PRMIA CRM Certification Exam Sample Questions

CRM Dumps PDF, Cyber Risk Management Dumps, download Cyber Risk Management free Dumps, PRMIA Cyber Risk Management exam questions, free online Cyber Risk Management exam questionsYou have to pass the CRM exam to receive the certification from PRMIA. To increase the effectiveness of your study and make you familiar with the actual exam pattern, we have prepared this PRMIA Cyber Risk Management sample questions. Our Sample PRMIA Cyber Risk Management Practice Exam will give you more insight about both the type and the difficulty level of the questions on the PRMIA Cyber Risk Management exam.

However, we are strongly recommending practice with our Premium PRMIA Cyber Risk Management (CRM) Practice Exam to achieve the best score in your actual PRMIA CRM Exam. The premium practice exam questions are more comprehensive, exam oriented, scenario-based and exact match of PRMIA Cyber Risk Management exam questions.

PRMIA Cyber Risk Management Sample Questions:

01. A firm is being asked to fund the separation of its trading environment from its general corporate network.
What is the primary risk-reduction argument for that investment?
a) It limits an attacker who gains a foothold elsewhere, so that reaching the trading systems means defeating a further barrier.
b) It reduces the number of systems that must be patched to the trading environment's standard, lowering the operational burden on the technology team.
c) It prevents an attacker from reaching the trading environment, because traffic between the two networks is no longer possible.
d) It allows the firm to apply stronger monitoring to trading activity, because that traffic is no longer mixed with general corporate traffic.
 
02. A monthly report shows that a cyber appetite limit — the number of critical vulnerabilities left unremediated beyond the firm's stated window — has been exceeded for three consecutive months. Each month the technology function has recorded the breach and stated that remediation is in progress.
What does this pattern most strongly indicate?
a) The remediation window in the appetite statement is too short for the firm's estate and the limit should be recalibrated upward.
b) The technology function lacks the capacity to remediate at the required rate, and additional funding or headcount should be allocated to it.
c) The escalation process is working as designed, since the breach has been reported through governance on each occasion.
d) The firm has been operating outside its stated appetite without deciding whether to accept the exposure or to fund the fix.
 
03. An overnight technology fault has degraded a customer-facing service. The incident response team is working on it and expects resolution within hours. Senior management asks whether the crisis management plan should be invoked.
What should determine the answer?
a) Whether the expected resolution time exceeds the impact tolerance set for the affected service.
b) Whether the fault was caused by a malicious act rather than by an internal technology failure.
c) Whether the situation requires decisions or communications beyond the incident team's authority.
d) Whether the incident has been escalated to the board, since the crisis plan operates at board level.
 
04. A firm's critical payments provider informs it that the provider has moved part of its own processing to a specialist sub-contractor.
What should the firm's assessment focus on?
a) Whether the provider obtained the firm's consent before appointing the sub-contractor, which such agreements commonly require.
b) Whether the sub-contractor's failure would disrupt the firm's service, and whether the firm's rights reach through to it.
c) Whether the sub-contractor holds the same certifications as the provider, since the chain is only as strong as its weakest certified link.
d) Whether the move reduces the provider's costs in a way that should be reflected in the fees the firm pays.
 
05. A firm has funding for one significant control improvement. Its assessment shows that its highest exposure is an attacker reaching customer data through a compromised employee account, and that most of its staff work remotely on firm-issued laptops.
Which investment best matches that exposure?
a) Restricting what each account can reach, so a compromised one exposes only the data that role requires.
b) Extending security awareness training, since employee accounts are most often compromised through phishing.
c) Deploying stronger endpoint detection across the laptop estate, so that compromise of a device is identified quickly.
d) Encrypting customer data at rest, so that data obtained through a compromised account cannot be read.
 
06. A provider notifies a firm of a security incident affecting its platform eleven days after the provider detected it. The firm's contract requires notification without undue delay. The firm's own regulatory reporting assessment could not begin until the notification arrived.
What is the most significant consequence for the firm?
a) It has a contractual claim against the provider for breach of the notification obligation, which should be pursued through the relationship.
b) Its regulatory reporting is late, and the firm should explain the delay by reference to the provider's failure to notify promptly.
c) It lost eleven days during which it could neither assess its own exposure nor take any action to contain it.
d) Its incident response plan is inadequate, since it did not detect the provider's incident independently within the eleven-day period.
 
07. A firm proposes to use a model whose internal workings its vendor will not disclose to decide which customers are offered a product. The vendor provides evidence that the model performs accurately on test data.
What risk does the arrangement leave unaddressed?
a) The model's performance on the vendor's test data may not be reproduced on the firm's own customer population.
b) The firm cannot demonstrate, from the model itself, why any particular decision was reached.
c) The vendor may cease to support the model, leaving the firm dependent on a system it cannot maintain itself.
d) The model may have been trained on data the vendor was not entitled to use, exposing the firm to claims arising from its provenance.
 
08. A board paper proposes that the firm's cyber risk appetite be set at the largest loss the firm could absorb without threatening its viability.
What is wrong with that proposition?
a) It sets appetite at the firm's capacity, which is the most it could survive rather than the level it chooses to accept.
b) It leaves the board setting appetite, when appetite for an operational risk is properly set by the executive that owns the process.
c) It expresses appetite as a loss figure, when cyber appetite should be expressed as tolerable disruption to important services.
d) It assumes the firm can quantify a cyber loss in advance, which requires loss history that a single firm is unlikely to hold.
 
09. A firm's fraud team requests a full copy of the customer database, including addresses, dates of birth and transaction histories, to build a detection model. It expects to use only a subset of the fields.
What should the risk function require first?
a) That the copy be encrypted at rest and in transit, protecting the additional fields to the same standard as the source.
b) That access to the copy be restricted to named members of the fraud team and reviewed on a quarterly cycle.
c) That the fraud team document a lawful basis for processing the data for this new purpose before the copy is made.
d) That the request be limited to the fields the model genuinely needs, so that data the firm never holds cannot be exposed.
 
10. A risk committee is agreeing where cyber risk belongs in the firm's risk taxonomy so that exposures can be aggregated and reported consistently across the group.
Which classification reflects established practice in a regulated financial institution?
a) A category of strategic risk, because the firm's exposure follows directly from the technology and business-model choices its leadership has made.
b) A category of reputational risk, because the consequence that matters most is the loss of customer or market confidence that follows an incident.
c) A category of operational risk, because it arises from inadequate or failed people, processes and systems, or from external events.
d) A technology risk owned within the IT function, because the controls that mitigate it are overwhelmingly technical in nature.

Answers:

Question: 01
Answer: a		 Question: 02
Answer: d		 Question: 03
Answer: c		 Question: 04
Answer: b		 Question: 05
Answer: a
Question: 06
Answer: c		 Question: 07
Answer: b		 Question: 08
Answer: a		 Question: 09
Answer: d		 Question: 10
Answer: c

If you find any errors or typos in PRMIA Cyber Risk Management (CRM) (CRM) sample question-answers or online PRMIA Cyber Risk Management practice exam, please report them to us on feedback@processexam.com

Your rating: None Average: 5 (1 vote)