Mixed Deck — All CRISC Topics Flashcards

A risk assessment that evaluates risks AFTER controls are applied is measuring:

Answer: Residual risk

Residual risk is the level of risk remaining after controls have been implemented, representing the organization's actual remaining exposure.

Which metric is MOST useful for ongoing monitoring of a vendor's security risk posture?

Answer: Frequency and severity of security incidents reported by the vendor

Security incident frequency and severity directly reflects the vendor's control effectiveness and their risk to the organization over time.

What is the difference between a general control and an application control?

Answer: General controls govern the overall IT environment; application controls are specific to individual systems or processes

General controls (like change management and access administration) apply broadly across the IT environment, while application controls (like input validation) operate within specific applications.

Which scenario BEST demonstrates the risk sharing response strategy?

Answer: Two companies jointly invest in a shared disaster recovery facility

Risk sharing distributes risk between two or more parties, such as joint investment in shared infrastructure, reducing each party's individual exposure.

An organization terminates its relationship with a cloud vendor. Which action is MOST critical from a risk management perspective?

Answer: Ensuring all organizational data is securely retrieved and deleted from vendor systems

Secure data retrieval and certified deletion prevents residual data exposure, which is the primary risk when offboarding a cloud vendor.

A threshold breach in a KRI should MOST immediately trigger:

Answer: Escalation to the risk owner and review of the associated control

When a KRI threshold is breached, the risk owner must be notified immediately to review whether the associated controls need reinforcement or response.

Which of the following is an example of an internal threat source?

Answer: A disgruntled employee with access to sensitive systems

Internal threat sources originate from within the organization, such as employees, contractors, or insiders with system access.

Which element of IT risk governance ensures that risk decisions are transparent and auditable?

Answer: Documentation and record-keeping of risk decisions

Documenting risk decisions creates a transparent audit trail that demonstrates accountability and supports governance review activities.

What is the purpose of a control self-assessment (CSA)?

Answer: To allow process owners to evaluate the effectiveness of controls over their own activities

CSA empowers process owners to assess whether controls in their area are operating effectively, promoting ownership and often uncovering issues before formal audits.

Which of the following factors should the cost-benefit analysis of a two-factor authentication system contain the MOST?

Answer: The total cost of ownership

A comprehensive cost-benefit analysis for a security system like two-factor authentication must consider the total cost of ownership (TCO). TCO includes not only initial purchase and implementation costs but also ongoing expenses like maintenance, support, training, and potential integration challenges. This holistic view provides a more accurate financial picture and ensures all costs are accounted for.

What is the purpose of a lessons-learned review after a security incident?

Answer: To analyze what happened, why controls failed, and how to prevent recurrence

Lessons-learned reviews close the risk management loop by identifying root causes, control weaknesses, and improvements to prevent the same incident from recurring.

Which element MUST be included in a risk response plan to ensure accountability?

Answer: Named owner responsible for implementing the response

A risk response plan must identify a specific owner who is responsible and accountable for executing the response within the agreed timeframe.

Which factor is MOST important when selecting between risk mitigation options?

Answer: Cost-effectiveness relative to the risk reduction achieved

Risk response selection should be driven by whether the cost of the control is justified by the reduction in risk exposure it delivers.

What is the primary purpose of exception reporting in IT risk management?

Answer: To immediately highlight instances where risk or control metrics fall outside acceptable thresholds

Exception reporting focuses management attention on deviations from expected performance, ensuring that issues requiring action are visible and not buried in routine reports.

When designing controls for a high-risk IT process, which approach provides the GREATEST assurance?

Answer: Implementing both preventive and detective controls in combination

Combining preventive controls (to stop threats) with detective controls (to catch what gets through) provides layered assurance for high-risk processes.

What is role-based access control (RBAC), and what risk does it help mitigate?

Answer: A model that assigns access rights based on job roles rather than individual users, reducing excessive access risk

RBAC assigns permissions to roles rather than individuals, ensuring access aligns with job functions and making it easier to manage and audit permissions at scale.

Which of the following best describes the concept of risk aggregation in CRISC?

Answer: Combining multiple smaller risks that together create a significant overall risk

Risk aggregation refers to the process of recognizing how multiple lower-level risks can combine to create a larger, more significant enterprise risk.

After the likelihood of a loss event has been estimated, which of the following criteria should be evaluated?

Answer: Magnitude of impact

Risk is typically calculated as the product of likelihood and impact. Once the likelihood (probability) of a loss event has been estimated, the next logical step in a risk assessment is to determine the potential magnitude of its impact. This allows for a complete understanding of the risk's severity and helps prioritize mitigation efforts.

What is the purpose of tracking risk trends over time?

Answer: To identify whether risks are increasing, decreasing, or stable so that responses can be adjusted accordingly

Trend analysis reveals the direction risk is moving, enabling proactive adjustments to risk responses before situations deteriorate beyond acceptable thresholds.

You are in charge of the GHT project. On your project, you've identified a risk event that, if it materializes, might prevent $100,000 in project expenditures. Which of the following best sums up this risky event?

Answer: This risk event is an opportunity for the project and should be exploited.

A risk event that prevents $100,000 in project expenditures is a positive outcome, as it represents a cost saving. In risk management, positive risks are referred to as opportunities. The appropriate response strategy for an opportunity with significant potential benefit, like this one, is often to 'exploit' it, meaning to take proactive steps to ensure the opportunity materializes and its benefits are fully realized.