ISACA CRISC Practice Test

Answer choices

1. A. Implement immediate vendor termination and transition to a new provider, disrupting payment services and incurring substantial costs.
2. B. Accept the risk and continue operations, relying on the vendor’s existing security posture.
3. C. Develop a treatment plan with the vendor to enhance security controls and monitor their effectiveness.
4. D. Escalate the issue to the board of directors for immediate legal action.

Wrong-answer review

• A. Implement immediate vendor termination and transition to a new provider, disrupting payment services and incurring substantial costs.: Immediate termination is a drastic measure that would disrupt payment processing and incur significant costs, and should only be considered after other options have been exhausted. A collaborative approach is preferred initially.
• B. Accept the risk and continue operations, relying on the vendor’s existing security posture.: Accepting the risk is irresponsible given the known vulnerabilities and potential for significant financial and reputational damage. This demonstrates a failure to manage risk effectively.
• D. Escalate the issue to the board of directors for immediate legal action.: Escalating to the board for legal action is premature. It bypasses the opportunity for collaborative remediation and could damage the vendor relationship before attempting to resolve the issue.

Answer choices

1. A. Develop a detailed remediation plan immediately, prioritizing all identified inconsistencies.
2. B. Escalate the issue to senior management for immediate resolution, bypassing the risk and control owners.
3. C. Conduct a comprehensive audit of both organizations’ IT systems to identify the root cause of the inconsistencies.
4. D. Collaborate with both risk and control owners to assess the impact and determine the appropriate response strategy.

Answer choices

1. A. Prioritize speed of delivery over thorough risk assessment.
2. B. Implement a waterfall methodology for all system development projects.
3. C. Maintain technology portfolio and project decisions aligned with risk requirements and business value, integrating risk considerations into each sprint.
4. D. Focus solely on reducing technical debt without considering business impact.

Answer choices

1. A. Terminate the highest-cost vendor to reduce concentration risk.
2. B. Create one generic 'vendor risk' entry and apply it to every provider.
3. C. Move vendor risks to a procurement spreadsheet to simplify the enterprise register.
4. D. Assess the material vendor scenarios and update the risk register with ratings, owners, relevant controls, and treatment status so the information can be incorporated into the enterprisewide risk profile.

Answer choices

1. A. Work with leadership and business units to identify cultural drivers that discourage escalation and define actions that reinforce timely, transparent risk reporting.
2. B. Require all employees to retake the annual code-of-conduct course.
3. C. Create an anonymous hotline and make it the primary channel for all operational risk reporting.
4. D. Increase disciplinary penalties for employees who fail to report incidents within one business day.

Answer choices

1. A. Immediately decommissioning the telehealth platform due to potential vulnerabilities.
2. B. Establishing a formal risk acceptance process for all identified risks associated with the platform.
3. C. Conducting a comprehensive security risk assessment of the telehealth platform and its integration.
4. D. Developing and implementing a targeted security awareness training program for all employees accessing the platform.

Answer choices

1. A. Establish a flexible framework that adapts to the company’s evolving risk landscape and incorporates continuous monitoring.
2. B. Implement a rigid, prescriptive risk assessment methodology to ensure standardization.
3. C. Conduct a single, comprehensive risk assessment to capture all potential threats and vulnerabilities.
4. D. Prioritize risk assessments based primarily on the size of the company’s revenue streams.

Answer choices

1. A. Define and validate the accountable risk owner, control owners, decision rights, and escalation path for the identified compliance risk.
2. B. Ask the board to approve every control exception associated with the platform.
3. C. Assign all compliance decisions to the IT operations manager because the platform is technology based.
4. D. Pause the program until an external assessor determines the final control design.

Answer choices

1. A. Immediately migrate all data from the legacy system to the enterprise’s standard EHR platform to consolidate data and improve security.
2. B. Implement a complete system replacement with a modern EHR solution to eliminate all legacy system risks.
3. C. Accept the inherent risks associated with the legacy system and focus on implementing standard security controls after the integration is complete.
4. D. Conduct a comprehensive data assessment, including a risk assessment and gap analysis, to identify vulnerabilities and prioritize remediation efforts, working with the acquired company’s IT team.

Answer choices

1. A. Adopt a zero-trust architecture across the company before updating the threat analysis.
2. B. Increase annual security-awareness training for all employees.
3. C. Refresh the threat model using current actors, events, conditions, and attack paths, and validate the resulting scenarios with relevant risk and control owners.
4. D. Subscribe to a threat-intelligence service and treat its alerts as the organization’s risk assessment.