CRISC Exam Questions

Which of the following BEST enables a risk practitioner to identify the consequences of losing critical resources due to a disaster?

Which of the following BEST enables an organization to address risk associated with technical complexity?

Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?

An organization has identified the need to implement an asset tiering model to establish the appropriate level of impact. Which of the following is the MOST effective risk assessme...

Concerned about system load capabilities during the month-end close process, management requires monitoring of the average time to complete tasks and monthly reporting of the findi...

Within the three lines of defense model, the PRIMARY responsibility for ensuring risk mitigation controls are properly configured belongs with:

A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?

An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack. Which of the following is the MOST effective control to support this polic...

During a post-implementation review for a new system, users voiced concerns about missing functionality. Which of the following is the BEST way for the organization to avoid this s...

An organization is outsourcing a key database to be hosted by an external service provider. Who is BEST suited to assess the impact of potential data loss?

A risk practitioner has been asked to propose a risk acceptance framework for an organization. Which of the following is the MOST important consideration for the risk practitioner...

Which of the following BEST mitigates reputational risk associated with disinformation campaigns against an organization?

Which of the following should a risk practitioner do FIRST to support the implementation of governance around organizational assets within an enterprise risk management (ERM) progr...

Zero Trust architecture is designed and deployed with adherence to which of the following basic tenets?

The risk to an organization's reputation due to a recent cybersecurity breach is PRIMARILY considered to be:

Which of the following is a PRIMARY reason for considering existing controls during initial risk assessment?

Which of the following is the BEST way to prevent the loss of highly sensitive data when disposing of storage media?

Which of the following is MOST important to consider when assessing the likelihood that a recently discovered software vulnerability will be exploited?

A risk practitioner identifies an increasing trend of employees copying company information unrelated to their job functions to USB drives. Which of the following elements of the r...

What would be MOST helpful to ensuring the effective implementation of a new cybersecurity program?

Who is BEST suited to provide information to the risk practitioner about the effectiveness of a technical control associated with an application?

An organization is concerned that a change in its market situation may impact the current level of acceptable risk for senior management. As a result, which of the following is MOS...

Which of the following BEST prevents control gaps in the Zero Trust model when implementing in the environment?

Which of the following should be the PRIMARY driver for the prioritization of risk responses?

Which of the following provides the BEST evidence that robust risk management practices are in place within an organization?

Which of the following stakeholders define risk tolerance for an enterprise?

A risk register BEST facilitates which of the following risk management functions?

Which of the following is the GREATEST risk of relying on artificial intelligence (Al) within heuristic security systems?

When a risk practitioner is building a key risk indicator (KRI) from aggregated data, it is CRITICAL that the data is derived from:

Which of the following techniques is MOST helpful when quantifying the potential loss impact of cyber risk?

Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?

Which of the following is the MOST useful information for prioritizing risk mitigation?

A key performance indicator (KPI) shows that a process is operating inefficiently, even though no control issues were noted during the most recent risk assessment. Which of the fol...

Senior management has requested more information regarding the risk associated with introducing a new application into the environment. Which of the following should be done FIRST?

An organization's board of directors is concerned about recent data breaches in the news and wants to assess its exposure to similar scenarios. Which of the following is the BEST c...

Which of the following is the MOST reliable validation of a new control?

A penetration testing team discovered an ineffectively designed access control. Who is responsible for ensuring the control design gap is remediated?

Which of the following information is MOST useful to a risk practitioner for developing IT risk scenarios?

Which of the following is the MOST important consideration when selecting digital signature software?

Which of the following BEST helps to mitigate risk associated with excessive access by authorized users?

Warning banners on login screens for laptops provided by an organization to its employees are an example of which type of control?

Which of the following is the GREATEST risk associated with inappropriate classification of data?

Which of the following events is MOST likely to trigger the need to conduct a risk assessment?

Which of the following is the MOST important for an organization to have in place to ensure IT asset protection?

Which of the following is the PRIMARY purpose for ensuring senior management understands the organization's risk universe in relation to the IT risk management program?

Which of the following BEST indicates the effective implementation of a risk treatment plan?

Which of the following is the MOST essential characteristic of a good IT risk scenario?

An organization has committed to a business initiative with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner's...

Which of the following is MOST important for a risk practitioner to confirm once a risk action plan has been completed?

When assessing the maturity level of an organization's risk management framework, which of the following should be of GREATEST concern to a risk practitioner?