CRISC Practice Questions & Practice Test

After integrating cybersecurity supply‑chain risk responses into the enterprise risk register, a health‑care organization must maintain ongoing visibility of those responses. Which activity best fulfills the monitoring and reporting requirement described in NIST SP 800-161r1?

• A.Periodically update the CSRR with the cost, status, and effectiveness of each risk response
• B.Shift all monitoring responsibilities to the procurement department without additional oversight
• C.Conduct a one‑time audit of all supplier contracts to verify compliance
• D.Rely solely on suppliers' self‑reported security questionnaires without independent verification

Why: Maintain continuous monitoring of supply‑chain risk responses through regular CSRR updates NIST SP 800-161r1 states that information about selection and projected cost of risk response is used to maintain a composite view, requiring periodic updates of the CSRR. Source: NIST SP 800-161r1

GlobalTech has identified a high‑impact vulnerability in its ERP system. After applying a patch and compensating controls, the risk analyst estimates the residual risk as moderate. What is the most appropriate next step for the risk practitioner?

• A.Recommend immediate acceptance of the residual risk because the inherent risk has been reduced.
• B.Reassess the inherent risk to verify the original estimate before deciding on residual‑risk treatment.
• C.Escalate the residual risk to senior management for a decision on additional controls, referencing the organization’s risk tolerance.
• D.Document the residual risk in the risk register and monitor it for changes, but defer further action until the next assessment cycle.

Why: Determine the correct action when residual risk remains after controls are applied NIST SP 800-39 states that residual risk may remain after security measures are applied and that this risk should be communicated to the decision makers responsible for risk response; if the residual risk is above the organization’s tolerance, senior management must decide whether additional controls are needed. Source: NIST SP 800-39

A public‑sector agency is aligning its ERM program with OMB Circular A‑123. Which statement best reflects the purpose of ERM according to OMB?

• A.To address risks in isolated silos, treating each separately
• B.To view risks as an interrelated portfolio impacting mission
• C.To isolate financial risks within a single dedicated department
• D.To delegate risk decisions primarily to line managers across units

Why: ERM should treat risks as an integrated portfolio that influences mission achievement OMB Circular A‑123 states ERM is an "effective agency‑wide approach…by understanding the combined impact of risks as an interrelated portfolio" Source: NIST SP 800-221

After a merger, two distinct asset registries exist. What is the best initial governance step to achieve a unified asset management system?

• A.Merge the registries and de‑duplicate records immediately
• B.Establish a cross‑functional steering committee to define a unified asset taxonomy
• C.Perform a gap analysis between the two registries to identify missing asset types
• D.Mandate that all future assets be recorded only in the acquiring company’s system

Why: Create governance structure to define consistent asset taxonomy before technical integration NIST SP 800-39 advises that central bodies should establish policies and procedures that coordinate subordinate activities, and a steering committee provides the needed coordination for taxonomy definition. Source: NIST SP 800-39

Acme Corp is adopting a new organization‑wide data‑encryption requirement. As the risk practitioner tasked with establishing the appropriate policy framework, what should be done first?

• A.Create a high‑level program policy that defines the organization’s overall encryption objectives and risk appetite.
• B.Assign ownership and accountability for encryption controls to the IT security manager.
• C.Draft detailed procedures that outline step‑by‑step tasks for system administrators to configure encryption.
• D.Develop a set of technical standards that specify the encryption algorithms and key lengths to be used.

Why: Establish the high‑level program policy before developing standards, procedures, or assigning owners. NIST SP 800-12r1 defines three basic policy types and states that a program‑level policy is created first; standards, guidelines, and procedures are then derived to implement that policy. The first step is therefore a high‑level program policy that sets objectives and risk appetite. Source: NIST SP 800-12r1

Acme Health, a regional healthcare provider, is revising its risk management program. Senior leadership wants the program to align with the organization’s culture, which emphasizes patient safety and data availability. The risk practitioner is tasked with ensuring the program’s risk tolerance is realistic and supported by the culture. What should the risk practitioner do first to align risk tolerance with organizational culture?

• A.Facilitate workshops with senior leaders and staff to identify shared values that influence risk trade‑offs.
• B.Conduct a formal survey of employees to quantify their personal risk attitudes toward data confidentiality.
• C.Draft a new risk tolerance statement based on industry best‑practice benchmarks and circulate it for approval.
• D.Review the organization’s published risk strategy documents and compare them with observed leadership behaviors.

Why: Identify shared organizational values before defining risk tolerance NIST SP 800-39 explains that senior leaders set risk tolerance through both formal guidance and informal actions, and that understanding existing organizational values and priorities is essential. Facilitating workshops to surface shared values directly addresses this need, ensuring the risk tolerance reflects the culture before any formal statements are created. Source: NIST SP 800-39

A mid‑size manufacturing company has identified a vulnerability that could allow unauthorized access to its production control system. The risk practitioner must align the response with a control framework. What should the practitioner do first?

• A.Select a preventative control to block the vulnerability
• B.Select a corrective control to remediate any breach
• C.Select a detective control to monitor for exploitation
• D.Conduct a control gap analysis against a recognized framework

Why: Identify the initial step of aligning controls with a framework before choosing control types NIST SP 800-221 emphasizes that people, processes, and technology combine to provide risk management controls and that selecting appropriate controls requires first analyzing gaps against a control baseline or framework. Conducting a control gap analysis ensures the chosen control type (preventive, detective, etc.) is aligned with the organization’s framework and risk tolerance. Source: NIST SP 800-221

SecureBank, a regional bank, has identified a critical vulnerability in its online‑banking platform and must choose a response. According to NIST guidance, who is ultimately accountable for selecting and assigning the risk response?

• A.The Chief Information Security Officer who designs controls
• B.The enterprise Risk Executive overseeing the ERM program
• C.The Authorizing Official who approves risk decisions
• D.The System Owner who operates the platform

Why: Assign accountability for risk‑response decisions to the designated risk owner, not to the operational manager NIST IR 8286 states that the risk owner is accountable for applying priorities to select and assign risk responses, and it distinguishes accountability from responsibility – often assigning accountability to an Authorizing Official. Source: NIST IR 8286