk reporting element is MOST valuable to a board-level audience?

A complete list of all identified risks in the risk register
Raw incident counts and mean time to detection metrics
A summary of top risks and their alignment with risk appetite (Correct answer)
Detailed technical vulnerability data from security scans

Correct answer: A summary of top risks and their alignment with risk appetite

Board members need a concise, strategic view of top risks relative to risk appetite — not granular technical details that belong in operational reporting.

Question 121: Which statement BEST describes the relationship between risk tolerance and risk appetite?

Risk tolerance is the acceptable deviation from risk appetite (Correct answer)
Risk tolerance and risk appetite are synonymous terms
Risk tolerance applies only to operational risks
Risk appetite is determined after risk tolerance is set

Correct answer: Risk tolerance is the acceptable deviation from risk appetite

Risk tolerance represents the acceptable variation around the risk appetite threshold, allowing flexibility within defined boundaries.

Question 122: A vendor risk register should PRIMARILY contain:

Identified risks associated with each vendor, their likelihood, impact, and mitigating controls (Correct answer)
Marketing contact information for each vendor
A record of all vendor invoices and payment history
A list of vendors ranked by contract value

Correct answer: Identified risks associated with each vendor, their likelihood, impact, and mitigating controls

A vendor risk register documents risks per vendor alongside risk ratings and controls, enabling systematic tracking and management of third-party risk exposure.

Question 123: Which type of risk reporting is MOST appropriate for communicating day-to-day IT risk status to operational teams?

Annual enterprise risk management report
Quarterly risk committee reports
Board-level risk appetite summary
Operational risk dashboards with real-time metrics (Correct answer)

Correct answer: Operational risk dashboards with real-time metrics

Operational teams need real-time or near-real-time dashboards that reflect current risk status rather than periodic strategic reports.

Question 124: How does a KRI differ from a Key Performance Indicator (KPI)?

KPIs are used only in financial reporting; KRIs apply only to IT systems
KRIs indicate potential future risk exposure; KPIs measure current control and process performance (Correct answer)
Both measure the same thing but use different scales
KRIs measure past incidents; KPIs predict future risk

Correct answer: KRIs indicate potential future risk exposure; KPIs measure current control and process performance

KRIs are predictive, warning of emerging risks, while KPIs are diagnostic, measuring how well current controls and processes are performing.

Question 125: Which control is designed to provide an auditable record of all significant system and user activities?

Audit logging and monitoring (Correct answer)
Data masking
Capacity management
Network segmentation

Correct answer: Audit logging and monitoring

Audit logs record who did what, when, and from where in a system, providing an essential trail for investigations, compliance, and detecting unauthorized activity.

Question 126: What is the difference between a general control and an application control?

There is no functional difference between the two types
General controls govern the overall IT environment; application controls are specific to individual systems or processes (Correct answer)
Application controls apply to all systems; general controls apply only to databases
General controls are preventive; application controls are always detective

Correct answer: General controls govern the overall IT environment; application controls are specific to individual systems or processes

General controls (like change management and access administration) apply broadly across the IT environment, while application controls (like input validation) operate within specific applications.

Question 127: Which of the following role holders will determine the enterprise's Key Risk Indicator?

Business leaders (Correct answer)
Chief financial officer
Senior management (Correct answer)
Human resource

Correct answer: Business leaders

Business leaders are primarily responsible for determining an enterprise's Key Risk Indicators (KRIs) because they define the strategic objectives and understand the critical risks that could impact business performance. KRIs are directly tied to business goals and risk appetite, which are established and overseen by these leaders. While senior management is broadly involved, business leaders specifically drive the identification of these critical metrics.

Question 128: What is risk reporting frequency typically based on?

Only regulatory reporting deadlines
The criticality of the risks being monitored and the requirements of the intended audience (Correct answer)
The availability of the risk management team
A fixed schedule regardless of risk severity or business context

Correct answer: The criticality of the risks being monitored and the requirements of the intended audience

Reporting frequency should be proportional to risk severity — critical risks may require daily monitoring while lower-priority risks might only need quarterly reviews.

Question 129: Which control design consideration is MOST important for systems handling Personally Identifiable Information (PII)?

Automated backup to geographically dispersed locations
Lowest possible latency for data retrieval
Maximum system uptime and availability
Data minimization and access controls aligned with privacy regulations (Correct answer)

Correct answer: Data minimization and access controls aligned with privacy regulations

PII systems must implement data minimization (collect only what's needed) and strong access controls to comply with privacy regulations like GDPR and CCPA.

Question 130: During a vendor security incident that affects your organization's data, what is the FIRST step the organization should take?

Wait for the vendor to fully resolve the incident before taking action
Immediately terminate the vendor contract
Activate the incident response plan and notify relevant internal stakeholders (Correct answer)
Issue a public press release about the incident

Correct answer: Activate the incident response plan and notify relevant internal stakeholders

Activating the incident response plan ensures a coordinated, timely response that limits further damage and fulfills regulatory notification obligations.

Question 131: Which contract provision gives an organization the RIGHT to examine a vendor's controls and compliance posture?

Limitation of liability clause
Indemnification clause
Force majeure clause
Right-to-audit clause (Correct answer)

Correct answer: Right-to-audit clause

A right-to-audit clause contractually permits the organization to conduct audits or assessments of the vendor's security controls and compliance.

Question 132: What is a key output of the IT risk identification process?

An employee performance review
A list of approved software applications
A documented inventory of risk scenarios with associated threat sources and potential impacts (Correct answer)
A quarterly financial report

Correct answer: A documented inventory of risk scenarios with associated threat sources and potential impacts

The primary deliverable of risk identification is a comprehensive inventory of scenarios that describes threats, vulnerabilities, and their potential business impact.

Question 133: What is the primary purpose of maintaining a risk register?

To log user access attempts to systems
To store backup copies of IT policies
To record software license expiry dates
To document identified risks, their attributes, and status for tracking and communication (Correct answer)

Correct answer: To document identified risks, their attributes, and status for tracking and communication

A risk register is the central repository for recording all identified risks along with their likelihood, impact, owner, and response status.

Question 134: Which statement BEST reflects the purpose of a risk committee in IT risk governance?

To implement security controls across the organization
To provide oversight and strategic direction for risk management activities (Correct answer)
To perform technical vulnerability assessments on IT systems
To conduct forensic investigations after security incidents

Correct answer: To provide oversight and strategic direction for risk management activities

A risk committee provides governance-level oversight and sets strategic direction for risk management rather than performing operational activities.

Question 135: Which risk assessment output BEST supports prioritization of risk remediation efforts?

A list of all identified vulnerabilities by CVE score
A count of total risks per business unit
A risk heat map showing likelihood vs. impact (Correct answer)
An inventory of all IT assets and their owners

Correct answer: A risk heat map showing likelihood vs. impact

A risk heat map visually plots risks by likelihood and impact, making it easy to prioritize the highest-priority risks for remediation.

Question 136: What is the primary goal of business continuity planning (BCP) as an information systems control?

To conduct regular security awareness training for employees
To prevent all possible disruptive events from occurring
To document all IT policies for regulatory review
To ensure critical business processes and IT systems can continue operating or recover quickly after a disruption (Correct answer)

Correct answer: To ensure critical business processes and IT systems can continue operating or recover quickly after a disruption

BCP establishes procedures and capabilities to maintain or rapidly restore critical business functions following a disruption, minimizing operational and financial impact.

Question 137: Which regulatory framework explicitly requires organizations to assess and manage third-party risks for financial institutions?

COBIT 2019
FFIEC IT Examination Handbook (Third-Party Relationships) (Correct answer)
ISO 9001
PMBOK Guide

Correct answer: FFIEC IT Examination Handbook (Third-Party Relationships)

The FFIEC IT Examination Handbook on Third-Party Relationships provides specific regulatory guidance for financial institutions on managing vendor and third-party risks.

Question 138: Which metric is MOST useful for ongoing monitoring of a vendor's security risk posture?

The vendor's employee satisfaction score
The vendor's annual revenue growth rate
Frequency and severity of security incidents reported by the vendor (Correct answer)
The number of years the vendor has been in business

Correct answer: Frequency and severity of security incidents reported by the vendor

Security incident frequency and severity directly reflects the vendor's control effectiveness and their risk to the organization over time.

Question 139: Continuous monitoring of third-party vendors is BEST achieved through:

Annual vendor questionnaires sent via email
Monthly billing reviews and invoice reconciliation
Bi-annual in-person vendor relationship meetings
Real-time threat intelligence feeds, periodic assessments, and performance metric tracking (Correct answer)

Correct answer: Real-time threat intelligence feeds, periodic assessments, and performance metric tracking

Continuous monitoring combines real-time intelligence with periodic structured assessments to provide an up-to-date view of vendor risk posture throughout the relationship lifecycle.

Question 140: Where would the data ethics function MOST likely reside in an enterprise, based on the three lines of defense model?

The board of directors
The first line of defense
The second line of defense (Correct answer)
The third line of defense

Correct answer: The second line of defense

The second line of defense is responsible for overseeing risk management and compliance, including establishing policies and monitoring their adherence. Data ethics, which involves setting standards for responsible data use and ensuring compliance, fits well within this oversight function. The first line executes, and the third provides independent assurance.

Question 141: Risk scenarios in CRISC are aligned with COBIT process goals PRIMARILY to:

Ensure IT risks are mapped to business processes and objectives (Correct answer)
Define specific penetration testing methodologies
Establish IT budgeting and resource allocation priorities
Provide technical vulnerability identification criteria

Correct answer: Ensure IT risks are mapped to business processes and objectives

Aligning risk scenarios with COBIT process goals ensures that IT risks are evaluated in terms of their impact on business processes and strategic objectives.

Question 142: What does 'three lines of defense' refer to in risk management?

Firewalls, intrusion detection systems, and endpoint protection
Business operations, risk management/compliance, and internal audit as three distinct layers of oversight (Correct answer)
Prevention, detection, and response phases of incident management
Physical, logical, and network security controls

Correct answer: Business operations, risk management/compliance, and internal audit as three distinct layers of oversight

The three lines of defense model assigns risk responsibilities to: (1) business operations, (2) risk and compliance functions, and (3) internal audit as independent assurance.

Question 143: What is the purpose of a lessons-learned review after a security incident?

To assign legal liability for the incident to specific parties
To analyze what happened, why controls failed, and how to prevent recurrence (Correct answer)
To document the incident solely for insurance claim purposes
To satisfy auditor requirements without making actual process changes

Correct answer: To analyze what happened, why controls failed, and how to prevent recurrence

Lessons-learned reviews close the risk management loop by identifying root causes, control weaknesses, and improvements to prevent the same incident from recurring.

Question 144: Which element MUST be included in a risk response plan to ensure accountability?

The risk assessment methodology used
Named owner responsible for implementing the response (Correct answer)
A list of all organizational IT assets
A history of past security incidents

Correct answer: Named owner responsible for implementing the response

A risk response plan must identify a specific owner who is responsible and accountable for executing the response within the agreed timeframe.

Question 145: Which metric best indicates the timeliness of risk response actions?

Annual IT security budget utilization
Number of security awareness training completions
Mean Time to Remediate (MTTR) for identified control deficiencies (Correct answer)
The total number of risks in the risk register

Correct answer: Mean Time to Remediate (MTTR) for identified control deficiencies

MTTR measures how long it takes to fix control deficiencies after they are identified, indicating whether the organization is responding to risks in a timely manner.

Question 146: Which metric is MOST useful for evaluating the effectiveness of an IT risk governance framework?

Number of vulnerabilities identified in the last quarter
Total IT budget allocated to risk tools
Percentage of risks with assigned owners and response plans (Correct answer)
Number of employees trained in cybersecurity

Correct answer: Percentage of risks with assigned owners and response plans

Governance effectiveness is best measured by how completely risks are owned and have defined response plans, indicating accountability and readiness.

Question 147: What is role-based access control (RBAC), and what risk does it help mitigate?

A model that grants all users the same level of access for simplicity
A system that allows users to self-select their own access permissions
An access control method based solely on user seniority
A model that assigns access rights based on job roles rather than individual users, reducing excessive access risk (Correct answer)

Correct answer: A model that assigns access rights based on job roles rather than individual users, reducing excessive access risk

RBAC assigns permissions to roles rather than individuals, ensuring access aligns with job functions and making it easier to manage and audit permissions at scale.

Question 148: What is the primary purpose of continuous risk monitoring in CRISC?

To monitor employee compliance with acceptable use policies
To replace periodic risk assessments entirely
To detect changes in the risk environment and verify that controls remain effective over time (Correct answer)
To document incidents for regulatory reporting purposes only

Correct answer: To detect changes in the risk environment and verify that controls remain effective over time

Continuous risk monitoring ensures that the organization maintains awareness of its risk profile and quickly identifies when new risks emerge or existing controls degrade.

Question 149: Which scenario BEST demonstrates the risk sharing response strategy?

A company purchases cyber insurance to cover breach costs
A company patches vulnerabilities to reduce attack surface
Two companies jointly invest in a shared disaster recovery facility (Correct answer)
A company stops collecting customer data to avoid privacy risk

Correct answer: Two companies jointly invest in a shared disaster recovery facility

Risk sharing distributes risk between two or more parties, such as joint investment in shared infrastructure, reducing each party's individual exposure.

Question 150: During IT risk identification, which asset classification approach is most useful?

Sorting assets by purchase date
Listing assets alphabetically in a spreadsheet
Categorizing assets by their criticality and sensitivity to business operations (Correct answer)
Grouping assets solely by hardware type

Correct answer: Categorizing assets by their criticality and sensitivity to business operations

Classifying assets by criticality and sensitivity helps prioritize which assets require the most rigorous risk identification.

Certified in Risk and Information Systems Control (CRISC)

The CRISC certification validates expertise in identifying and managing enterprise IT risk and implementing and maintaining information systems controls. It is awarded by ISACA and is designed for IT and risk professionals responsible for governance, risk assessment, risk response, and information security management.

150

Questions

240 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds