ISACA CRISC Practice Exam

• A. Recommend deferring the launch until a full assessment of the feature is complete
• B. Express the risks in terms of their effect on the launch objectives and expected value Correct answer
• C. List the controls the feature needs so the strategy can budget for them
• D. Benchmark the feature's controls against those of competing payment providers

Option B is correct because a practitioner supports strategy by translating risk into the language of the launch objectives and expected value, so leaders can weigh it against the opportunity. Option A delays the launch without informing the decision, option C is a control list rather than a strategic contribution, and option D is a benchmarking exercise that does not address the enterprise's own objectives.

• A. Provide independent assurance to the board on the risk process
• B. Operate the controls that treat the enterprise's highest-rated risks
• C. Challenge risk reporting and advise executives on exposure against appetite Correct answer
• D. Decide the enterprise risk appetite on behalf of the board

Option C is correct because a cross-functional risk committee is an advisory and challenge body that reviews risk reporting and advises executives on exposure relative to appetite. Option A describes internal audit's independent assurance, option B is a control owner's task, and option D is wrong because the board sets risk appetite.

• A. Have the risk function perform the security reviews that teams skip
• B. Link delivery leaders' incentives to risk objectives as well as schedule targets Correct answer
• C. Require delivery staff to re-sign the code of conduct each year
• D. Name the teams that skip security reviews in the monthly leadership update

Option B is correct because behavior follows incentives, so tying leaders' rewards to risk objectives as well as schedule removes the conflict that drives teams to skip reviews. Option A takes ownership of the control away from the first line, and options C and D are reminders or shaming that leave the underlying incentive unchanged.

• A. Low attendance at the awareness sessions that explain the policy to new hires
• B. A policy review date that is older than the scheduled review cycle
• C. Repeated exception requests for the same requirement across departments Correct answer
• D. A growing number of staff who have not acknowledged the policy

Option C is correct because repeated exception requests for the same requirement across departments show the requirement is not workable in practice, which signals a policy that no longer fits the business. Options A, B and D point to awareness, administrative or compliance weaknesses rather than a mismatch between policy and operations.

• A. Procurement
• B. Deployment
• C. Disposal Correct answer
• D. Maintenance

Option C, Disposal, is correct because data left on devices when they leave the enterprise's control is a failure of secure media sanitization at end of life. Procurement, deployment and maintenance (options A, B and D) occur earlier, while the device is still in the enterprise's hands.

• A. An occurrence that, if it happens, would affect the achievement of objectives Correct answer
• B. A weakness in an asset or control that a threat could exploit
• C. The amount of risk the board is willing to take in pursuit of objectives
• D. A potential cause of harm, such as an attacker or a natural hazard

Option A is correct because a risk event is an occurrence that, if it happens, affects the achievement of objectives. Option B describes a vulnerability, option C describes risk appetite, and option D describes a threat source rather than the event itself.

• A. Raise the likelihood ratings of the external attacker scenarios using current threat intelligence feeds and sector reports
• B. Add accidental, structural and environmental sources, such as administrator error and component failure Correct answer
• C. Add a profile of each external attacker group with its usual tools, techniques and targets
• D. Add a scenario for each vulnerability reported by the latest scanner run across production hosts

Option B is correct because the scenarios cover only deliberate external threats, so completeness requires accidental, structural and environmental sources such as administrator error and component failure. Options A and C refine the external attacker view that already exists, and option D lists vulnerabilities rather than new threat sources.

• A. Support the deferral to the next window, with the owner accepting interim risk and administrator sessions monitored Correct answer
• B. Escalate to the risk committee for a decision, using the base severity score as the measure of exposure
• C. Recommend an emergency patch and restart outside the freeze, overriding the business owner's request for the clearing application
• D. Recommend taking the application off the management network until the freeze ends and the patch is applied

Option A is correct because the application is reachable only by 12 named administrators on a segmented network, which limits exposure to the exploit, so the business owner can accept the interim risk with monitoring in place until the window. Option B relies on a base severity score that ignores those conditions, option C overrides the business for a risk that is already contained, and option D removes access that the administrators need.

• A. Obtain the provider's own risk register and adopt its scenarios in place of the company's, after confirming their scope
• B. Keep the existing scenarios and note that the provider's independent assurance report already covers the changed environment and its controls
• C. Revise the scenarios for new dependencies such as provider outage and tenant data exposure, retiring those no longer valid Correct answer
• D. Lower the likelihood ratings of the existing database administrator misuse and datacenter outage scenarios across the payroll register

Option C is correct because moving to a provider changes the dependencies and exposures, so the scenarios must be revised for provider outage and tenant data exposure while retiring those that no longer apply. Options A and B hand the company's scenario ownership to the provider or its report, and option D lowers likelihood without reassessing the new exposures.

• A. Keep the technical wording and attach scanner findings, patch status and asset owners as likelihood evidence
• B. Restate it as ransomware halting order fulfilment beyond its recovery objective, measured as business loss Correct answer
• C. Split it by server, then rate the likelihood of encryption for each one separately in the register
• D. Replace it with the catalog category 'malware infection' so it matches the organization's existing threat taxonomy

Option B is correct because a scenario should be expressed in terms of business impact against the board's appetite, here fulfilment disruption beyond the recovery objective and monetary loss. Options A and C keep a technical view that cannot be compared with appetite, and option D drops the specific event into a generic category.

• A. Exit the market and wind down the card product Correct answer
• B. Accept the risk in the business with a documented sign-off
• C. Fund a larger compliance function dedicated to that market
• D. Buy insurance against the penalties the compliance failures could bring

Option A is correct because when no affordable control brings the risk within appetite and the activity costs more than it earns, avoidance (exiting the market) is the response that removes the exposure. Accepting it (B) would leave risk above appetite, a larger compliance function (C) is the control that was judged unaffordable, and insurance (D) cannot cover the compliance obligations themselves.

• A. The control owner named in the control description Correct answer
• B. The owner of the chargeback process that uses the screening output
• C. The risk owner for card-fraud risk, who performs the review
• D. The sponsor of the control framework, who sets the review schedule

Option A is correct because the control owner is accountable for operating the control as described, so restoring the skipped review sits with them. The risk owner (C) owns the risk and decides on response but does not perform the control, and the owners in B and D do not own this control.

• A. Replace the processor under the contract's exit clause and migrate payroll to a second provider
• B. Treat the drop as a trigger for an out-of-cycle reassessment and update the vendor's risk entry with the result Correct answer
• C. Add the rating to the vendor scorecard presented at the next quarterly service review meeting
• D. Accept the processor's written attestation that the exposed services are now secured and keep the low rating

Option B is correct because a sharp drop in an external rating is a trigger to reassess outside the annual cycle, and the result should update the vendor's risk entry. Replacing the processor (A) is premature before the risk is reassessed, a scorecard line at the next review (C) is too slow, and relying on the vendor's own attestation (D) is unverified evidence.

• A. Rank them by the severity label each source assigned and fix the highest labels
• B. Let the application owner choose the order and report progress each month
• C. Ask each source to restate its findings on the penetration test's rating scale
• D. Log them in one issues list and rate each on a common impact and likelihood scale Correct answer

Option D is correct because findings from different sources can only be compared once they are logged in one list and rated on a common impact and likelihood scale. Option A ranks by incompatible labels, option B leaves prioritization to the owner of the exposed application, and option C forces every source onto one tool's scale that does not fit the others.

• A. COSO Enterprise Risk Management, rated against the organization's strategy and performance
• B. ISO 31000, applied to the financial reporting processes by the risk function
• C. COSO Internal Control - Integrated Framework, assessed against each of its components Correct answer
• D. COBIT 2019, using its governance objectives for the financial reporting systems

Option C is correct because the COSO Internal Control - Integrated Framework is the framework most commonly used for assessing internal control over financial reporting. COSO ERM (A) and ISO 31000 (B) address enterprise risk management, and COBIT 2019 (D) addresses IT governance and management, so none of them is the control framework for this assessment.

• A. Have IT block access to the survey service on the corporate network until formal approval is granted
• B. Ask procurement to complete due diligence on the survey provider's security and privacy terms
• C. Obtain a signed exception from the department head covering use of the service while the review is pending
• D. Find out which customer data and business processes now depend on the survey service Correct answer

Option D is correct because the practitioner's first step is to understand the exposure: which customer data and business processes now depend on the service. Without that, blocking access (A), demanding full due diligence (B) or obtaining an exception (C) are responses sized without knowing the risk, and the exception is also a risk acceptance that belongs to the risk owner.

• A. Recommend executive sign-off for each emergency change to discourage use of the fast path
• B. Set an indicator threshold at the earlier 5% level and report breaches to the board
• C. Analyze the emergency changes by cause and by requester to find what is driving the increase Correct answer
• D. Propose closing the emergency path to application teams until the rate returns to the earlier level

Option C is correct because the rising emergency rate is a symptom, and the practitioner must find its cause before recommending a response. Executive sign-off (A), a lower threshold (B) or closing the path (D) act on the symptom and could push developers toward more workarounds without removing the driver.

• A. Ask problem management to reopen the root cause analysis and look for a quicker fix than waiting for the major release
• B. Quantify the exposure until the release and ask the service owner to decide how to treat it Correct answer
• C. Propose automating the restart procedure and adding a health check that triggers it on failure
• D. Recommend that the service desk keep each incident open until the underlying defect is removed

Option B is correct because the practitioner quantifies the exposure and asks the service owner, who owns the risk, to choose between fixing, interim controls and acceptance. Reopening the analysis (A) repeats completed work, automating restarts (C) hides the failures without treating them, and keeping incidents open (D) misuses incident management for a known problem.

• A. Survey the project stakeholders on how well the delivery process handled risk and what they would change
• B. Compare risks predicted at approval with issues seen after go-live and update the assessment criteria Correct answer
• C. Extend the vendor warranty period for post-go-live defects found on the core system
• D. Repeat the original project risk assessment against the live system and file it with the project record

Option B is correct because comparing predicted risks with what actually materialised after go-live shows where the assessment method was wrong or missing, and that evidence feeds improved criteria. A stakeholder survey (A) captures opinion on delivery, not assessment accuracy, a longer warranty (C) transfers cost but does not improve assessments, and repeating the same assessment (D) does not learn from the outcome.

• A. Rising storage and backup costs for data that no longer serves a business purpose
• B. A larger impact if the data is breached and exposure to regulatory action for excess retention Correct answer
• C. Declining data quality across the older records that customers have not updated
• D. Slower queries and reporting on the systems that hold the oversized data sets during peak periods

Option B is correct because keeping personal data without a purpose enlarges the impact of a breach and breaches storage-limitation and retention obligations. Storage cost (A), data quality (C) and query speed (D) are real but secondary effects compared with legal and breach exposure.