CRISC Practice Test 24 — 15 Questions

Question 1

During a quantitative risk analysis, the risk team calculates the loss event frequency (LEF) using the FAIR framework. If the threat event frequency (TEF) is 10 per year and the vulnerability (V) is 0.3, what is the LEF?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

3 per year. In the FAIR framework, loss event frequency (LEF) is calculated as the product of threat event frequency (TEF) and vulnerability (V). Given TEF = 10 per year and V = 0.3, LEF = 10 × 0.3 = 3 per year. This represents the expected number of loss events per year, accounting for the probability that a threat event will actually result in a loss.

Answer

10.3 per year

Answer

30 per year

Answer

0.3 per year

Question 2

A multinational corporation is identifying risks associated with cross-border data transfers. Which regulation's risk identification requirements are most relevant?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the most relevant regulation for risk identification in cross-border data transfers because it explicitly governs the transfer of personal data from the European Economic Area (EEA) to third countries. GDPR requires organizations to identify and assess risks related to adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), and potential data localization conflicts. This regulation directly addresses the legal and technical risks of moving data across borders, such as exposure to differing privacy laws and surveillance regimes.

Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Question 3

During a solution architecture review, the Architecture Review Board (ARB) identifies that a new application communicates with a legacy system using plain text over a public network. Which risk treatment option is MOST appropriate?

Accepted Answer

Require encryption (e.g., TLS) for the communication. Requiring encryption (e.g., TLS) directly mitigates the confidentiality and integrity risk of plaintext transmission over a public network by protecting data in transit. This is the most appropriate risk treatment because it addresses the root cause—unprotected communication—without disrupting the legacy system's functionality. TLS provides encryption, authentication, and integrity checking, which are standard controls for this scenario. The ARB should mandate this as a condition of approval.

Answer

Transfer the risk to a third-party vendor

Answer

Accept the risk because the legacy system cannot be changed

Answer

Decommission the legacy system immediately

Question 4

Which of the following best describes the purpose of a risk heat map in an IT risk report?

Accepted Answer

To provide a visual representation of the likelihood and impact of risks. A risk heat map is a visual tool that plots risks on a grid using likelihood (probability) on one axis and impact (consequence) on the other, typically with color coding (green/yellow/red) to indicate severity. Its primary purpose is to give decision-makers an at-a-glance view of which risks fall into high, medium, or low severity zones. This visual representation supports prioritization and communication, but the visualization itself — not the ranking — is the defining purpose.

Answer

To list the top risks in order of priority

Answer

To illustrate the relationship between risks and controls

Answer

To show the cost of controls

Question 5

Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?

Accepted Answer

IEC 62443. IEC 62443 is the international standard series specifically designed for industrial automation and control systems (IACS) security. It provides a framework for securing IACS across the entire lifecycle, including risk assessment, system design, and operational security, with roles defined for asset owners, system integrators, and product suppliers. It is the de facto standard for OT/ICS security.

Answer

ISO 27001

Answer

NERC CIP

Answer

NIST SP 800-53

Question 6

During a risk assessment, a risk is assigned a likelihood of 'High' and an impact of 'Medium' on a 5×5 heat map. What is the risk rating?

Accepted Answer

High. On a 5x5 heat map, likelihood and impact are typically rated on a scale of 1 to 5. A likelihood of 'High' (often 4) and impact of 'Medium' (often 3) combine to a risk rating that is usually 'High' in most standard risk matrices. The exact rating depends on the organization's risk matrix, but in common CRISC contexts, High likelihood and Medium impact yield a High risk rating.

Answer

Critical

Answer

Low

Answer

Medium

Question 7

After implementing controls, the risk remaining is called:

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls have been implemented to mitigate the original (inherent) risk. It represents the exposure the organization still carries and must consciously accept, transfer, or further mitigate. This is a core CRISC definition tested repeatedly.

Answer

Control risk

Answer

Acceptable risk

Answer

Inherent risk

Question 8

An organization's board has issued a risk appetite statement indicating that the company is willing to accept a moderate level of operational risk but has zero tolerance for compliance violations. This statement primarily defines which of the following?

Accepted Answer

Risk appetite. The board's statement explicitly articulates the organization's willingness to accept a moderate level of operational risk while having zero tolerance for compliance violations. This is the definition of risk appetite: the amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. Risk appetite is set at the strategic level and guides risk tolerance thresholds and risk criteria.

Answer

Risk tolerance thresholds

Answer

Risk criteria

Answer

Risk capacity

Question 9

During an IT risk assessment for a new cloud-based customer relationship management (CRM) system, the risk practitioner identifies that the vendor's data center is located in a country with different data protection regulations. Which of the following is the MOST appropriate next step?

Accepted Answer

Conduct a legal review to assess regulatory implications and contractual safeguards.. When a cloud vendor's data center is in a jurisdiction with different data protection regulations, the immediate priority is to understand the legal and contractual implications before making any technical or risk acceptance decisions. A legal review will identify specific regulatory conflicts (e.g., GDPR vs. local law) and assess whether existing contractual safeguards (such as Standard Contractual Clauses or Binding Corporate Rules) adequately address the gap. This step ensures that subsequent risk treatment decisions are informed by compliance requirements rather than assumptions.

Answer

Recommend migrating to a different cloud provider.

Answer

Implement technical controls to encrypt data in transit and at rest.

Answer

Accept the risk because the vendor is compliant with industry standards.

Question 10

An organization decides to discontinue a high-risk business process that cannot be effectively mitigated. This is an example of which risk treatment option?

Accepted Answer

Risk avoidance. Risk avoidance is the deliberate decision to eliminate the activity, process, or asset that gives rise to the risk rather than trying to control it. Discontinuing a high-risk business process removes the risk entirely because the underlying activity no longer exists. This is the only treatment option that makes the risk disappear rather than reducing, sharing, or tolerating it.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk mitigation

Question 11

A risk practitioner is performing a cost-benefit analysis for a proposed control. The annualized loss expectancy (ALE) for a risk is currently $500,000. The proposed control will reduce the ALE by 80%, and the annual cost of the control is $150,000. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The control reduces the ALE by 80%, so the risk reduction benefit is 0.80 × $500,000 = $400,000. The net benefit is the benefit minus the control cost: $400,000 − $150,000 = $250,000. This represents the expected annual savings after implementing the control.

Answer

$100,000

Answer

$400,000

Answer

$350,000

Question 12

A company's risk monitoring report shows that a key risk indicator (KRI) has exceeded the threshold for three consecutive months. What is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis and implement corrective actions.. A KRI that has exceeded its threshold for three consecutive months indicates a persistent risk condition, not a transient anomaly. The most appropriate action is to conduct a root cause analysis to identify the underlying issue and implement corrective actions to bring the risk back within acceptable levels. This aligns with the CRISC domain of Risk and Control Monitoring and Reporting, which emphasizes proactive remediation over passive observation or threshold manipulation.

Answer

Wait for the KRI to return to normal on its own.

Answer

Raise the threshold to avoid future breaches.

Answer

Implement temporary manual controls.

Question 13

A risk analyst is assessing a critical application's inherent risk. After implementing controls, the residual risk is calculated as high. The analyst determines that the control design is adequate but operating effectiveness is poor. Which factor most likely explains the high residual risk?

Accepted Answer

Control operating effectiveness is poor. Residual risk is the risk remaining after controls are applied, and it is a function of both control design and control operating effectiveness. The scenario explicitly states the design is adequate but operating effectiveness is poor, meaning the controls exist on paper but are not functioning as intended in practice. Poor operating effectiveness therefore leaves the original inherent risk largely unmitigated, producing a high residual risk despite good design.

Answer

Control design is inadequate

Answer

Risk appetite was misstated

Answer

Inherent risk is too low

Question 14

Which of the following is a characteristic of IoT devices that increases cybersecurity risk?

Accepted Answer

Limited processing power for security features. IoT devices are frequently constrained by cost, size, and power, which limits CPU, memory, and battery. This directly restricts their ability to run strong encryption, host-based firewalls, secure boot, or frequent patching, expanding the attack surface. Limited processing power is therefore a structural characteristic that elevates cybersecurity risk.

Answer

Built-in hardware security modules

Answer

Standardized communication protocols

Answer

Regular automatic firmware updates

Question 15

A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?

Accepted Answer

$1,000,000. Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM). Here, LEF = 0.2 per year and LM = $5,000,000, so ALE = 0.2 × $5,000,000 = $1,000,000. This represents the expected annualized financial loss from the ransomware scenario.

Answer

$500,000

Answer

$250,000

Answer

$5,000,000