ISACA CRISC — Certified in Risk and Information Systems Control

Question 1

A mid-sized financial services firm has just acquired a smaller fintech company that operated with an informal, spreadsheet-based approach to risk tracking. The acquiring firm uses a mature enterprise risk management (ERM) program aligned to a formal framework. The board wants the acquired entity's risks reflected in enterprise reporting within one quarter. As the risk practitioner leading integration, what should be your FIRST priority?

Accepted Answer

Assess whether the acquired entity's business objectives, processes, and risk context can be mapped to the parent firm's ERM framework and risk taxonomy

Answer

Immediately migrate the acquired entity's spreadsheets into the parent firm's GRC tool to consolidate data

Answer

Require the acquired entity to immediately adopt the parent firm's risk appetite statement without modification

Answer

Schedule external penetration testing of the acquired entity's systems to identify technical vulnerabilities

Question 2

A manufacturing company recently redesigned its procurement process to speed up vendor onboarding, allowing purchasing managers to approve new suppliers within hours. Six months later, the risk practitioner notices that several onboarded vendors were never screened for sanctions-list or conflict-of-interest issues, though the corporate policy still requires such screening. What is the MOST significant governance concern the risk practitioner should raise?

Accepted Answer

The redesigned business process was implemented without aligning it to existing policy requirements and embedded control objectives

Answer

The purchasing managers were given approval authority that exceeds industry benchmarks for onboarding speed

Answer

The procurement policy should be rewritten to remove the sanctions-list screening requirement to match the new process

Answer

The vendors that were onboarded should be immediately terminated to eliminate the residual risk

Question 3

A newly appointed CRISC-certified risk practitioner reviews the enterprise risk register and finds that many identified risks are documented in technical terms with no reference to how they could affect the organization's stated growth and market-expansion strategy. Senior management complains that risk reports are not useful for decision-making. What should the practitioner do FIRST to address this concern?

Accepted Answer

Map identified risks to the organization's strategic goals and objectives so their potential business impact is clearly expressed

Answer

Escalate the poorly written risk entries to the internal audit function for corrective action

Answer

Increase the frequency of risk register updates to ensure management receives more current information

Answer

Replace the qualitative risk descriptions with quantitative loss estimates for every entry

Question 4

A newly appointed CRISC-certified risk practitioner reviews the information security department's annual goals. The goals emphasize maximizing the number of vulnerabilities patched and increasing firewall rule counts, but make no reference to the enterprise's stated strategic objective of expanding into new digital markets. Which action should the practitioner recommend FIRST to improve governance?

Accepted Answer

Reframe the security department goals so they demonstrably support and enable the enterprise's strategic business objectives

Answer

Increase the vulnerability patching targets to further reduce technical risk exposure

Answer

Require the security team to report firewall rule metrics directly to the board each quarter

Answer

Escalate the misalignment to internal audit for a formal control deficiency finding

Question 5

A risk practitioner is conducting a risk assessment for a customer-facing e-commerce platform. During the initial data-gathering phase, the practitioner discovers that the asset inventory used to scope the assessment only lists production servers and databases, but omits the CI/CD pipeline, cloud storage buckets holding customer data, and third-party payment integration components. What is the GREATEST concern this poses to the validity of the risk assessment?

Accepted Answer

Threats and vulnerabilities affecting unlisted assets will not be identified or analyzed, understating overall risk exposure

Answer

The residual risk calculations will be delayed until control testing is completed

Answer

The qualitative rating scale will need to be converted to a quantitative one

Answer

The business impact analysis will overstate recovery time objectives for listed assets

Question 6

A risk analyst is assessing the likelihood of a targeted intrusion against a customer-facing payment portal. Historical internal incident data is sparse because the organization has never suffered a successful breach of this system. To produce a defensible likelihood estimate for the risk register, which combination of inputs should the analyst rely on MOST?

Accepted Answer

External threat intelligence on threat actor activity plus the exploitability of identified vulnerabilities in the portal

Answer

The board's stated risk appetite and the residual risk targets defined for the payment portal

Answer

The projected financial impact of a breach derived from the business impact analysis

Answer

The number of controls currently documented in the control catalog for the portal

Question 7

A risk practitioner is conducting a business impact analysis (BIA) for an order-processing application. Business owners assert the system is 'mission critical,' but they cannot agree on how severe an outage would be. To produce a defensible prioritization that the steering committee can use to allocate recovery investment, what should the practitioner do FIRST?

Accepted Answer

Quantify the impact of disruption over time by measuring lost revenue, operational costs, and other consequences at defined outage intervals

Answer

Assign a qualitative 'high/medium/low' criticality rating to each business process based on owner opinion

Answer

Define recovery time objectives (RTOs) and recovery point objectives (RPOs) for the application

Answer

Select and implement redundant infrastructure to minimize the likelihood of an outage

Question 8

During a business impact analysis for an order-processing application, the business owner asserts that the application must be recovered within one hour. However, analysis shows that manual workarounds can sustain operations for up to eight hours before customer contractual penalties and irreversible reputational damage begin to accrue. Which value should the risk practitioner use to establish the maximum tolerable downtime (MTD) for this application?

Accepted Answer

Eight hours, because that is the point at which unacceptable business consequences begin

Answer

One hour, because the business owner's stated requirement takes precedence

Answer

Four hours, as a compromise between the stated requirement and the workaround capacity

Answer

Zero hours, because any downtime introduces measurable risk to the business

Question 9

A risk practitioner is supporting a business impact analysis (BIA) for a mid-sized insurer. Two applications are being evaluated: a claims-processing system that generates most revenue but can tolerate up to 24 hours of downtime before material financial loss, and an internal HR portal that has near-zero revenue impact but must be restored within 4 hours to meet a labor regulation. Management wants to use the BIA to prioritize recovery investment. Which factor should MOST influence the recovery time objective (RTO) assigned to each system?

Accepted Answer

The maximum tolerable downtime derived from the operational, financial, and regulatory consequences of each system's outage

Answer

The relative annual revenue each system contributes to the organization

Answer

The replacement cost and current book value of the underlying infrastructure

Answer

The historical frequency of past outages recorded for each system

Question 10

A financial services firm is deploying a smart contract on a public blockchain to automate loan disbursements. During a pre-deployment risk review, a risk practitioner notes that once deployed, the contract code cannot be modified. Which risk implication should the practitioner prioritize when advising the project team?

Accepted Answer

Coding errors or logic flaws in the contract cannot be corrected after deployment, requiring rigorous pre-deployment validation and testing

Answer

Transaction throughput on public blockchains may be too slow for real-time disbursements

Answer

Blockchain nodes may consume excessive electricity, raising sustainability concerns

Answer

The distributed ledger will increase storage costs across the participating nodes

Question 11

A newly appointed CRISC-certified risk manager discovers that the enterprise has a formally approved code of conduct, but employees routinely bypass its requirements around gift acceptance from vendors, and no disciplinary action has ever been taken. Senior leadership acknowledges the code exists but treats it as guidance rather than a binding rule. Which action should the risk manager recommend FIRST to strengthen the organization's risk governance?

Accepted Answer

Establish and communicate consistent enforcement and consequences for code of conduct violations, endorsed by leadership

Answer

Rewrite the code of conduct to include more detailed examples of prohibited gifts

Answer

Deploy a technical monitoring tool to automatically flag vendor interactions

Answer

Remove the gift acceptance clause since it is not being followed in practice

Question 12

A manufacturing company has automated a previously manual invoice-approval business process, introducing a workflow tool that routes approvals electronically. Three months later, an internal audit finds employees are still following the outdated documented standard that references manual sign-offs, creating confusion about who is accountable for approvals. As the risk practitioner, what should you recommend as the MOST appropriate first action to address the governance gap?

Accepted Answer

Update the affected policies, standards, and procedures to reflect the automated process and re-communicate them to staff

Answer

Discipline the employees who continued to use the manual sign-off method after automation

Answer

Revert the workflow tool to manual approvals until documentation is corrected

Answer

Increase the frequency of internal audits over the invoice-approval process

Question 13

An organization is migrating a customer-facing application to a public cloud provider using an Infrastructure-as-a-Service (IaaS) model. During the risk assessment, the risk practitioner notices that the project team assumes the cloud provider will handle all security patching, including the guest operating systems and application layers. Which action should the risk practitioner recommend FIRST to address this concern?

Accepted Answer

Clarify and document the shared responsibility model to define which security tasks belong to the provider versus the organization

Answer

Purchase cyber insurance to cover any breach resulting from unpatched systems

Answer

Require the cloud provider to provide a SOC 2 Type II report before go-live

Answer

Deploy an automated patch management tool across all cloud workloads immediately

Question 14

A multinational retailer processes customer data across several countries. The risk practitioner discovers that a new data-localization law in one country directly conflicts with a data-sharing clause in a signed contract with a global cloud provider, and that the marketing department has continued cross-border transfers to meet campaign deadlines. What should the risk practitioner do FIRST?

Accepted Answer

Escalate the conflict to legal counsel and management to assess the legal, regulatory, and contractual exposure before recommending action

Answer

Instruct the marketing department to immediately halt all cross-border data transfers until the matter is resolved

Answer

Renegotiate the cloud provider contract to remove the data-sharing clause

Answer

Document the finding in the risk register and continue monitoring the transfers

Question 15

A financial services firm outsources its customer data processing to a third-party cloud provider. The contract includes a service-level agreement (SLA) requiring 99.9% availability and specific data-breach notification timelines mandated by the firm's regulator. During a governance review, the risk manager notes that no internal party has been formally assigned to monitor the provider's adherence to these contractual and regulatory obligations. Which action should the risk manager recommend FIRST?

Accepted Answer

Assign a business owner within the firm to be accountable for monitoring the provider's compliance with the SLA and regulatory obligations

Answer

Transfer full accountability for the obligations to the cloud provider through a revised indemnification clause

Answer

Purchase cyber insurance to cover potential losses arising from provider non-compliance

Answer

Require the cloud provider to submit an annual independent audit report to the regulator directly

Question 16

A risk practitioner is reviewing a proposed control to mitigate a data-integrity risk. The annual cost of implementing and operating the control is estimated at $250,000, while the control is expected to reduce annualized loss expectancy from $180,000 to $40,000. Management is eager to proceed because the risk relates to a high-visibility system. What should the risk practitioner recommend?

Accepted Answer

Reject the proposed control and evaluate lower-cost response options, since the control cost exceeds the reduction in expected loss

Answer

Proceed with the control because it addresses a high-visibility system

Answer

Transfer the risk entirely to a third party regardless of cost

Answer

Accept the risk at its current level without further analysis

Question 17

During a risk assessment, an analyst discovers that a critical database server was compromised despite having patch management, access controls, and network segmentation in place. Investigation reveals that the patch management tool had not successfully applied updates for six months because a service account had expired, and no one monitored the tool's job completion status. What should the analyst identify as the most significant control deficiency to document in the risk register?

Accepted Answer

The absence of a monitoring process to verify that the patch management control was operating effectively

Answer

The service account expiration, which directly caused the failed patch deployment

Answer

The lack of additional compensating controls such as a web application firewall

Answer

The failure to segment the database server onto a more isolated network zone

Question 18

During a risk assessment of a payment processing application, a CRISC practitioner discovers that a mandated data encryption control is configured but has been failing silently for three months due to an expired certificate. Management asks how this finding should be reflected in the risk analysis. What is the MOST accurate way to characterize this situation?

Accepted Answer

The residual risk should be treated as equal to the inherent risk for the affected exposure until the control is restored

Answer

The residual risk remains unchanged because the encryption control is documented and formally implemented

Answer

The finding represents a threat event that should be added to the threat landscape rather than affecting residual risk

Answer

The inherent risk should be lowered because compensating monitoring detected the certificate expiration

Question 19

During a review of a newly implemented access-recertification control, a risk analyst confirms that the control was thoughtfully designed to require quarterly manager sign-off on user entitlements. However, over the past two quarters, managers approved recertifications in bulk without reviewing individual entitlements, and several terminated employees retained active access. Which conclusion best describes the state of this control?

Accepted Answer

The control is design-effective but not operating-effective, and remediation should target how the control is executed

Answer

The control is fundamentally flawed and must be redesigned from scratch to remove the manager approval step

Answer

The control is operating-effective because managers are performing the required sign-offs each quarter

Answer

The control should be reclassified as a detective control since it identifies terminated users after the fact

Question 20

During a risk assessment of a payment processing application, an analyst determines the inherent likelihood and impact of fraudulent transactions is very high. After documenting the automated fraud-detection controls, transaction monitoring, and dual-authorization requirements, the assessed likelihood drops significantly. When the analyst updates the risk register, which value should be recorded as the residual risk?

Accepted Answer

The risk level remaining after accounting for the effectiveness of the implemented controls

Answer

The risk level calculated before any controls were considered, to reflect worst-case exposure

Answer

The average of the inherent risk and the target risk defined in the risk appetite statement

Answer

The maximum potential loss regardless of control performance, to remain conservative

Question 21

A risk practitioner is reviewing a remediation action where the IT team reports that a new privileged-access monitoring control has been fully deployed to close a high-rated finding. The finding owner has requested that the corresponding risk register entry be updated to 'closed.' Before agreeing to close the entry, what is the MOST important action the practitioner should take?

Accepted Answer

Verify through independent testing that the control is operating effectively as designed

Answer

Confirm that the control was implemented within the approved budget and timeline

Answer

Update the residual risk score to reflect the finding owner's assessment

Answer

Obtain sign-off from the IT team that deployment is complete

Question 22

A financial services firm processes thousands of high-value wire transfers daily. Management is concerned that a manual quarterly review of transactions exceeding approval thresholds is failing to catch unauthorized transfers before funds leave the organization. The risk practitioner is asked to recommend an improvement to the monitoring approach. Which recommendation BEST addresses management's concern?

Accepted Answer

Implement an automated detective control that flags threshold breaches in real time for immediate investigation

Answer

Increase the frequency of the manual review from quarterly to monthly

Answer

Add a second reviewer to the existing quarterly manual review process

Answer

Transfer the risk of unauthorized wires to the firm's cyber-insurance policy

Question 23

A financial institution processes thousands of high-value wire transfers daily. The risk practitioner is designing a monitoring approach for the fraud-detection control governing these transfers. Given the transaction volume and the potential for large, rapid financial loss from a single fraudulent transfer, which monitoring approach should the practitioner recommend?

Accepted Answer

Continuous automated monitoring with real-time alerting on anomalous transactions

Answer

Quarterly control self-assessments completed by the wire-transfer operations team

Answer

An annual independent audit of a statistical sample of wire transfers

Answer

Monthly management review of aggregated transfer volume reports

Question 24

During quarterly control monitoring, a risk analyst notices that the same access-provisioning control has generated approved exceptions in each of the last four quarters, always for the same business unit citing 'urgent operational need.' Each exception was individually approved within policy and expired on schedule. What should the analyst do FIRST?

Accepted Answer

Escalate the recurring exception pattern for analysis, as it may indicate the control is not aligned with legitimate business needs

Answer

Continue approving future exceptions since each has followed the established policy and expired on time

Answer

Immediately recommend removing the access-provisioning control because it is repeatedly bypassed

Answer

Report the business unit to internal audit for chronic non-compliance with the control

Question 25

A risk manager is designing a monitoring program for a payment processing system that has more than 40 documented controls. Resource constraints prevent continuous monitoring of every control. To provide the most meaningful assurance to management with limited resources, which approach should the risk manager prioritize?

Accepted Answer

Monitor the key controls that most directly mitigate the highest-rated risks to the payment process

Answer

Monitor an equal sample of controls from every process area to ensure balanced coverage

Answer

Monitor the controls that are least expensive and quickest to test each cycle

Answer

Monitor only the controls that failed during the most recent internal audit

Question 26

During a risk response review, a newly appointed control owner for a data-loss-prevention (DLP) system tells the risk committee that because the control is operating effectively, the associated data-leakage risk is now fully 'owned and closed' by their team. The risk manager wants to correct the misunderstanding before it is documented in the risk register. Which statement best clarifies the accountability relationship the risk manager should communicate?

Accepted Answer

The control owner is accountable for the operating effectiveness of the DLP control, while the risk owner remains accountable for the residual data-leakage risk and its acceptance.

Answer

Once a control is operating effectively, accountability for the residual risk transfers entirely to the control owner who manages that control.

Answer

The risk owner is accountable for both the risk and the day-to-day operation of the control, so the control owner role is advisory only.

Answer

Because the risk is mitigated by an effective control, no residual risk remains and neither party retains ongoing accountability.

Question 27

A newly implemented data loss prevention (DLP) control was deployed by the security engineering team to reduce the risk of confidential customer data leaving the organization. During a post-implementation review, the risk practitioner notes that no one has been formally designated as responsible for the ongoing operation, tuning, and monitoring of the DLP control. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Assign a control owner who is accountable for the ongoing operation and effectiveness of the DLP control

Answer

Escalate the gap to internal audit for inclusion in the next audit cycle

Answer

Add the DLP control to the risk register as a new emerging risk

Answer

Recommend decommissioning the DLP control until governance is clarified

Question 28

A financial services firm has identified a risk that employees may fraudulently alter payment amounts in the accounts payable system. Management wants to select a control response. The organization already has manual monthly reconciliations that catch discrepancies after payments are made, but losses have already occurred by that point. Which control approach should the risk practitioner recommend to most effectively reduce the likelihood of this risk materializing?

Accepted Answer

Implement system-enforced segregation of duties and approval workflows that prevent unauthorized changes before payment execution

Answer

Increase the frequency of the manual reconciliations from monthly to weekly

Answer

Purchase a fidelity insurance policy to cover losses from employee fraud

Answer

Add an after-the-fact audit log review performed quarterly by internal audit

Question 29

A risk manager wants to increase business unit engagement in control monitoring while reducing reliance on periodic internal audit reviews. Operational managers currently view control assessment as a compliance burden imposed by others. Which approach would BEST address this situation?

Accepted Answer

Implement a control self-assessment (CSA) program in which process owners periodically evaluate the design and operation of their own controls

Answer

Increase the frequency of independent internal audit engagements across all business units

Answer

Centralize all control testing within the second-line risk function to ensure consistency

Answer

Require each business unit to outsource its control testing to an external assurance provider

Question 30

A risk practitioner is designing the ongoing monitoring plan for a portfolio of internal controls. Management wants an efficient approach that focuses testing effort where it matters most. Which factor should PRIMARILY determine how frequently each control is tested?

Accepted Answer

The criticality of the risk the control addresses and the control's historical failure rate

Answer

The number of staff members involved in operating the control

Answer

The date the control was most recently implemented or modified

Answer

The preference of the control owner regarding audit disruption

Question 31

A risk manager is preparing a consolidated enterprise risk report for the board by combining risk data submitted independently by five business units. Each unit uses its own 1-to-5 scoring scale, but the definitions of what constitutes a '4' or '5' differ significantly between units (e.g., one unit defines '5' as a $1M loss while another defines it as a $10M loss). What should the risk manager do FIRST before aggregating the data?

Accepted Answer

Normalize the data by mapping each unit's scores to a common, consistently defined impact and likelihood scale

Answer

Sum the raw scores from all units to produce a total enterprise risk exposure figure

Answer

Present each business unit's scores separately without aggregation to preserve their original context

Answer

Apply the highest business unit's scoring scale to all units to ensure conservative reporting

Question 32

A financial services firm is rolling out a new data protection program. The security team wants to apply encryption, access restrictions, and retention rules across all repositories. However, they find that data across shared drives, databases, and cloud storage is treated uniformly, making it unclear which datasets warrant the strongest safeguards. What should the risk practitioner recommend the organization establish FIRST to guide the assignment of protection controls?

Accepted Answer

A data classification scheme that categorizes information by sensitivity and business value

Answer

A data loss prevention (DLP) tool deployed across all endpoints and gateways

Answer

An encryption standard mandating AES-256 for all stored and transmitted data

Answer

A data retention schedule aligned to regulatory record-keeping requirements

Question 33

A financial services firm retains seven years of transaction data to satisfy regulatory obligations. Most queries touch only the last 90 days, but the entire dataset currently resides on high-performance production storage that is nearing capacity. The risk practitioner is asked to advise on managing this data through its lifecycle. Which recommendation BEST balances cost, performance, and risk?

Accepted Answer

Move data older than 90 days to a lower-cost archival tier while preserving integrity, access controls, and retrievability to meet the retention requirement

Answer

Delete all transaction data older than 90 days to free capacity, since it is rarely queried

Answer

Purchase additional high-performance storage so all seven years remain on production tier for uniform fast access

Answer

Compress the older data in place on production storage and remove the access controls to reduce management overhead

Question 34

A financial services firm is decommissioning several storage arrays that held customer account records subject to retention regulations. The records have exceeded their mandatory retention period and are no longer needed. The IT operations team plans to reformat the drives before sending the equipment to a third-party recycler. As the risk practitioner reviewing the data lifecycle disposal stage, what is your PRIMARY concern with this plan?

Accepted Answer

Reformatting does not guarantee irrecoverable destruction of the data, so a sanitization method appropriate to the media and data sensitivity should be applied and verified

Answer

The recycler should be selected based on the lowest cost to minimize the expense of decommissioning

Answer

The equipment should be retained on-site indefinitely in case the records are needed for future business analytics

Answer

The retention period should be extended to ensure the firm never has to make a disposal decision

Question 35

A development team is building a new customer-facing mobile application that will collect location, contact, and payment data. To align with data protection principles, the privacy officer insists that privacy safeguards be embedded from the earliest design phases rather than added after the product is functional. Which principle is the privacy officer primarily applying?

Accepted Answer

Privacy by design and by default

Answer

Purpose limitation

Answer

Data portability

Answer

Breach notification

Question 36

A multinational retailer plans to transfer customer personal data from its European subsidiary to a cloud analytics platform hosted in a country that the European Commission has NOT deemed to provide an adequate level of data protection. The privacy officer must ensure the transfer is lawful before it begins. Which action should the privacy officer take FIRST to enable this cross-border transfer?

Accepted Answer

Implement Standard Contractual Clauses supplemented by a transfer impact assessment

Answer

Encrypt all data in transit using TLS before it leaves the European subsidiary

Answer

Obtain a signed acknowledgment from the cloud provider accepting all liability

Answer

Anonymize a sample of records to demonstrate compliance to the supervisory authority

Question 37

A retail company receives an email from an individual demanding a copy of all personal data the company holds about them, citing their right of access under applicable privacy law. The requester provides only a name and email address. The data protection officer must decide how to proceed before releasing any records. What is the MOST important action to take first?

Accepted Answer

Verify the identity of the requester to a reasonable level of assurance before disclosing any personal data

Answer

Immediately compile and send all records to meet the statutory response deadline

Answer

Reject the request because it was not submitted on the company's official request form

Answer

Charge the requester a processing fee to cover the cost of gathering the records

Question 38

A marketing team wants to launch a new customer loyalty app. During the design review, the privacy officer notes that the app's registration form requests the customer's date of birth, home address, income bracket, and social media handles, even though the loyalty program only requires an email address and purchase history to function. Which data privacy principle should the privacy officer cite to challenge the current design?

Accepted Answer

Data minimization — collect only the personal data necessary for the specified purpose

Answer

Purpose limitation — ensure the data is used only for the reason it was collected

Answer

Storage limitation — retain personal data only as long as necessary

Answer

Integrity and confidentiality — protect personal data against unauthorized access

Question 39

An organization's data retention schedule mandates that customer transaction records be automatically purged after seven years. Litigation has just commenced involving one customer segment, and outside counsel has issued a legal hold notice covering those records. The automated purge routine is scheduled to run next week. What should the risk practitioner recommend FIRST?

Accepted Answer

Suspend the automated purge for the records subject to the legal hold before the routine executes

Answer

Proceed with the scheduled purge because the retention policy takes precedence over the litigation

Answer

Extend the retention period for all customer transaction records enterprise-wide

Answer

Archive all purged records to offline media so they can be restored if needed

Question 40

A risk analyst must estimate the likelihood and impact of a rare but severe supply-chain disruption for which the organization has no historical loss data. Management wants to avoid the situation where a single dominant senior executive skews the group's estimates during a live workshop. Which risk analysis approach BEST addresses this concern?

Accepted Answer

Use the Delphi technique, gathering anonymous expert input across multiple rounds with controlled feedback

Answer

Conduct a facilitated brainstorming session where all participants openly debate until they reach consensus

Answer

Apply a Monte Carlo simulation using the executive's single best-estimate figures as inputs

Answer

Calculate the annualized loss expectancy using industry-average exposure factors

Question 41

A financial services organization maintains nightly encrypted backups of its core banking database, replicated to an off-site facility. During an annual audit, the risk manager notes that the backups have never actually been restored to verify usability; the team relies solely on the backup software's success logs. Which action should the risk manager recommend FIRST to address this concern?

Accepted Answer

Perform a periodic restoration test of the backups to confirm data integrity and recoverability

Answer

Increase the backup frequency from nightly to hourly to reduce potential data loss

Answer

Add a second off-site replication target to improve backup redundancy

Answer

Require the backup software vendor to provide a certification of log reliability

Question 42

A financial services firm's business impact analysis established a two-hour recovery time objective (RTO) for its core transaction processing platform. The firm is designing its disaster recovery strategy and comparing recovery site options against cost. Which recovery site option is MOST appropriate to meet the stated RTO?

Accepted Answer

A hot site with fully configured hardware, current software, and near-real-time data replication

Answer

A warm site with pre-installed hardware requiring software configuration and data restoration from backups

Answer

A cold site providing power, cooling, and space where equipment can be installed when needed

Answer

A reciprocal agreement with a peer institution to share processing capacity during an outage

Question 43

A financial services firm completes a business impact analysis for its transaction processing system. Business owners state that, following a disruption, the firm can tolerate losing no more than 15 minutes of transaction data before regulatory and reconciliation problems become unacceptable. The current backup schedule captures full snapshots every 4 hours. Which action should the risk practitioner recommend to align the recovery strategy with this requirement?

Accepted Answer

Implement more frequent data replication (such as near-continuous or synchronous replication) to meet the 15-minute recovery point objective (RPO)

Answer

Reduce the recovery time objective (RTO) so the system can be restored within 15 minutes of an outage

Answer

Increase the maximum tolerable downtime (MTD) to accommodate the existing 4-hour backup window

Answer

Retain the 4-hour backup schedule but store copies at an additional offsite location for redundancy

Question 44

During a regional disaster, a financial services firm activates its disaster recovery plan. The IT operations team is overwhelmed by simultaneous requests to restore dozens of systems. To restore services in a way that minimizes overall business impact, what should MOST guide the sequence in which systems are recovered?

Accepted Answer

The business impact analysis and the criticality/dependency ranking of each system

Answer

The chronological order in which each system originally went offline

Answer

The technical complexity of each system, restoring the simplest first

Answer

The preference of the department heads who submit restoration requests first

Question 45

A financial services firm has documented a disaster recovery plan for its core transaction platform but has never validated it beyond reviewing the written procedures. The risk practitioner wants to recommend a test that provides meaningful assurance that recovery procedures actually work while minimizing the risk of disrupting live production operations. Which testing approach should the practitioner recommend as the next step?

Accepted Answer

A parallel test that restores systems at the recovery site while production continues to run normally

Answer

A full interruption test that shuts down production and fails over entirely to the recovery site

Answer

A checklist review confirming that all recovery documentation is complete and current

Answer

A structured walkthrough where recovery team members verbally discuss their assigned roles

Question 46

A newly appointed CRO discovers that while the enterprise has a documented risk management framework, business unit managers routinely treat risk activities as the sole responsibility of the risk function. Incidents are frequently escalated late because managers do not see risk identification as part of their day-to-day duties. The CRO wants a sustainable governance change to correct this behavior. Which action would MOST effectively address the root cause?

Accepted Answer

Formally integrate risk identification and reporting responsibilities into business unit managers' job descriptions and performance objectives

Answer

Increase the frequency of enterprise-wide risk awareness training sessions

Answer

Expand the central risk function's staffing to monitor business units more closely

Answer

Require the risk function to sign off on all business unit decisions before implementation

Question 47

A risk practitioner learns of an emerging technology risk related to generative AI tools being adopted informally across several business units. The threat is not yet well understood, no loss events have occurred, and the potential impact is highly uncertain. Senior management is pressing for an immediate decision on how to respond. What should the practitioner recommend FIRST?

Accepted Answer

Establish monitoring mechanisms and gather intelligence to better characterize the emerging risk before selecting a response

Answer

Immediately implement a technical control that blocks all generative AI tools across the enterprise

Answer

Formally accept the risk since no loss events have occurred and impact is uncertain

Answer

Transfer the risk to a cyber insurance provider to cover any future AI-related losses

Question 48

An enterprise has deployed a machine-learning model into production to approve consumer credit applications. Six months later, a risk practitioner notices that the model's approval patterns have shifted noticeably compared to its validation baseline, though no code changes were made. Which emerging-technology risk consideration should the practitioner MOST emphasize to management?

Accepted Answer

The model requires ongoing monitoring for drift because changing input data can degrade accuracy and introduce unfair or non-compliant decisions over time

Answer

The model should be retired because machine learning is inherently too unpredictable for regulated credit decisions

Answer

The shift is expected and requires no action as long as the source code and infrastructure remain unchanged

Answer

The development team should add more computing capacity to improve the model's processing speed

Question 49

A risk practitioner reviews an organization where individual business units independently procure and deploy cloud services and applications without central coordination. This has resulted in duplicated tools, inconsistent security configurations, and integration gaps between systems. Which enterprise architecture practice would MOST effectively reduce the underlying risk exposure?

Accepted Answer

Establishing and enforcing a target-state architecture with approved technology standards and a governance review for new deployments

Answer

Requiring each business unit to purchase cyber insurance covering its independently deployed systems

Answer

Increasing the frequency of vulnerability scans across all business unit environments

Answer

Directing internal audit to catalog all existing applications and report findings quarterly

Question 50

A risk practitioner reviews an enterprise's IT estate and finds that several core business applications still run on an unsupported operating system for which the vendor no longer issues security patches. IT operations continues to keep the systems running because migrating them would disrupt production. From a risk management perspective, what is the MOST significant concern the practitioner should raise to leadership?

Accepted Answer

The accumulated technical debt increases exposure to unpatched vulnerabilities that cannot be remediated, elevating the enterprise's risk profile beyond what may be within appetite

Answer

The applications should be immediately decommissioned regardless of business dependency to eliminate the vulnerability

Answer

IT operations lacks a service-level agreement with the operating system vendor for extended support

Answer

The help desk may receive more support tickets as the legacy systems age and degrade

Question 51

A large manufacturing enterprise has grown through several acquisitions, and each business unit selected its own middleware, database platforms, and integration tools. Executives now report that inter-unit data exchange requires costly custom connectors, upgrades are unpredictable, and integrating a newly acquired firm takes over a year. The CIO asks the risk practitioner what enterprise architecture (EA) practice would most directly reduce these recurring integration risks and costs going forward. Which recommendation should the risk practitioner make?

Accepted Answer

Establish and enforce common technology standards and reference architectures across business units

Answer

Increase the disaster recovery testing frequency for each business unit's platforms

Answer

Require each business unit to purchase cyber insurance covering integration failures

Answer

Mandate that all future acquisitions be delayed until a full risk assessment is completed

Question 52

A newly appointed chief risk officer at a mid-sized insurer discovers that risk activities are performed inconsistently across departments, with each unit using its own spreadsheets, terminology, and rating scales. The board asks the CRO to recommend the single most important first step to establish effective enterprise risk management. Which recommendation best addresses the board's request?

Accepted Answer

Adopt a common enterprise risk management framework that provides consistent processes, terminology, and criteria across the organization

Answer

Purchase an integrated GRC software platform to automate all risk data collection immediately

Answer

Require each department to hire a dedicated risk analyst to improve local risk reporting quality

Answer

Instruct internal audit to test the accuracy of every department's existing risk spreadsheets

Question 53

A business unit cannot meet a corporate password-complexity standard because a legacy application does not support it. Management requests that the risk practitioner grant a formal exception so the application can remain in production. What is the MOST important element to include when documenting this exception?

Accepted Answer

A defined expiration date with a scheduled review by the accountable risk owner

Answer

A statement that internal audit has reviewed and approved the deviation

Answer

A calculation of the annualized loss expectancy for the affected application

Answer

A commitment to remove the application from the risk register once the exception is signed

Question 54

A manufacturing company is formalizing its three lines of defense model. During implementation, the head of production operations argues that because the risk management function performs quarterly risk assessments of the production floor, that function should be accountable for ensuring production-line safety controls operate effectively day-to-day. How should the risk practitioner respond to correctly assign responsibility under the three lines of defense model?

Accepted Answer

Operational management owns and operates the safety controls as the first line, while the risk management function provides oversight and facilitation as the second line.

Answer

The risk management function should accept accountability for the day-to-day operation of safety controls because it possesses the specialized risk assessment expertise.

Answer

Internal audit should assume responsibility for operating the safety controls since it independently reviews control effectiveness.

Answer

The board's risk committee should directly operate and monitor the safety controls to ensure enterprise-wide consistency.

Question 55

A newly appointed CRO discovers that risk-related decisions at a manufacturing company are frequently delayed and sometimes reversed. Investigation reveals that both the IT steering committee and the operational risk committee believe they hold final authority over technology risk acceptance, while business unit heads independently accept residual risks without informing either committee. Which action should the CRO prioritize FIRST to address the root cause?

Accepted Answer

Define and formally document risk governance roles, responsibilities, and decision-making authority across the committees and business units

Answer

Merge the IT steering committee and operational risk committee into a single body to eliminate duplication

Answer

Require all residual risk acceptances to be escalated directly to the board for approval

Answer

Implement a GRC tool to log and track all risk acceptance decisions in one place

Question 56

A risk analyst is documenting a new risk in the organization's risk register. The analyst has identified the threat, mapped the affected assets, and now must record the level of risk that would exist assuming NO controls are in place. Which risk value should the analyst record for this field?

Accepted Answer

The inherent risk before considering any mitigating controls

Answer

The residual risk after applying existing mitigating controls

Answer

The risk appetite established by the board for this category

Answer

The target risk the organization intends to achieve after treatment

Question 57

A manufacturing enterprise is deploying thousands of Internet-connected sensors (IoT devices) across its production floor to enable real-time monitoring. Many of these devices ship with limited processing power, cannot run endpoint agents, and receive infrequent firmware updates from the vendor. The risk practitioner is asked to recommend the control that best limits the enterprise's exposure to the compromise of these devices. Which recommendation should the risk practitioner make FIRST?

Accepted Answer

Isolate the IoT devices on a dedicated, segmented network zone with tightly restricted traffic to and from production systems

Answer

Deploy the same endpoint detection and response (EDR) agents used on corporate workstations onto each IoT device

Answer

Require the vendor to provide a SOC 2 Type II report before the devices are connected

Answer

Purchase cyber insurance to transfer the financial impact of an IoT-related breach

Question 58

During a quarterly review, a risk analyst finds that several audit findings from the previous year remain open. The findings were logged in the issue-tracking system, but no remediation progress has been recorded, and the target dates have all passed without any updates or escalation. Which weakness in the organization's issues and findings management process does this MOST directly indicate?

Accepted Answer

Lack of defined ownership and accountability for tracking findings through to closure

Answer

Insufficient use of quantitative risk analysis to prioritize the findings

Answer

Failure to select preventive rather than detective controls for the affected processes

Answer

Absence of a risk appetite statement approved by the board

Question 59

A risk practitioner reviews the IT operations function of a growing e-commerce company. Over the past two quarters, several outages occurred during promotional sales events when transaction volumes spiked well beyond normal levels, causing servers to exhaust memory and CPU. Operations staff report they typically add capacity reactively after performance complaints arise. Which IT operations practice would MOST effectively reduce the recurrence of these availability incidents?

Accepted Answer

Implementing a capacity management process that forecasts demand and provisions resources proactively based on projected workloads

Answer

Establishing a formal incident management process to speed restoration when outages occur

Answer

Requiring a post-incident review after each outage to document lessons learned

Answer

Increasing the frequency of data backups during promotional events

Question 60

A KRI monitoring failed privileged-access login attempts has just crossed its established threshold for the third consecutive week. The metric is owned by the IT security manager, and reporting is automated and accurate. What should the risk practitioner ensure happens FIRST in response to this sustained breach?

Accepted Answer

The predefined escalation and response actions tied to the KRI threshold are triggered and executed

Answer

The KRI threshold is recalibrated upward so the metric stops generating breach alerts

Answer

A new compensating control is designed and deployed to reduce failed login attempts

Answer

The breach is documented in the next quarterly risk report for stakeholder awareness

Question 61

A risk analyst notices that one of the organization's key risk indicators (KRIs) for failed login attempts has been reporting flat, unchanging values for three consecutive months, even though the security operations team has confirmed multiple brute-force incidents during that period. Before presenting the risk dashboard to the risk committee, what should the analyst do FIRST?

Accepted Answer

Verify the integrity and configuration of the data source feeding the KRI to confirm the values are accurate

Answer

Lower the KRI threshold so future incidents are more likely to trigger an alert

Answer

Replace the KRI with a different indicator that shows more variation

Answer

Present the dashboard as-is and note the discrepancy verbally to the committee

Question 62

A risk manager is preparing a monthly dashboard for the operations leadership team. The team wants to understand both whether a critical patch-management control is operating as designed and whether the exposure it addresses is increasing. Which pairing of metrics BEST satisfies both needs on the same dashboard?

Accepted Answer

Percentage of systems patched within SLA (KPI) alongside the number of unpatched systems with known exploited vulnerabilities (KRI)

Answer

Number of patches released by vendors this month and total help-desk tickets logged

Answer

Percentage of systems patched within SLA and average time to close help-desk tickets

Answer

Number of unpatched systems with known exploited vulnerabilities and count of change requests submitted

Question 63

A risk manager is designing key risk indicators (KRIs) for the organization's patch management process. The goal is to give management advance warning so they can act before an incident occurs. Which of the following candidate metrics would be the MOST effective KRI for this purpose?

Accepted Answer

The percentage of critical systems exceeding the defined patch deployment deadline

Answer

The number of security incidents caused by unpatched systems in the previous quarter

Answer

The total cost of remediation activities completed after the last breach

Answer

The number of positive audit findings closed during the reporting period

Question 64

A risk practitioner monitors a key risk indicator (KRI) for the percentage of privileged accounts without multifactor authentication. The KRI has a warning threshold of 5% and an escalation threshold of 10%. Over the last three monthly reports the value has moved from 3% to 4.2% to 4.9%, remaining below the warning threshold each time. What is the MOST appropriate action for the practitioner to take?

Accepted Answer

Report the upward trend to management and recommend proactive investigation before the threshold is breached

Answer

Take no action because the KRI has not breached the warning threshold

Answer

Immediately lower the warning threshold to 4% so the current value triggers escalation

Answer

Remove the KRI from reporting since it consistently stays within tolerance

Exam domain	Exam weight	Practice
Governance	26%	Practice this topic
Risk Assessment	22%	Practice this topic
Risk Response and Reporting	32%	Practice this topic
Technology and Security	20%	Practice this topic

ISACA CRISC — Certified in Risk and Information Systems Control (CRISC) practice exam & study guide

Start studying CRISC

All CRISC study resources

CRISC exam domains

Sample CRISC questions

Key CRISC terms

CRISC frequently asked questions

Governance (26%)

Risk Assessment (22%)

Risk Response and Reporting (32%)

Technology and Security (20%)