Objective 2.0

IT Risk Assessment

CRISC Practice Questions

Risk questions require you to match the scenario characteristics to the correct response strategy. The probability-impact combination drives the choice — avoid or mitigate high combinations, accept low ones.

Full Practice Test →All Objectives

What this objective tests

CRISC IT Risk Assessment — Key Topics

Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.

Risk identification techniques: brainstorming, SWOT, Delphi technique, and historical data review.
Qualitative analysis: probability-impact matrix, risk categorisation, and urgency assessment.
Quantitative analysis: EMV (Expected Monetary Value), Monte Carlo simulation, and sensitivity analysis.
Risk response strategies and when each is appropriate based on impact and probability.

Common exam traps

Where candidates lose marks on IT Risk Assessment

⚠Confusing risk avoidance (eliminate the cause) with risk transfer (shift consequence to another party).
⚠Treating a risk with low probability and high impact the same as one with high probability and low impact.
⚠Forgetting that residual risk remains after mitigation and must be accepted or further treated.
⚠Selecting risk acceptance for a high-impact, high-probability risk — acceptance is for low-impact or unavoidable risks.

CRISC IT Risk Assessment — Practice Questions

30 questions from this objective

Question 2mediummultiple choice

IT Risk Assessment

CRISC IT Risk Assessment — Key Topics

Where candidates lose marks on IT Risk Assessment

CRISC IT Risk Assessment — Practice Questions

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

A risk assessment for a healthcare organization reveals a high likelihood of data breaches due to weak encryption on portable devices. The organization decides to deploy full-disk encryption and enforce multi-factor authentication. Which risk response strategy is being applied?

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

A retail company is assessing the risk of a POS malware attack. Which approach would BEST quantify the potential financial impact?

A risk assessor is evaluating a third-party cloud service provider. Which of the following is the MOST important factor to consider when assessing the risk of data exfiltration?

An organization has a risk appetite that is risk-averse. Which risk treatment option would be most aligned with this appetite?

During a risk assessment, a financial institution identifies that its online banking application uses an outdated encryption protocol. The likelihood of exploitation is high, and the impact is moderate. What should the risk owner do FIRST?

A multinational corporation is assessing the risk of non-compliance with GDPR. Which of the following is the BEST approach to quantify the potential fine?

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

A risk assessment reveals that a legacy system has a high vulnerability score but low business criticality. The cost to remediate is high. What is the MOST appropriate risk response?

An organization uses a quantitative risk analysis method. The annualized rate of occurrence (ARO) for a specific threat is 0.5, and the single loss expectancy (SLE) is $200,000. What is the annualized loss expectancy (ALE)?

During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

After a risk assessment, the risk owner decides to mitigate a high-risk finding by implementing additional access controls. What should the risk manager do NEXT?

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?

A risk manager is evaluating the risk associated with a new third-party vendor that will have access to customer data. The vendor has been in business for 10 years and holds ISO 27001 certification. Which factor should be given the MOST weight when determining the vendor's risk level?

Which TWO of the following are valid techniques for identifying risk in IT risk assessment?

Which THREE of the following are key components of a risk assessment report?

Which TWO of the following are examples of inherent risk?

Based on the exhibit, what is the MOST likely risk scenario?

Exhibit

Based on the exhibit, what is the primary risk to the organization?

Exhibit

A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?

Which THREE of the following are key components of an IT risk assessment report as per ISACA guidelines?

Based on the exhibit, which risk should be treated first according to the risk rating?

Exhibit

Refer to the exhibit. An organization has identified vulnerabilities on a critical server. The risk owner has limited resources and can remediate only one finding this quarter. Based on the information provided, which approach is the most appropriate risk assessment decision?

Exhibit

All CRISC Objectives

IT Risk Assessment

CRISC IT Risk Assessment — Key Topics

Where candidates lose marks on IT Risk Assessment

CRISC IT Risk Assessment — Practice Questions

During a risk assessment, an organization identifies that its primary data center is located in a flood-prone area. Which risk treatment option would best address this risk?

A risk assessment for a healthcare organization reveals a high likelihood of data breaches due to weak encryption on portable devices. The organization decides to deploy full-disk encryption and enforce multi-factor authentication. Which risk response strategy is being applied?

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

A retail company is assessing the risk of a POS malware attack. Which approach would BEST quantify the potential financial impact?

A risk assessor is evaluating a third-party cloud service provider. Which of the following is the MOST important factor to consider when assessing the risk of data exfiltration?

An organization has a risk appetite that is risk-averse. Which risk treatment option would be most aligned with this appetite?

During a risk assessment, a financial institution identifies that its online banking application uses an outdated encryption protocol. The likelihood of exploitation is high, and the impact is moderate. What should the risk owner do FIRST?

A multinational corporation is assessing the risk of non-compliance with GDPR. Which of the following is the BEST approach to quantify the potential fine?

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

A risk assessment reveals that a legacy system has a high vulnerability score but low business criticality. The cost to remediate is high. What is the MOST appropriate risk response?

An organization uses a quantitative risk analysis method. The annualized rate of occurrence (ARO) for a specific threat is 0.5, and the single loss expectancy (SLE) is $200,000. What is the annualized loss expectancy (ALE)?

During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

After a risk assessment, the risk owner decides to mitigate a high-risk finding by implementing additional access controls. What should the risk manager do NEXT?

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?

A risk manager is evaluating the risk associated with a new third-party vendor that will have access to customer data. The vendor has been in business for 10 years and holds ISO 27001 certification. Which factor should be given the MOST weight when determining the vendor's risk level?

Which TWO of the following are valid techniques for identifying risk in IT risk assessment?

Which THREE of the following are key components of a risk assessment report?

Which TWO of the following are examples of inherent risk?

Based on the exhibit, what is the MOST likely risk scenario?

Exhibit

Based on the exhibit, what is the primary risk to the organization?

Exhibit

A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?

Which THREE of the following are key components of an IT risk assessment report as per ISACA guidelines?

Based on the exhibit, which risk should be treated first according to the risk rating?

Exhibit

Refer to the exhibit. An organization has identified vulnerabilities on a critical server. The risk owner has limited resources and can remediate only one finding this quarter. Based on the information provided, which approach is the most appropriate risk assessment decision?

Exhibit

All CRISC Objectives