Certified in Risk and Information Systems Control (CRISC) — Questions and Answers

Question 1: Which statement BEST describes the difference between a preventive and a detective control?

Preventive controls are manual; detective controls are automated
Preventive controls stop incidents before they occur; detective controls identify incidents after they begin (Correct answer)
Preventive controls reduce impact; detective controls reduce likelihood
Preventive controls are more expensive than detective controls

Correct answer: Preventive controls stop incidents before they occur; detective controls identify incidents after they begin

Preventive controls block threats before they cause harm, while detective controls identify when a threat event is occurring or has occurred.

Question 2: What is a risk scenario in the context of CRISC?

A documented description of a threat that could negatively impact business objectives (Correct answer)
A technical vulnerability found during a penetration test
A compliance checklist used by auditors
A financial projection for IT spending

Correct answer: A documented description of a threat that could negatively impact business objectives

A risk scenario describes a threat event, its cause, and its potential impact on IT and business objectives.

Question 3: A compensating control is BEST described as:

An alternative control used when a primary control cannot be implemented (Correct answer)
A control automatically triggered by a monitoring system
A detective control that identifies when a risk has materialized
A control that provides additional layers on top of existing controls

Correct answer: An alternative control used when a primary control cannot be implemented

A compensating control substitutes for a primary control when the primary control is impractical or not feasible to implement in a given context.

Question 4: What is the difference between a general control and an application control?

General controls govern the overall IT environment; application controls are specific to individual systems or processes (Correct answer)
Application controls apply to all systems; general controls apply only to databases
General controls are preventive; application controls are always detective
There is no functional difference between the two types

Correct answer: General controls govern the overall IT environment; application controls are specific to individual systems or processes

General controls (like change management and access administration) apply broadly across the IT environment, while application controls (like input validation) operate within specific applications.

Question 5: Concentration risk in third-party management occurs when:

A single vendor provides services to multiple business units or critical functions (Correct answer)
A vendor concentrates solely on one industry vertical
Multiple vendors compete for the same contract
An organization diversifies across too many vendors

Correct answer: A single vendor provides services to multiple business units or critical functions

Concentration risk arises when over-reliance on a single vendor means their failure could simultaneously disrupt multiple critical organizational functions.

Question 6: Which element of IT risk governance ensures that risk decisions are transparent and auditable?

Deployment of intrusion detection systems
Documentation and record-keeping of risk decisions (Correct answer)
Monthly risk committee meetings
Use of qualitative risk assessment methods

Correct answer: Documentation and record-keeping of risk decisions

Documenting risk decisions creates a transparent audit trail that demonstrates accountability and supports governance review activities.

Question 7: In IT risk assessment, exposure factor (EF) represents:

The annual frequency at which a threat is expected to occur
The total value of all assets at risk
The cost of implementing a compensating control
The percentage of an asset's value lost if a threat event occurs (Correct answer)

Correct answer: The percentage of an asset's value lost if a threat event occurs

The exposure factor is the percentage of an asset's value that would be lost in a single threat event, used to calculate Single Loss Expectancy.

Question 8: Which governance principle requires that those who own risk decisions also bear the consequences of those decisions?

Independence
Transparency
Segregation of duties
Accountability (Correct answer)

Correct answer: Accountability

Accountability in governance means that risk decision-makers are responsible for the outcomes of their decisions, incentivizing sound risk management.

Question 9: Which control design consideration is MOST important for systems handling Personally Identifiable Information (PII)?

Automated backup to geographically dispersed locations
Maximum system uptime and availability
Lowest possible latency for data retrieval
Data minimization and access controls aligned with privacy regulations (Correct answer)

Correct answer: Data minimization and access controls aligned with privacy regulations

PII systems must implement data minimization (collect only what's needed) and strong access controls to comply with privacy regulations like GDPR and CCPA.

Question 10: In a risk governance framework, the risk owner is BEST described as the person who:

Identifies new risks during assessments
Performs the daily monitoring of risk controls
Reports risk metrics to the board
Is accountable for managing the risk to acceptable levels (Correct answer)

Correct answer: Is accountable for managing the risk to acceptable levels

The risk owner is accountable for ensuring a specific risk is managed within acceptable levels and that appropriate controls are in place.

Question 11: Which of the following applications of KRIs is THE MOST crucial?

Providing a backward-looking view on risk events that have occurred
Providing an early warning signal (Correct answer)
Providing an indication of the enterprise's risk appetite and tolerance
Enabling the documentation and analysis of trends

Correct answer: Providing an early warning signal

Key Risk Indicators (KRIs) are crucial because they provide an early warning signal of increasing risk exposure. They are forward-looking metrics designed to help organizations anticipate potential problems before they escalate into actual incidents or losses. This proactive insight allows for timely intervention and risk mitigation, making the early warning signal their most critical application.

Question 12: Which stakeholder group is most critical to engage during IT risk identification?

External auditors exclusively
Business process owners who understand operational dependencies and critical assets (Correct answer)
Only the IT security team
The marketing department

Correct answer: Business process owners who understand operational dependencies and critical assets

Business process owners have the deepest understanding of operational workflows, critical assets, and dependencies, making them essential partners in risk identification.

Question 13: What does 'three lines of defense' refer to in risk management?

Prevention, detection, and response phases of incident management
Firewalls, intrusion detection systems, and endpoint protection
Business operations, risk management/compliance, and internal audit as three distinct layers of oversight (Correct answer)
Physical, logical, and network security controls

Correct answer: Business operations, risk management/compliance, and internal audit as three distinct layers of oversight

The three lines of defense model assigns risk responsibilities to: (1) business operations, (2) risk and compliance functions, and (3) internal audit as independent assurance.

Question 14: A risk appetite statement should PRIMARILY be approved by which organizational body?

IT Steering Committee
Chief Information Officer
Internal Audit Committee
Board of Directors (Correct answer)

Correct answer: Board of Directors

The Board of Directors is ultimately accountable for setting and approving the organization's risk appetite at the highest governance level.

Question 15: Which approach BEST ensures that risk reporting supports informed decision-making by senior management?

Standardizing all reports in a single format for consistency
Tailoring report content and format to the audience's decision-making needs (Correct answer)
Including all identified risks regardless of significance
Providing the most detailed technical data available

Correct answer: Tailoring report content and format to the audience's decision-making needs

Effective risk reporting presents the right information in the right format for each audience so that recipients can make well-informed decisions.

Question 16: Which of the following best describes the concept of risk aggregation in CRISC?

Reducing risk by distributing it across multiple departments
Eliminating risks through redundant controls
Combining multiple smaller risks that together create a significant overall risk (Correct answer)
Documenting risks in a centralized register

Correct answer: Combining multiple smaller risks that together create a significant overall risk

Risk aggregation refers to the process of recognizing how multiple lower-level risks can combine to create a larger, more significant enterprise risk.

Question 17: Which IS control framework is MOST widely used for evaluating and designing controls in IT environments?

COBIT (Correct answer)
SAFe
TOGAF
PMBOK

Correct answer: COBIT

COBIT is the leading framework for IT governance and control design, providing a comprehensive set of processes and control objectives.

Question 18: What is a key output of the IT risk identification process?

A documented inventory of risk scenarios with associated threat sources and potential impacts (Correct answer)
An employee performance review
A quarterly financial report
A list of approved software applications

Correct answer: A documented inventory of risk scenarios with associated threat sources and potential impacts

The primary deliverable of risk identification is a comprehensive inventory of scenarios that describes threats, vulnerabilities, and their potential business impact.

Question 19: What is risk reporting frequency typically based on?

The criticality of the risks being monitored and the requirements of the intended audience (Correct answer)
Only regulatory reporting deadlines
A fixed schedule regardless of risk severity or business context
The availability of the risk management team

Correct answer: The criticality of the risks being monitored and the requirements of the intended audience

Reporting frequency should be proportional to risk severity — critical risks may require daily monitoring while lower-priority risks might only need quarterly reviews.

Question 20: Defense in depth is a control design strategy that involves:

Relying on encryption as the primary protection mechanism
Layering multiple controls so that failure of one does not expose the entire system (Correct answer)
Using automated controls exclusively to eliminate human error
Installing the strongest single control available at the perimeter

Correct answer: Layering multiple controls so that failure of one does not expose the entire system

Defense in depth uses multiple overlapping controls so that if one layer fails, subsequent layers still protect the asset.

Question 21: Which risk assessment technique uses historical data and probability distributions to simulate thousands of possible risk scenarios?

Bowtie analysis
Monte Carlo simulation (Correct answer)
Delphi technique
SWOT analysis

Correct answer: Monte Carlo simulation

Monte Carlo simulation runs large numbers of probabilistic simulations based on historical data to estimate the range of possible risk outcomes.

Question 22: What is the primary purpose of maintaining a risk register?

To log user access attempts to systems
To record software license expiry dates
To document identified risks, their attributes, and status for tracking and communication (Correct answer)
To store backup copies of IT policies

Correct answer: To document identified risks, their attributes, and status for tracking and communication

A risk register is the central repository for recording all identified risks along with their likelihood, impact, owner, and response status.

Question 23: What is the purpose of input validation controls in application systems?

To restrict physical access to server hardware
To encrypt data at rest in the database
To log all user activity for audit trail purposes
To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data (Correct answer)

Correct answer: To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data

Input validation controls check that data conforms to expected format, type, and range before processing, preventing issues like SQL injection, data corruption, and processing errors.

Question 24: Which CRISC domain focuses on ensuring that risk management activities are integrated into the enterprise governance structure?

Risk Response and Reporting
IT Risk Governance (Correct answer)
IT Risk Identification
IT Risk Assessment

Correct answer: IT Risk Governance

The IT Risk Governance domain ensures risk management is embedded in the enterprise governance structure and aligned with business objectives.

Question 25: When classifying vendors by risk tier, which factor is MOST relevant to assigning a vendor to the highest risk tier?

The vendor's geographic headquarters location
The length of the vendor relationship
The volume of sensitive data the vendor accesses or processes (Correct answer)
The number of employees the vendor has

Correct answer: The volume of sensitive data the vendor accesses or processes

Vendors who access or process significant volumes of sensitive or regulated data pose the greatest potential impact in a breach, warranting the highest risk tier.

Question 26: A CRISC practitioner identifies that a KRI has been consistently at its threshold for three months. The BEST response is to:

Remove the KRI from the monitoring program as it is not escalating
Raise the threshold so the KRI no longer appears at the boundary
Treat the elevated KRI as a signal to reassess the underlying risk and controls (Correct answer)
Report the situation in the next annual risk assessment cycle

Correct answer: Treat the elevated KRI as a signal to reassess the underlying risk and controls

A KRI persistently at threshold indicates that the risk environment is stressed, requiring reassessment of whether current controls are sufficient.

Question 27: Which risk assessment approach is MOST appropriate when limited historical data is available?

Qualitative assessment using expert judgment (Correct answer)
Regression analysis
Quantitative assessment using actuarial data
Monte Carlo simulation

Correct answer: Qualitative assessment using expert judgment

Qualitative assessment using expert judgment is most practical when historical data is insufficient for statistical or quantitative analysis.

Question 28: The inherent risk of an IT process is BEST defined as:

The risk remaining after all controls are implemented
The risk level before any controls are applied (Correct answer)
The risk accepted by senior management
The risk transferred to a third party via contract

Correct answer: The risk level before any controls are applied

Inherent risk is the raw, unmitigated risk level of an activity before any controls or countermeasures are taken into account.

Question 29: Which of the following elements will most strongly influence the kind of information security governance model a company chooses to implement?

The enterprise’s budget
The number of employees
The organizational structure (Correct answer)
The type of technology that the enterprise uses

Correct answer: The organizational structure

The organizational structure dictates reporting lines, roles, responsibilities, and decision-making processes within an enterprise. An information security governance model must align with this structure to be effective, ensuring clear accountability, appropriate authority, and seamless integration into existing operational frameworks. It is foundational to how governance is implemented and sustained.

Question 30: Which statement BEST reflects the purpose of a risk committee in IT risk governance?

To provide oversight and strategic direction for risk management activities (Correct answer)
To conduct forensic investigations after security incidents
To implement security controls across the organization
To perform technical vulnerability assessments on IT systems

Correct answer: To provide oversight and strategic direction for risk management activities

A risk committee provides governance-level oversight and sets strategic direction for risk management rather than performing operational activities.

Question 31: Which metric would BEST serve as a KRI for the risk of insider data theft?

Total number of data records in the organization's databases
Number of employees accessing data outside normal business hours (Correct answer)
Average time to complete employee security awareness training
Number of external security incidents reported monthly

Correct answer: Number of employees accessing data outside normal business hours

Unusual access patterns such as off-hours data access are leading indicators of potential insider threat activity and directly correlate to insider theft risk.

Question 32: Which element should be included in a risk exception report submitted to senior management?

Technical details of the vulnerabilities associated with the risk
The risk description, justification for exception, residual risk level, and expiration date (Correct answer)
A comparison of the organization's risk posture to industry benchmarks
A complete list of all accepted risks across the organization

Correct answer: The risk description, justification for exception, residual risk level, and expiration date

A risk exception report must document what the risk is, why the exception is justified, the remaining residual risk, and when the exception will be reviewed or expire.

Question 33: Which principle is MOST critical when integrating IT risk management into corporate governance?

Alignment of IT risk with business objectives (Correct answer)
Separation of IT operations from risk management
Use of automated risk assessment tools
Quarterly reporting of all identified risks

Correct answer: Alignment of IT risk with business objectives

IT risk management must be aligned with business objectives to ensure governance decisions support the organization's overall strategic direction.

Question 34: The principle of least privilege in access control design means that users should be granted:

Read-only access to all organizational data
Only the minimum permissions needed to perform their job functions (Correct answer)
Administrative rights to enable self-service IT tasks
Access to all systems to support business continuity

Correct answer: Only the minimum permissions needed to perform their job functions

Least privilege limits each user's access to only what is required for their role, reducing the attack surface if credentials are compromised.

Question 35: What role does a risk owner play in the IT risk identification process?

Oversees the IT budget allocation
In charge of conducting penetration tests
Accountable for managing a specific risk and ensuring appropriate responses are taken (Correct answer)
Responsible only for documenting risks in the register

Correct answer: Accountable for managing a specific risk and ensuring appropriate responses are taken

A risk owner is accountable for monitoring and managing a specific risk, including ensuring that responses are implemented and effective.

Question 36: During a vendor security incident that affects your organization's data, what is the FIRST step the organization should take?

Issue a public press release about the incident
Wait for the vendor to fully resolve the incident before taking action
Activate the incident response plan and notify relevant internal stakeholders (Correct answer)
Immediately terminate the vendor contract

Correct answer: Activate the incident response plan and notify relevant internal stakeholders

Activating the incident response plan ensures a coordinated, timely response that limits further damage and fulfills regulatory notification obligations.

Question 37: What is the purpose of a configuration management database (CMDB)?

To hold copies of all application source code
To store user credentials for authentication purposes
To maintain a centralized record of all IT assets and their relationships, supporting change and incident management (Correct answer)
To track employee IT training completions

Correct answer: To maintain a centralized record of all IT assets and their relationships, supporting change and incident management

A CMDB provides a comprehensive inventory of IT assets and their interdependencies, enabling better change impact analysis and faster incident resolution.

Question 38: A Key Risk Indicator (KRI) is BEST defined as:

A measure of the financial impact of a past risk event
A benchmark comparing organizational risk to industry peers
A tool for identifying new risks in the environment
A metric that signals increasing risk exposure before an incident occurs (Correct answer)

Correct answer: A metric that signals increasing risk exposure before an incident occurs

KRIs are forward-looking metrics that provide early warning signals of increasing risk, enabling proactive management before losses occur.

Question 39: Which condition indicates that a control monitoring program is INEFFECTIVE?

Control failures are only discovered after security incidents occur (Correct answer)
Control owners review monitoring reports and take corrective action
Automated monitoring tools alert within minutes of a control failure
Control test results are documented and reported quarterly

Correct answer: Control failures are only discovered after security incidents occur

Discovering control failures only after incidents indicates monitoring is reactive rather than proactive, meaning the monitoring program has failed its purpose.

Question 40: Which standard provides a framework specifically for information security requirements in supplier relationships?

ISO 22000 (Food Safety Management)
ISO/IEC 27036 (Information Security for Supplier Relationships) (Correct answer)
ISO 45001 (Occupational Health and Safety)
ISO 14001 (Environmental Management)

Correct answer: ISO/IEC 27036 (Information Security for Supplier Relationships)

ISO/IEC 27036 is specifically designed to address information security risks in supplier and customer relationships, providing guidance on policies, controls, and assessment.

Question 41: During IT risk identification, which asset classification approach is most useful?

Listing assets alphabetically in a spreadsheet
Grouping assets solely by hardware type
Sorting assets by purchase date
Categorizing assets by their criticality and sensitivity to business operations (Correct answer)

Correct answer: Categorizing assets by their criticality and sensitivity to business operations

Classifying assets by criticality and sensitivity helps prioritize which assets require the most rigorous risk identification.

Question 42: Using comparable network technology, an enterprise learns of a security breach at another organization. The MOST crucial thing a risk practitioner should do is:

Remind staff that no similar security breaches have taken place
Assess the likelihood of the incident occurring at the risk practitioner’s enterprise (Correct answer)
Report to senior management that the enterprise is not affected
Discontinue the use of the vulnerable technology

Correct answer: Assess the likelihood of the incident occurring at the risk practitioner’s enterprise

When a similar organization experiences a breach, it serves as a strong indicator of potential vulnerability. The most crucial action for a risk practitioner is to immediately assess if their own enterprise faces a similar likelihood of the incident, given their comparable technology and environment. This proactive assessment helps determine if mitigation actions are needed to prevent a similar occurrence.

Question 43: What is the purpose of data masking in information systems control?

To permanently delete sensitive data after its retention period expires
To replace sensitive data with realistic but fictitious values, protecting confidentiality in non-production environments (Correct answer)
To prevent unauthorized access to physical storage media
To encrypt production data for backup storage

Correct answer: To replace sensitive data with realistic but fictitious values, protecting confidentiality in non-production environments

Data masking protects sensitive information by substituting real values with masked equivalents in test and development environments, preventing exposure of production data.

Question 44: When designing controls for a high-risk IT process, which approach provides the GREATEST assurance?

Relying solely on the most advanced preventive control available
Deploying a single comprehensive control covering all risk scenarios
Using only automated controls to eliminate human error
Implementing both preventive and detective controls in combination (Correct answer)

Correct answer: Implementing both preventive and detective controls in combination

Combining preventive controls (to stop threats) with detective controls (to catch what gets through) provides layered assurance for high-risk processes.

Question 45: The BIGGEST danger associated with not having a strategy is:

improper oversight of IT investment (Correct answer)
increase in the number of licensing violation
increase in the number of obsolete systems
unresolved current and past problems

Correct answer: improper oversight of IT investment

Without a clear strategy, IT investments can become ad-hoc and misaligned with business needs, leading to wasted resources and a lack of accountability. A strategy provides a framework for prioritizing, allocating, and monitoring IT spending to ensure it delivers value and supports organizational goals. Improper oversight of IT investment is a significant danger that arises from this lack of direction.

Question 46: Which risk response is MOST appropriate for a low-likelihood, low-impact risk?

Risk avoidance
Risk mitigation
Risk transfer
Risk acceptance (Correct answer)

Correct answer: Risk acceptance

Low-likelihood, low-impact risks are typically accepted because the cost of mitigation outweighs the potential benefit.

Question 47: Which of the following BEST describes a vendor risk appetite statement?

A list of vendors who have been approved for all risk categories
A description of all risks the organization wishes to transfer to vendors
A budget allocation for vendor risk management activities
A formal declaration of the level and type of third-party risk the organization is willing to accept (Correct answer)

Correct answer: A formal declaration of the level and type of third-party risk the organization is willing to accept

A vendor risk appetite statement formally defines how much and what types of third-party risk the organization will tolerate, guiding vendor selection and management decisions.

Question 48: What is the primary objective of designing information systems controls?

To satisfy external auditor requirements exclusively
To maximize the technical complexity of the security architecture
To achieve zero risk across all IT systems and processes
To reduce risk to an acceptable level while enabling business operations to continue efficiently (Correct answer)

Correct answer: To reduce risk to an acceptable level while enabling business operations to continue efficiently

Controls must balance risk reduction with operational efficiency — overly restrictive controls can impede business processes as much as the risks they are meant to prevent.

Question 49: Which approach to risk mitigation involves redesigning a business process to eliminate a risk entirely?

Risk avoidance through process redesign (Correct answer)
Risk sharing with business partners
Risk acceptance with monitoring
Risk transfer through outsourcing

Correct answer: Risk avoidance through process redesign

Redesigning a process to remove the conditions that create the risk is a form of risk avoidance that eliminates the root cause.

Question 50: When assessing the impact of a risk, a CRISC practitioner should consider which dimension FIRST?

The number of systems affected by the risk
Business impact rather than technical impact (Correct answer)
The cost of the exploited vulnerability patch
The technical severity score from a scanning tool

Correct answer: Business impact rather than technical impact

Business impact (financial, reputational, operational) should be the primary consideration because it directly connects risk to organizational objectives.

Question 51: A risk scenario is MOST useful in risk assessment because it:

Lists all technical vulnerabilities identified by scanning tools
Documents the cost of implementing specific security controls
Defines the organizational risk appetite in measurable terms
Provides a realistic narrative linking threats, vulnerabilities, and business impacts (Correct answer)

Correct answer: Provides a realistic narrative linking threats, vulnerabilities, and business impacts

Risk scenarios connect threat actors, vulnerabilities, and business impacts into a coherent story that helps stakeholders understand and prioritize risks.

Question 52: Which statement about risk acceptance is TRUE?

It eliminates the need to monitor the accepted risk going forward
It means the organization is ignoring the risk without review
It must be a deliberate, documented decision made by an authorized risk owner (Correct answer)
It is only appropriate for risks below a certain dollar threshold

Correct answer: It must be a deliberate, documented decision made by an authorized risk owner

Risk acceptance requires a conscious, documented choice by an authorized person — it is not passive neglect and must be periodically reviewed.

Question 53: An application that generates an audit log of all privileged user actions is implementing which type of control?

Corrective control
Detective control (Correct answer)
Directive control
Preventive control

Correct answer: Detective control

Audit logging is a detective control that creates a record of activities, enabling identification and investigation of unauthorized or suspicious actions.

Question 54: A preventive control that stops a database administrator from accessing production data without a second approver is an example of:

Access logging
Least privilege
Dual control (Correct answer)
Network segmentation

Correct answer: Dual control

Dual control requires two authorized individuals to act together to access sensitive resources, preventing single-person abuse of privileged access.

Question 55: What is the purpose of a control self-assessment (CSA)?

To automatically remediate control deficiencies using AI tools
To replace external audits entirely
To assign blame for security incidents to specific teams
To allow process owners to evaluate the effectiveness of controls over their own activities (Correct answer)

Correct answer: To allow process owners to evaluate the effectiveness of controls over their own activities

CSA empowers process owners to assess whether controls in their area are operating effectively, promoting ownership and often uncovering issues before formal audits.

Question 56: Which risk governance document defines the boundaries within which business units must manage their risk?

Risk policy (Correct answer)
Vulnerability assessment report
Risk register
Business impact analysis

Correct answer: Risk policy

A risk policy establishes the organization's overall approach, boundaries, and mandates for how risk must be managed across all business units.

Question 57: How does a KRI differ from a Key Performance Indicator (KPI)?

KRIs measure past incidents; KPIs predict future risk
KPIs are used only in financial reporting; KRIs apply only to IT systems
Both measure the same thing but use different scales
KRIs indicate potential future risk exposure; KPIs measure current control and process performance (Correct answer)

Correct answer: KRIs indicate potential future risk exposure; KPIs measure current control and process performance

KRIs are predictive, warning of emerging risks, while KPIs are diagnostic, measuring how well current controls and processes are performing.

Question 58: What is the MOST crucial protection that needs to be in place to prevent abuse of the company's social media account?

Awareness training
Social media account monitoring
Two-factor authentication (Correct answer)
Strong passwords

Correct answer: Two-factor authentication

Two-factor authentication (2FA) significantly enhances security by requiring a second verification method beyond just a password. This makes it much harder for unauthorized individuals to gain access to social media accounts, even if they compromise a password, thereby preventing abuse. It's a strong preventative control against unauthorized access and account takeover.

Question 59: Which document typically provides the foundational framework for IT risk identification activities?

Software development lifecycle (SDLC) guide
IT risk management policy (Correct answer)
Incident response playbook
Acceptable use policy

Correct answer: IT risk management policy

The IT risk management policy defines the scope, methodology, roles, and objectives that guide all risk identification activities.

Question 60: When a critical control fails, which response is MOST aligned with CRISC best practices?

Document the failure and schedule repair in the next maintenance window
Shut down the affected system until the control is restored
Immediately activate compensating controls and assess residual risk (Correct answer)
Report the failure to regulators within 24 hours

Correct answer: Immediately activate compensating controls and assess residual risk

When a primary control fails, compensating controls should be activated immediately to maintain protection while assessing and addressing the increased residual risk.

Question 61: A CRISC professional advising on governance would MOST likely recommend that risk reporting frequency to the board be based on:

The volume of incidents reported in the prior period
The availability of the Chief Risk Officer
The significance of risks and organizational risk appetite (Correct answer)
A fixed quarterly schedule regardless of risk environment

Correct answer: The significance of risks and organizational risk appetite

Board reporting frequency should be driven by the materiality of risks and how close the organization is to its risk appetite thresholds.

Question 62: What is the BEST approach for managing vendor risk when a vendor refuses to allow direct audits?

Terminate the vendor immediately regardless of the business relationship
Accept the vendor's word that their controls are adequate
Reduce the contract value to reflect the increased risk
Require the vendor to provide third-party audit reports such as SOC 2 Type II (Correct answer)

Correct answer: Require the vendor to provide third-party audit reports such as SOC 2 Type II

Independent third-party audit reports like SOC 2 Type II provide objective assurance of vendor control effectiveness when direct audits are not permitted.

Question 63: What is change management control, and why is it important in IT risk management?

A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes (Correct answer)
An HR process for managing employee role transitions
A financial process for approving IT budget requests
A method for tracking vendor contract renewals

Correct answer: A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes

Change management controls prevent unauthorized, untested, or poorly planned changes from introducing new vulnerabilities or disruptions to IT systems.

Question 64: Which approach BEST ensures that a risk assessment remains relevant over time?

A one-time comprehensive assessment stored in a risk register
Periodic reassessment triggered by significant changes in the environment (Correct answer)
Annual penetration testing by external consultants
Continuous automated vulnerability scanning of all systems

Correct answer: Periodic reassessment triggered by significant changes in the environment

Risk assessments must be refreshed whenever significant changes occur (new systems, threats, regulations) to remain accurate and actionable.

Question 65: A risk assessment that evaluates risks AFTER controls are applied is measuring:

Control risk
Residual risk (Correct answer)
Detection risk
Inherent risk

Correct answer: Residual risk

Residual risk is the level of risk remaining after controls have been implemented, representing the organization's actual remaining exposure.

Question 66: A control that automatically locks a user account after five failed login attempts is BEST classified as:

Corrective physical control
Preventive technical control (Correct answer)
Detective administrative control
Compensating logical control

Correct answer: Preventive technical control

An account lockout policy is a preventive technical control that automatically blocks brute-force login attempts.

Question 67: What is the purpose of encryption as an information systems control?

To protect data confidentiality by making it unreadable to unauthorized parties, both at rest and in transit (Correct answer)
To prevent unauthorized changes to data
To ensure data is available when needed
To provide an audit trail of who accessed data

Correct answer: To protect data confidentiality by making it unreadable to unauthorized parties, both at rest and in transit

Encryption transforms data into an unreadable format, protecting confidentiality so that even if data is intercepted or accessed without authorization, it cannot be understood.

Question 68: A company's IT risk governance structure is WEAK when which condition exists?

Risk assessments are conducted annually
Risk owners are assigned for each identified risk
Risk decisions are made without senior management involvement (Correct answer)
Risk appetite is documented and communicated

Correct answer: Risk decisions are made without senior management involvement

When risk decisions lack senior management involvement, governance is weak because strategic alignment and accountability are absent.

Question 69: You are in charge of the GHT project. On your project, you've identified a risk event that, if it materializes, might prevent $100,000 in project expenditures. Which of the following best sums up this risky event?

This risk event should be avoided to take full advantage of the potential savings.
This is a risk event that should be accepted because the rewards outweigh the threat to the project.
This risk event should be mitigated to take advantage of the savings.
This risk event is an opportunity for the project and should be exploited. (Correct answer)

Correct answer: This risk event is an opportunity for the project and should be exploited.

A risk event that prevents $100,000 in project expenditures is a positive outcome, as it represents a cost saving. In risk management, positive risks are referred to as opportunities. The appropriate response strategy for an opportunity with significant potential benefit, like this one, is often to 'exploit' it, meaning to take proactive steps to ensure the opportunity materializes and its benefits are fully realized.

Question 70: Which of the following is a key input to the IT risk identification process?

Organizational strategy, objectives, and existing IT asset inventory (Correct answer)
Vendor pricing contracts
Only historical incident logs
External audit reports exclusively

Correct answer: Organizational strategy, objectives, and existing IT asset inventory

Understanding organizational strategy and having an accurate IT asset inventory ensures that risk identification is comprehensive and aligned with business priorities.

Question 71: When aligning IT risk governance with enterprise risk management, the FIRST step is to:

Train IT staff on risk assessment techniques
Create a new IT-specific risk register
Implement automated risk monitoring tools
Understand the enterprise risk management framework already in place (Correct answer)

Correct answer: Understand the enterprise risk management framework already in place

Before aligning IT risk governance, practitioners must first understand the existing ERM framework to ensure consistent language, methodology, and objectives.

Question 72: Which control objective is MOST directly supported by implementing input validation in a web application?

Preventing injection attacks and data integrity violations (Correct answer)
Ensuring data availability during peak traffic periods
Providing non-repudiation for user transactions
Encrypting sensitive data in transit

Correct answer: Preventing injection attacks and data integrity violations

Input validation prevents malicious inputs (e.g., SQL injection, XSS) from compromising data integrity or allowing unauthorized system access.

Question 73: A key logger installed on workstations by an attacker would BEST be detected by which control?

Segregation of duties policy
Data loss prevention (DLP) system
Network perimeter firewall rules
Endpoint detection and response (EDR) software (Correct answer)

Correct answer: Endpoint detection and response (EDR) software

EDR solutions monitor endpoint behavior and can detect unauthorized software such as keyloggers through behavioral analysis.

Question 74: What is the benefit of using automated tools for risk monitoring?

They enable continuous, real-time detection of control failures and risk threshold breaches at scale (Correct answer)
They eliminate the need for a risk register
They replace the need for human judgment in risk management decisions
They guarantee compliance with all applicable regulations

Correct answer: They enable continuous, real-time detection of control failures and risk threshold breaches at scale

Automated monitoring tools can track thousands of data points continuously, providing immediate alerts when conditions indicate elevated risk or control failures.

Question 75: Which CRISC concept refers to the combination of likelihood and impact of a risk?

Risk appetite
Residual risk
Control objective
Risk level (Correct answer)

Correct answer: Risk level

Risk level is the overall measure of a risk derived from its likelihood of occurrence multiplied by its potential impact on the organization.

Question 76: Supply chain risk management in IT focuses primarily on risks from:

Procurement department staffing levels
Internal logistics and warehouse management systems
Hardware manufacturers, software vendors, and service providers across the entire IT supply chain (Correct answer)
Physical transportation of hardware components only

Correct answer: Hardware manufacturers, software vendors, and service providers across the entire IT supply chain

IT supply chain risk encompasses risks from all parties in the chain of hardware, software, and services that ultimately deliver IT capabilities to the organization.

Question 77: Which risk assessment scope consideration is UNIQUE to IT environments compared to general business risk?

Financial impact of operational disruptions
Regulatory compliance requirements
Interdependencies between interconnected systems and platforms (Correct answer)
Reputational impact of risk events on customers

Correct answer: Interdependencies between interconnected systems and platforms

IT risk assessments must uniquely account for cascading failures across interconnected systems, which is more complex than assessing independent business units.

Question 78: In a qualitative risk assessment, risks are PRIMARILY evaluated using:

Descriptive scales such as High, Medium, and Low (Correct answer)
Statistical probability distributions
Return on security investment calculations
Dollar value of potential losses

Correct answer: Descriptive scales such as High, Medium, and Low

Qualitative risk assessment uses descriptive scales rather than numerical values to rate likelihood and impact of risks.

Question 79: An anti-malware system has been installed by an IT company to lower risk. Which of the following statements BEST explains how this control lowers risk, assuming it is operating within the parameters set?

The control reduces the probability and impact of malware on company computers
The control reduces neither probability nor impact of malware on company computers
The control reduces the probability of malware on company computers but does not reduce the impact of those attacks
The control reduces the impact of malware on company computers but does not reduce the probability of those attacks (Correct answer)

Correct answer: The control reduces the impact of malware on company computers but does not reduce the probability of those attacks

An anti-malware system primarily functions to detect and neutralize malware *after* it has attempted to infect a system. While it doesn't prevent the *probability* of an attack attempt (e.g., someone clicking a malicious link), it significantly reduces the *impact* by preventing successful infection, data corruption, or system compromise. Thus, it reduces the impact, not the probability of the initial attack.

Question 80: What is the primary purpose of continuous risk monitoring in CRISC?

To document incidents for regulatory reporting purposes only
To monitor employee compliance with acceptable use policies
To detect changes in the risk environment and verify that controls remain effective over time (Correct answer)
To replace periodic risk assessments entirely

Correct answer: To detect changes in the risk environment and verify that controls remain effective over time

Continuous risk monitoring ensures that the organization maintains awareness of its risk profile and quickly identifies when new risks emerge or existing controls degrade.

Question 81: A security control that limits access to sensitive data based on job function is an example of which type of control?

Compensating technical control
Preventive logical control (Correct answer)
Corrective administrative control
Detective physical control

Correct answer: Preventive logical control

Role-based access control is a preventive logical control that prevents unauthorized access by restricting data access to job-relevant functions.

Question 82: Which metric is MOST useful for evaluating the effectiveness of an IT risk governance framework?

Percentage of risks with assigned owners and response plans (Correct answer)
Total IT budget allocated to risk tools
Number of vulnerabilities identified in the last quarter
Number of employees trained in cybersecurity

Correct answer: Percentage of risks with assigned owners and response plans

Governance effectiveness is best measured by how completely risks are owned and have defined response plans, indicating accountability and readiness.

Question 83: What does a risk dashboard primarily provide to stakeholders?

A complete audit trail of all system changes
A real-time or near-real-time visual summary of the organization's risk posture and KRI status (Correct answer)
Detailed technical vulnerability scan results
Vendor contract performance metrics

Correct answer: A real-time or near-real-time visual summary of the organization's risk posture and KRI status

A risk dashboard aggregates KRIs and risk metrics into a visual format that enables quick understanding of the current risk posture without requiring detailed analysis.

Question 84: A vendor risk scoring model should incorporate which combination of factors?

Contract value, payment history, and vendor size
Geographic proximity, account manager tenure, and pricing model
Inherent risk level, control effectiveness, and residual risk rating (Correct answer)
Vendor age, headquarters location, and number of clients

Correct answer: Inherent risk level, control effectiveness, and residual risk rating

Effective vendor risk scoring combines inherent risk (potential exposure) with control effectiveness to derive residual risk, enabling prioritized oversight and resource allocation.

Question 85: You are in charge of managing a sizable building project. The completion of this project will cost $750,000 and take 18 months. Before the project work starts, you are collaborating with your project team, specialists, and stakeholders to identify project risks. Management is curious as to why you have so many risk identification meetings scheduled throughout the project as opposed to just at the beginning, during project planning. <br> What makes the duplicate risk identification sessions the most effective?

All stakeholders are able to participate in the risk identification processes throughout the project phases thanks to the iterative meetings.
The project manager and the risk identification participants can identify recently found risk events throughout the project thanks to the iterative sessions. (Correct answer)
The iterative meetings give the project manager a chance to discuss impending risks and events as the project is being carried out.
The iterative meetings give the project manager a chance to talk about risk events that have come and gone but did not affect the project.

Correct answer: The project manager and the risk identification participants can identify recently found risk events throughout the project thanks to the iterative sessions.

Risk identification is an iterative and ongoing process throughout a project's lifecycle, not a one-time event. As a project progresses, new risks can emerge, existing risks can change in probability or impact, and previously unidentified risks may become apparent. Iterative meetings ensure the project team continuously monitors the environment and identifies these new or evolving risk events, allowing for timely planning and response.

Question 86: What information should a risk report to senior management typically include?

Only a list of all identified risks without prioritization
Current risk status, changes since last reporting period, KRI trends, and recommendations for action (Correct answer)
Technical details of every vulnerability found during the period
Detailed firewall configuration settings

Correct answer: Current risk status, changes since last reporting period, KRI trends, and recommendations for action

Executive risk reports should summarize the risk landscape in business terms, highlight changes and trends, and provide actionable recommendations.

Question 87: The concept of 'privacy by design' in IS control design means that:

All user data is encrypted at rest and in transit
Privacy policies are displayed on all public-facing web pages
Privacy audits are conducted quarterly by external reviewers
Privacy controls are built into systems from the start rather than added later (Correct answer)

Correct answer: Privacy controls are built into systems from the start rather than added later

Privacy by design embeds privacy protections into system architecture and processes from inception, making privacy an inherent feature rather than an afterthought.

Question 88: After the likelihood of a loss event has been estimated, which of the following criteria should be evaluated?

Magnitude of impact (Correct answer)
Residual risk
Risk tolerance
Compensating controls

Correct answer: Magnitude of impact

Risk is typically calculated as the product of likelihood and impact. Once the likelihood (probability) of a loss event has been estimated, the next logical step in a risk assessment is to determine the potential magnitude of its impact. This allows for a complete understanding of the risk's severity and helps prioritize mitigation efforts.

Question 89: When integrating risk monitoring into IT operations, which approach BEST supports continuous assurance?

Relying on incident reports as the primary source of risk data
Conducting annual third-party IT audits
Requiring manual control reviews by risk managers monthly
Embedding automated control monitoring into operational workflows (Correct answer)

Correct answer: Embedding automated control monitoring into operational workflows

Continuous assurance requires automated monitoring embedded in operations so that control status is constantly evaluated rather than periodically checked.

Question 90: Which IS control objective is addressed by implementing multi-factor authentication (MFA)?

Ensuring only authorized users gain access to systems (Correct answer)
Detecting malware on endpoints
Preventing denial-of-service attacks
Encrypting data stored on servers

Correct answer: Ensuring only authorized users gain access to systems

MFA strengthens authentication by requiring multiple verification factors, ensuring that stolen credentials alone are insufficient for unauthorized access.

Question 91: What is the significance of understanding business objectives when identifying IT risks?

It ensures identified risks are relevant to what the organization is trying to achieve (Correct answer)
It focuses attention solely on technical vulnerabilities
It replaces the need for a risk assessment
It allows the IT team to bypass compliance requirements

Correct answer: It ensures identified risks are relevant to what the organization is trying to achieve

Linking IT risk identification to business objectives ensures that the risks assessed are meaningful and prioritized based on organizational impact.

Question 92: Under the shared responsibility model for cloud services, who is responsible for classifying and protecting customer data stored in the cloud?

A jointly appointed data governance committee
The cloud service provider exclusively
The regulatory authority overseeing the organization
The customer organization (Correct answer)

Correct answer: The customer organization

Under the shared responsibility model, the customer organization retains responsibility for data classification, access control, and data protection even when data resides in the cloud.

Question 93: Which control design principle ensures that no single individual can complete a sensitive transaction without involvement of another person?

Segregation of duties (Correct answer)
Defense in depth
Need to know
Least privilege

Correct answer: Segregation of duties

Segregation of duties divides critical tasks among multiple people, preventing any single person from committing and concealing fraud or error.

Question 94: Which indicator would be MOST helpful in an operational analysis of the processing environment?

Regulatory changes
Management changes
User satisfaction (Correct answer)
Audit findings

Correct answer: User satisfaction

User satisfaction is a key indicator of the effectiveness and efficiency of a processing environment from an operational perspective. High user satisfaction suggests that systems are meeting user needs, are reliable, and are performing as expected, directly reflecting the operational health and usability of the environment. It provides direct feedback on how well the environment supports daily operations.

Question 95: Which control type is designed to reduce the severity of an incident after it has occurred?

Deterrent control
Corrective control (Correct answer)
Detective control
Preventive control

Correct answer: Corrective control

Corrective controls restore systems and processes to normal after an incident, such as disaster recovery procedures, patch management, and incident response plans.

Question 96: The PRIMARY purpose of risk monitoring in the CRISC framework is to:

Identify new vulnerabilities through automated scanning
Detect changes in the risk environment that require updated risk responses (Correct answer)
Provide technical metrics for the IT operations team
Generate compliance reports for external regulators

Correct answer: Detect changes in the risk environment that require updated risk responses

Risk monitoring detects environmental changes — new threats, control failures, or shifting business conditions — that may require updates to risk responses.

Question 97: What is the primary purpose of exception reporting in IT risk management?

To provide a complete inventory of all IT assets
To immediately highlight instances where risk or control metrics fall outside acceptable thresholds (Correct answer)
To document all routine control activities regardless of performance
To satisfy annual compliance reporting requirements

Correct answer: To immediately highlight instances where risk or control metrics fall outside acceptable thresholds

Exception reporting focuses management attention on deviations from expected performance, ensuring that issues requiring action are visible and not buried in routine reports.

Question 98: When conducting a business impact analysis (BIA), which output is MOST directly used in IT risk assessment?

Recovery time objectives and critical process dependencies (Correct answer)
A technical architecture diagram of IT systems
The organization's disaster recovery plan
A list of all software licenses in use

Correct answer: Recovery time objectives and critical process dependencies

RTOs and critical process dependencies from a BIA directly inform which IT risks have the highest business impact, guiding prioritization.

Question 99: Which scenario BEST demonstrates the risk sharing response strategy?

A company purchases cyber insurance to cover breach costs
A company patches vulnerabilities to reduce attack surface
A company stops collecting customer data to avoid privacy risk
Two companies jointly invest in a shared disaster recovery facility (Correct answer)

Correct answer: Two companies jointly invest in a shared disaster recovery facility

Risk sharing distributes risk between two or more parties, such as joint investment in shared infrastructure, reducing each party's individual exposure.

Question 100: Continuous monitoring of third-party vendors is BEST achieved through:

Bi-annual in-person vendor relationship meetings
Monthly billing reviews and invoice reconciliation
Real-time threat intelligence feeds, periodic assessments, and performance metric tracking (Correct answer)
Annual vendor questionnaires sent via email

Correct answer: Real-time threat intelligence feeds, periodic assessments, and performance metric tracking

Continuous monitoring combines real-time intelligence with periodic structured assessments to provide an up-to-date view of vendor risk posture throughout the relationship lifecycle.

Question 101: What is the difference between a vulnerability and a threat in IT risk identification?

A vulnerability is a weakness that can be exploited; a threat is a potential event that could exploit it (Correct answer)
A threat is a weakness; a vulnerability is the probability of exploitation
A vulnerability is always human-caused; a threat is always technical
Both terms are interchangeable in CRISC

Correct answer: A vulnerability is a weakness that can be exploited; a threat is a potential event that could exploit it

A vulnerability is a weakness in a system or process, while a threat is an event or actor that could exploit that weakness to cause harm.

Question 102: Which regulatory framework explicitly requires organizations to assess and manage third-party risks for financial institutions?

PMBOK Guide
FFIEC IT Examination Handbook (Third-Party Relationships) (Correct answer)
ISO 9001
COBIT 2019

Correct answer: FFIEC IT Examination Handbook (Third-Party Relationships)

The FFIEC IT Examination Handbook on Third-Party Relationships provides specific regulatory guidance for financial institutions on managing vendor and third-party risks.

Question 103: A risk dashboard that shows risks trending toward the red zone is MOST useful for which purpose?

Documenting post-incident lessons learned
Justifying the IT security budget to senior management
Triggering proactive risk response before the risk reaches critical levels (Correct answer)
Identifying which employees need additional security training

Correct answer: Triggering proactive risk response before the risk reaches critical levels

A worsening trend visible on a risk dashboard gives risk owners advance warning to act before a risk breaches tolerance thresholds.

Question 104: What is the principle of least privilege in information systems control?

Access should be granted based on seniority rather than job function
Systems should deny all access by default and never grant permissions
All users should have administrative rights to ensure productivity
Users and systems should have only the minimum access rights required to perform their authorized functions (Correct answer)

Correct answer: Users and systems should have only the minimum access rights required to perform their authorized functions

Least privilege limits access to the minimum necessary for each role, reducing the attack surface and limiting the damage that can be caused by compromised accounts or insider threats.

Question 105: COBIT 2019 supports CRISC practitioners PRIMARILY by providing which capability?

A database of known vulnerabilities
A governance and management framework for enterprise IT (Correct answer)
A methodology for software development
A technical standard for network security

Correct answer: A governance and management framework for enterprise IT

COBIT 2019 provides an enterprise IT governance and management framework that aligns IT objectives with business goals and risk management.

Question 106: Which factor should be considered when determining the frequency component of a risk assessment?

The number of IT staff available for response
The vendor's patch release schedule
The organization's annual IT budget
Historical incident data and threat intelligence (Correct answer)

Correct answer: Historical incident data and threat intelligence

Frequency (likelihood) is best estimated using historical incident records and current threat intelligence relevant to the organization's environment.

Question 107: Which formula correctly represents Annualized Loss Expectancy (ALE)?

ALE = SLE + ARO
ALE = SLE × ARO (Correct answer)
ALE = AV × EF + ARO
ALE = ARO / SLE

Correct answer: ALE = SLE × ARO

ALE is calculated by multiplying Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO) to estimate annual risk cost.

Question 108: What is the purpose of a lessons-learned review after a security incident?

To analyze what happened, why controls failed, and how to prevent recurrence (Correct answer)
To satisfy auditor requirements without making actual process changes
To assign legal liability for the incident to specific parties
To document the incident solely for insurance claim purposes

Correct answer: To analyze what happened, why controls failed, and how to prevent recurrence

Lessons-learned reviews close the risk management loop by identifying root causes, control weaknesses, and improvements to prevent the same incident from recurring.

Question 109: Which characteristic distinguishes a mature IT risk governance program from an immature one?

Risk assessments are performed after incidents occur
Risk policies are reviewed every five years
Risk management is proactive and integrated into decision-making (Correct answer)
IT risk is managed solely by the IT department

Correct answer: Risk management is proactive and integrated into decision-making

Mature IT risk governance integrates risk considerations proactively into all business decisions rather than reacting to incidents after the fact.

Question 110: What is the significance of control testing in the SDLC?

Control testing is only necessary after a system has experienced a security incident
Testing controls during development ensures security requirements are met before systems are deployed to production (Correct answer)
Controls should be tested only after the system has been running for at least one year
Testing is the sole responsibility of the quality assurance team, not the risk function

Correct answer: Testing controls during development ensures security requirements are met before systems are deployed to production

Incorporating control testing into the SDLC identifies weaknesses before deployment, when fixes are cheapest and least disruptive, rather than after production rollout.

Question 111: Which control ensures that only tested and approved software is deployed in the production environment?

Separation of development, testing, and production environments (Correct answer)
Using the same credentials across all environments
Full access for developers to the production environment
Allowing direct code deployment without peer review

Correct answer: Separation of development, testing, and production environments

Maintaining separate environments ensures that code is tested in a controlled setting before reaching production, preventing untested changes from causing incidents.

Question 112: What is the concept of 'privacy by design' in information systems control?

Installing privacy software after a system is already deployed
Documenting privacy policies without implementing technical controls
Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later (Correct answer)
Restricting system access to only the privacy officer

Correct answer: Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later

Privacy by design embeds privacy protections into the architecture and processes of systems from the ground up, making privacy a default feature rather than an afterthought.

Question 113: Which activity is MOST important when onboarding a new critical third-party vendor?

Negotiating the lowest possible contract price
Conducting a thorough due diligence risk assessment (Correct answer)
Reviewing the vendor's marketing materials
Assigning an internal project manager to the relationship

Correct answer: Conducting a thorough due diligence risk assessment

Due diligence risk assessment is essential before onboarding critical vendors to identify security, financial, and operational risks they may introduce.

Question 114: Which of the following role holders will determine the enterprise's Key Risk Indicator?

Chief financial officer
Senior management (Correct answer)
Business leaders (Correct answer)
Human resource

Correct answer: Senior management

Business leaders are primarily responsible for determining an enterprise's Key Risk Indicators (KRIs) because they define the strategic objectives and understand the critical risks that could impact business performance. KRIs are directly tied to business goals and risk appetite, which are established and overseen by these leaders. While senior management is broadly involved, business leaders specifically drive the identification of these critical metrics.

Question 115: What is the significance of establishing control thresholds in risk monitoring?

Thresholds are used only for financial controls, not IT controls
Thresholds determine the maximum IT budget for a fiscal year
They eliminate the need for human review of control performance
Thresholds define the acceptable performance range for controls, triggering alerts when breached (Correct answer)

Correct answer: Thresholds define the acceptable performance range for controls, triggering alerts when breached

Control thresholds define the boundary of acceptable performance; when a metric crosses the threshold, it signals that human review and potential escalation are needed.

Question 116: Which statement BEST describes the relationship between risk tolerance and risk appetite?

Risk tolerance and risk appetite are synonymous terms
Risk tolerance is the acceptable deviation from risk appetite (Correct answer)
Risk appetite is determined after risk tolerance is set
Risk tolerance applies only to operational risks

Correct answer: Risk tolerance is the acceptable deviation from risk appetite

Risk tolerance represents the acceptable variation around the risk appetite threshold, allowing flexibility within defined boundaries.

Question 117: A threat-vulnerability pairing is used in risk assessment to determine:

The likelihood that a specific threat will exploit a given vulnerability (Correct answer)
The residual risk after controls are applied
The organizational risk appetite for IT risks
The total cost of implementing a security control

Correct answer: The likelihood that a specific threat will exploit a given vulnerability

Pairing threats with vulnerabilities helps assessors determine the probability that a specific threat source will successfully exploit an existing weakness.

Question 118: Which contract provision gives an organization the RIGHT to examine a vendor's controls and compliance posture?

Limitation of liability clause
Indemnification clause
Right-to-audit clause (Correct answer)
Force majeure clause

Correct answer: Right-to-audit clause

A right-to-audit clause contractually permits the organization to conduct audits or assessments of the vendor's security controls and compliance.

Question 119: Which characteristic distinguishes a HIGH-QUALITY KRI from a poorly designed one?

It captures the largest number of risk events over time
It is measurable, timely, and directly correlated to a specific risk (Correct answer)
It is reported on an annual basis to maintain relevance
It is complex enough to require specialized analysis tools

Correct answer: It is measurable, timely, and directly correlated to a specific risk

Effective KRIs must be quantifiable, available in time to act, and have a proven correlation to the risk they are monitoring.

Question 120: When evaluating risk response options, which economic concept is MOST relevant?

Return on investment for new technology
Cost-benefit analysis (Correct answer)
Net present value of IT assets
Total cost of ownership for security tools

Correct answer: Cost-benefit analysis

Cost-benefit analysis compares the cost of implementing a risk response against the benefit of the risk reduction it provides, guiding optimal decisions.

Question 121: Which control is designed to provide an auditable record of all significant system and user activities?

Audit logging and monitoring (Correct answer)
Capacity management
Network segmentation
Data masking

Correct answer: Audit logging and monitoring

Audit logs record who did what, when, and from where in a system, providing an essential trail for investigations, compliance, and detecting unauthorized activity.

Question 122: Which of the following indicates a control deficiency that requires immediate escalation?

A low-priority system does not have a documented backup procedure
An internal policy has not been reviewed within the past 24 months
A critical control has failed and the resulting risk now exceeds the organization's risk tolerance (Correct answer)
A non-critical application lacks multi-factor authentication

Correct answer: A critical control has failed and the resulting risk now exceeds the organization's risk tolerance

When a failed control causes risk to exceed tolerance, immediate escalation is required because the organization is operating outside its acceptable risk boundaries.

Question 123: Risk scenarios in CRISC are aligned with COBIT process goals PRIMARILY to:

Ensure IT risks are mapped to business processes and objectives (Correct answer)
Establish IT budgeting and resource allocation priorities
Define specific penetration testing methodologies
Provide technical vulnerability identification criteria

Correct answer: Ensure IT risks are mapped to business processes and objectives

Aligning risk scenarios with COBIT process goals ensures that IT risks are evaluated in terms of their impact on business processes and strategic objectives.

Question 124: What is the primary goal of business continuity planning (BCP) as an information systems control?

To conduct regular security awareness training for employees
To prevent all possible disruptive events from occurring
To document all IT policies for regulatory review
To ensure critical business processes and IT systems can continue operating or recover quickly after a disruption (Correct answer)

Correct answer: To ensure critical business processes and IT systems can continue operating or recover quickly after a disruption

BCP establishes procedures and capabilities to maintain or rapidly restore critical business functions following a disruption, minimizing operational and financial impact.

Question 125: A vendor risk register should PRIMARILY contain:

A list of vendors ranked by contract value
Marketing contact information for each vendor
Identified risks associated with each vendor, their likelihood, impact, and mitigating controls (Correct answer)
A record of all vendor invoices and payment history

Correct answer: Identified risks associated with each vendor, their likelihood, impact, and mitigating controls

A vendor risk register documents risks per vendor alongside risk ratings and controls, enabling systematic tracking and management of third-party risk exposure.

Question 126: What is the purpose of a threat landscape analysis in CRISC risk identification?

To design technical controls for known vulnerabilities
To audit user access privileges
To create a disaster recovery plan
To understand current and emerging threats relevant to the organization's industry and environment (Correct answer)

Correct answer: To understand current and emerging threats relevant to the organization's industry and environment

Threat landscape analysis surveys the external and internal environment to identify the types of threats most likely to affect the organization.

Question 127: The THREE lines of defense model assigns IT risk oversight responsibility to which line?

Second line (risk management function) (Correct answer)
Fourth line (external audit)
First line (operational management)
Third line (internal audit)

Correct answer: Second line (risk management function)

The second line of defense — the risk management function — is responsible for overseeing and monitoring IT risk across the organization.

Question 128: What is the MAIN benefit of including a 'business continuity' requirement in vendor contracts?

It eliminates the need for the organization to maintain its own BCP
It transfers all continuity responsibility to the vendor
It reduces the contract price by sharing risk with the vendor
It ensures the vendor has tested plans to maintain services during disruptions affecting your organization (Correct answer)

Correct answer: It ensures the vendor has tested plans to maintain services during disruptions affecting your organization

Requiring vendors to maintain and test business continuity plans ensures they can sustain service delivery during disruptions, reducing the risk to the organization's own operations.

Question 129: Which element MUST be included in a risk response plan to ensure accountability?

The risk assessment methodology used
Named owner responsible for implementing the response (Correct answer)
A list of all organizational IT assets
A history of past security incidents

Correct answer: Named owner responsible for implementing the response

A risk response plan must identify a specific owner who is responsible and accountable for executing the response within the agreed timeframe.

Question 130: The concept of 'risk-based monitoring' means that monitoring intensity should be:

Greatest for systems that were recently upgraded
Equal across all systems to ensure consistent coverage
Proportional to the significance of the risk being monitored (Correct answer)
Focused exclusively on externally facing systems

Correct answer: Proportional to the significance of the risk being monitored

Risk-based monitoring concentrates resources on higher-risk areas, ensuring that the most significant risks receive the most frequent and rigorous monitoring.

Question 131: When a critical vendor announces it is going out of business, the organization should FIRST:

Wait to see if the vendor finds a buyer before taking action
Immediately notify regulators without assessing impact
Stop all payments to the vendor immediately
Activate contingency or exit plans and identify alternative vendors (Correct answer)

Correct answer: Activate contingency or exit plans and identify alternative vendors

Activating exit and contingency plans ensures business continuity by transitioning to alternative vendors or in-house capabilities before service disruption occurs.

Question 132: Which technique is used to verify that a software application's controls function as designed before deployment to production?

Business continuity drill
Regression testing after deployment
Post-implementation review
User acceptance testing (UAT) (Correct answer)

Correct answer: User acceptance testing (UAT)

UAT verifies that an application's controls and functions meet business requirements and work as designed before the system goes live.

Question 133: Which CRISC domain is primarily responsible for identifying IT risk scenarios that could affect business objectives?

IT Risk Identification (Correct answer)
Risk Response and Mitigation
Risk and Control Monitoring
IT Risk Assessment

Correct answer: IT Risk Identification

The IT Risk Identification domain focuses on recognizing IT risk scenarios linked to business objectives and stakeholder requirements.

Question 134: Which metric is MOST useful for ongoing monitoring of a vendor's security risk posture?

The vendor's employee satisfaction score
The vendor's annual revenue growth rate
Frequency and severity of security incidents reported by the vendor (Correct answer)
The number of years the vendor has been in business

Correct answer: Frequency and severity of security incidents reported by the vendor

Security incident frequency and severity directly reflects the vendor's control effectiveness and their risk to the organization over time.

Question 135: Which metric best indicates the timeliness of risk response actions?

The total number of risks in the risk register
Number of security awareness training completions
Annual IT security budget utilization
Mean Time to Remediate (MTTR) for identified control deficiencies (Correct answer)

Correct answer: Mean Time to Remediate (MTTR) for identified control deficiencies

MTTR measures how long it takes to fix control deficiencies after they are identified, indicating whether the organization is responding to risks in a timely manner.

Question 136: What is the purpose of an IT general control (ITGC) review?

To evaluate the performance of individual business applications
To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems (Correct answer)
To verify user satisfaction with IT services
To conduct a security assessment of external-facing web applications

Correct answer: To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems

ITGC reviews examine controls like change management, access administration, and operations management that underpin all systems and are fundamental to reliable financial and operational reporting.

Question 137: What does the term 'risk universe' mean in CRISC?

The industry standard list of cybersecurity threats
The complete set of risks that an organization could potentially face (Correct answer)
A database of historical incidents
The most critical single risk identified in an assessment

Correct answer: The complete set of risks that an organization could potentially face

The risk universe encompasses all possible risks an organization might face, providing a comprehensive view from which prioritization can occur.

Question 138: Which internationally recognized framework is MOST commonly used to align IT risk governance with enterprise risk management (ERM)?

ISO 9001
COSO ERM (Correct answer)
ITIL v4
PRINCE2

Correct answer: COSO ERM

COSO ERM provides an integrated framework that aligns IT risk management with broader enterprise risk governance objectives.

Question 139: A company decides to discontinue an e-commerce feature because its security risks are too high. This is an example of:

Risk transfer
Risk mitigation
Risk avoidance (Correct answer)
Risk acceptance

Correct answer: Risk avoidance

Risk avoidance eliminates the risk entirely by choosing not to engage in the activity that creates the risk.

Question 140: Which risk assessment output BEST supports prioritization of risk remediation efforts?

An inventory of all IT assets and their owners
A count of total risks per business unit
A list of all identified vulnerabilities by CVE score
A risk heat map showing likelihood vs. impact (Correct answer)

Correct answer: A risk heat map showing likelihood vs. impact

A risk heat map visually plots risks by likelihood and impact, making it easy to prioritize the highest-priority risks for remediation.

Question 141: When designing controls for a third-party vendor relationship, which document BEST defines required security controls?

Vendor's published ISO 27001 certificate
Annual vendor financial audit report
Vendor's internal security policy
Service level agreement with security annexure (Correct answer)

Correct answer: Service level agreement with security annexure

An SLA with a security annexure contractually requires the vendor to meet specific security control standards and allows for enforcement.

Question 142: What is an access control matrix?

A network diagram showing firewall rule configurations
A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination (Correct answer)
A physical keycard reader installed at server room entrances
A list of all user accounts ordered by their access level

Correct answer: A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination

An access control matrix provides a structured view of who or what can access which resources and what actions they are permitted to perform, supporting the principle of least privilege.

Question 143: You are in charge of an HGT project that just completed the final compilation phase. The project customer has approved the completion of the project, and you only need to complete a few administrative closure tasks. There were a number of significant risks in the project that might have destroyed it, but you and your project team discovered some innovative ways to address the risks without compromising the project's expenses or completion schedule. <br> What should you do with the risk reactions you discovered throughout the monitoring and controlling procedure for the project?

Include the responses in the project management plan.
Nothing. The risk responses are included in the project's risk register already.
Include the risk responses in the organization's lessons learned database. (Correct answer)
Include the risk responses in the risk management plan.

Correct answer: Include the risk responses in the organization's lessons learned database.

The project is completing, and innovative risk responses were discovered. These successful strategies represent valuable organizational knowledge that should be captured for future reference. The organization's lessons learned database is the appropriate repository for documenting such insights, ensuring that future projects can benefit from these innovations and avoid similar risks or apply similar successful responses.

Question 144: Which factor is MOST important when selecting between risk mitigation options?

The IT department's preference for specific technologies
Cost-effectiveness relative to the risk reduction achieved (Correct answer)
Availability of vendor-supplied solutions
The speed at which the control can be implemented

Correct answer: Cost-effectiveness relative to the risk reduction achieved

Risk response selection should be driven by whether the cost of the control is justified by the reduction in risk exposure it delivers.

Question 145: When developing a risk governance framework, which element BEST ensures accountability for risk decisions?

Defined RACI matrix for risk roles (Correct answer)
Automated risk monitoring tools
Comprehensive risk register
Regular vulnerability scans

Correct answer: Defined RACI matrix for risk roles

A RACI matrix (Responsible, Accountable, Consulted, Informed) explicitly assigns accountability for each risk-related decision and activity.

Question 146: A threshold breach in a KRI should MOST immediately trigger:

Escalation to the risk owner and review of the associated control (Correct answer)
An external penetration test of related systems
Immediate shutdown of the affected IT system
An update to the annual risk assessment report

Correct answer: Escalation to the risk owner and review of the associated control

When a KRI threshold is breached, the risk owner must be notified immediately to review whether the associated controls need reinforcement or response.

Question 147: Which of the following best describes a threat actor in IT risk identification?

A risk register entry
A software patch that reduces system exposure
A business continuity plan
Any entity that could exploit a vulnerability to cause harm (Correct answer)

Correct answer: Any entity that could exploit a vulnerability to cause harm

A threat actor is any person, group, or system that could exploit vulnerabilities to negatively affect the organization.

Question 148: Which of the following justifications for keeping key risk indicators (KRIs) is the MOST crucial?

Risk reports need to be timely
In order to avoid risk
Complex metrics require fine-tuning
Threats and vulnerabilities change over time (Correct answer)

Correct answer: Threats and vulnerabilities change over time

Key Risk Indicators (KRIs) are crucial because the risk landscape is dynamic; threats, vulnerabilities, and business contexts constantly evolve. Monitoring KRIs allows organizations to detect changes in their risk exposure in real-time or near real-time, enabling proactive adjustments to risk management strategies before incidents occur. This continuous monitoring is essential for adapting to an ever-changing threat environment.

Question 149: What is role-based access control (RBAC), and what risk does it help mitigate?

A system that allows users to self-select their own access permissions
A model that grants all users the same level of access for simplicity
An access control method based solely on user seniority
A model that assigns access rights based on job roles rather than individual users, reducing excessive access risk (Correct answer)

Correct answer: A model that assigns access rights based on job roles rather than individual users, reducing excessive access risk

RBAC assigns permissions to roles rather than individuals, ensuring access aligns with job functions and making it easier to manage and audit permissions at scale.

Question 150: The Delphi technique is MOST useful in risk assessment for which purpose?

Documenting the results of a penetration test
Quantifying the financial impact of risks
Automating the collection of risk metrics
Reaching consensus among experts without groupthink bias (Correct answer)

Correct answer: Reaching consensus among experts without groupthink bias

The Delphi technique uses structured, anonymous rounds of expert input to build consensus on risk assessments while minimizing groupthink.

Certified in Risk and Information Systems Control (CRISC)

The CRISC certification validates expertise in identifying and managing enterprise IT risk and implementing and maintaining information systems controls. It is awarded by ISACA and is designed for IT and risk professionals responsible for governance, risk assessment, risk response, and information security management.

Questions

50 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds