ISACA certification practice
Practise Certified in Risk and Information Systems Control CRISC practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 4 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified in Risk and Information Systems Control CRISC exam.
Exam cost
$575 USD (ISACA member) / $760 USD (non-member) / ~£460 / ~£610
Duration
240 minutes (4 hours)
Question count
150 questions
Passing score
450 / 800
Validity
Ongoing (annual CPE maintenance required)
Delivered by
PSI
Online proctored
Yes — available
100% free — no account required
Everything on Courseiva for CRISC is free — no subscription, no trial, no email wall.
Courseiva provides free Certified in Risk and Information Systems Control CRISC (CRISC) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with ISACA.
Retake policy
Up to four attempts per 12-month period
Question formats
The ISACA Certified in Risk and Information Systems Control (CRISC) is a globally recognised credential that validates expertise in enterprise IT risk identification, assessment, evaluation, response, and monitoring. The exam spans four domains: governance, IT risk assessment, risk response and reporting, and information technology and security. CRISC is designed for professionals who bridge the gap between IT and business risk management, ensuring that risk-related decisions align with organisational strategy and risk appetite. It is consistently ranked among the highest-paying IT certifications globally and is particularly valued in financial services, consulting, and large enterprise environments where formal risk governance frameworks are essential.
Official prerequisite
Three years of cumulative work experience in IT risk management and IS control across at least two of the four CRISC domains, with mandatory experience in Domains 1 or 2. No education substitutions are permitted for CRISC.
Recommended experience
Hands-on experience in enterprise risk assessment, risk frameworks (NIST RMF, ISO 31000, COBIT), and internal controls; experience in regulated industries such as banking, insurance, or government is highly beneficial
3+ years in IT risk management and IS control — practitioners in risk, audit, and compliance are the primary audience
Should you skip this exam?
Skip if you have no dedicated risk management background — CRISC assumes significant risk assessment and control experience; those early in their careers should consider CISA or Security+ first
Courseiva study tip
Anchor your preparation in ISACA's official CRISC Review Manual and practice questions — questions are heavily scenario-based and require you to apply risk management judgement in realistic enterprise situations, not just recall definitions
UK salary range
£75,000–£115,000
US salary range
$125,000–$170,000
Job roles that cite CRISC
What certification to take next
The CRISC exam costs $575 USD for ISACA members and $760 USD for non-members. Annual ISACA membership is $135 and includes access to resources and member discounts, making it cost-effective to join before registering for the exam.
The passing score is 450 out of 800 on a scaled basis, consistent with other ISACA credentials. The exam uses 150 multiple-choice questions in a four-hour session.
CRISC requires three years of cumulative paid work experience in IT risk management and IS control, covering at least two of the four domains — and experience in Domain 1 (Governance) or Domain 2 (IT Risk Assessment) is mandatory. Unlike some ISACA credentials, no education substitutions are allowed for CRISC.
CRISC covers four domains: (1) Governance, (2) IT Risk Assessment, (3) Risk Response and Reporting, and (4) Information Technology and Security. The exam emphasises the practical integration of risk management with business strategy and IT operations.
CRISC is specifically focused on IT risk identification, assessment, and control — it is narrower than CISM (which covers all of security management) and complementary to CISA (which focuses on auditing and assurance). Many senior GRC and risk professionals hold CRISC alongside CISM or CISA. CRISC typically commands the highest salaries of the three.
CRISC requires continuous annual maintenance: 20 CPE hours per year (120 hours over three years) and an annual ISACA maintenance fee. The credential remains active indefinitely as long as these requirements are met.
CRISC is best suited for IT risk managers, GRC professionals, compliance officers, and risk consultants with hands-on experience in enterprise risk frameworks. It is particularly valued in financial services, insurance, healthcare, and any sector where formal IT risk governance is regulated or audited.
See how CRISC stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CRISC Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified in Risk and Information Systems Control CRISC questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CRISC questions linked to IT Risk Identification.
Practise CRISC questions linked to Risk Response and Mitigation.
Practise CRISC questions linked to Risk and Control Monitoring and Reporting.
Practise CRISC questions linked to IT Risk Assessment.
Practise CRISC questions linked to CRISC fundamentals.
Practise CRISC questions linked to CRISC scenario.
Practise CRISC questions linked to CRISC troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 36 tests. See all 36 CRISC practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Free study guide
The Courseiva CRISC study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Drag a concept onto its matching description — or click a concept then click the description.
Eliminate the activity that causes the risk
Reduce the likelihood or impact of the risk
Shift the risk to a third party, e.g., insurance
Acknowledge the risk and take no further action
Drag a concept onto its matching description — or click a concept then click the description.
Data is accessible only to authorized parties
Data is accurate and complete
Data is accessible when needed
Actions can be traced to individuals
Trap 1: Potential for service downtime affecting patient care.
Downtime is an availability risk, not specifically privacy/compliance.
Trap 2: Loss of control over the cloud provider's internal access controls.
Loss of control is a general risk but not the most significant for privacy.
Trap 3: Vendor lock-in due to proprietary APIs.
Vendor lock-in is a business risk, not primarily privacy/compliance.
Potential for service downtime affecting patient care.
Why wrong: Downtime is an availability risk, not specifically privacy/compliance.
Data residency and jurisdiction issues.
Data may be stored in countries with inadequate privacy laws.
Loss of control over the cloud provider's internal access controls.
Why wrong: Loss of control is a general risk but not the most significant for privacy.
Insufficient encryption of data at rest and in transit.
Inadequate encryption directly risks data confidentiality and compliance.
Vendor lock-in due to proprietary APIs.
Why wrong: Vendor lock-in is a business risk, not primarily privacy/compliance.
Trap 1: Transfer the risk by purchasing cyber insurance
Insurance does not prevent data exposure or GDPR fines.
Trap 2: Accept the risk because the IP restriction reduces likelihood
IP restriction may still be insufficient for GDPR; acceptance is not appropriate.
Trap 3: Implement a web application firewall (WAF) to monitor traffic
WAF does not enforce encryption on the database connection.
Transfer the risk by purchasing cyber insurance
Why wrong: Insurance does not prevent data exposure or GDPR fines.
Close the port or implement a VPN, and enforce encryption
This directly mitigates the vulnerability and ensures compliance.
Accept the risk because the IP restriction reduces likelihood
Why wrong: IP restriction may still be insufficient for GDPR; acceptance is not appropriate.
Implement a web application firewall (WAF) to monitor traffic
Why wrong: WAF does not enforce encryption on the database connection.
Trap 1: Request the vendor's latest risk assessment report.
The vendor's risk assessment may not address the company's specific context.
Trap 2: Perform a pilot deployment and monitor for security incidents.
A pilot does not assess regulatory compliance before full deployment.
Trap 3: Accept the vendor's certifications as sufficient evidence of…
Certifications may not cover all specific regulatory requirements.
Request the vendor's latest risk assessment report.
Why wrong: The vendor's risk assessment may not address the company's specific context.
Conduct a data classification and legal review to identify applicable regulatory obligations.
Data classification and legal review determine if additional controls are needed.
Perform a pilot deployment and monitor for security incidents.
Why wrong: A pilot does not assess regulatory compliance before full deployment.
Accept the vendor's certifications as sufficient evidence of control effectiveness.
Why wrong: Certifications may not cover all specific regulatory requirements.
Trap 1: Users may reuse strong passwords across multiple systems.
Password reuse is a risk but not the greatest during migration.
Trap 2: Users may experience increased convenience, leading to reduced…
Convenience is not a direct risk; it is a benefit.
Trap 3: Help desk call volumes may increase due to SSO authentication…
SSO typically reduces help desk calls.
Users may reuse strong passwords across multiple systems.
Why wrong: Password reuse is a risk but not the greatest during migration.
Users may experience increased convenience, leading to reduced security awareness.
Why wrong: Convenience is not a direct risk; it is a benefit.
Legacy authentication accounts may remain active, creating orphan accounts.
Orphan accounts are a high-risk security issue if not disabled.
Help desk call volumes may increase due to SSO authentication failures.
Why wrong: SSO typically reduces help desk calls.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.