CRISC IT Risk Assessment — 10 Questions

Question 1

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

Accepted Answer

Control operating effectiveness. Residual risk is the remaining risk after considering the effectiveness of controls. To calculate residual risk, you need to know the control design adequacy (whether controls are properly designed) and control operating effectiveness (whether they work as intended). These two components together determine control effectiveness. Inherent risk is a given input, not a component for calculation.

Answer

Likelihood of threat events

Answer

Financial impact of the risk

Answer

Inherent risk level

Question 2

After implementing a set of controls for a critical risk, the residual risk is calculated. The risk owner argues that the residual risk remains high and requires further treatment. Which of the following BEST describes the relationship between inherent risk, control effectiveness, and residual risk?

Accepted Answer

Residual risk = Inherent risk × (1 - Control effectiveness). Residual risk is calculated by applying control effectiveness as a percentage reduction to inherent risk. This is the standard formula used in risk management frameworks: Residual Risk = Inherent Risk × (1 - Control Effectiveness). If control effectiveness is 0.8 (80%), then only 20% of the inherent risk remains, reflecting the portion not mitigated by controls.

Answer

Residual risk = Inherent risk + Control effectiveness

Answer

Residual risk = Inherent risk - Control effectiveness

Answer

Residual risk = Inherent risk / Control effectiveness

Question 3

A risk practitioner is conducting a business impact assessment for a critical application. Which TWO of the following are examples of direct financial costs? (Select TWO)

Accepted Answer

Incident response costs. In a business impact assessment (BIA), direct financial costs are those that result in immediate monetary outflows. Incident response costs (A) involve expenditures for containment, investigation, and remediation. Regulatory fines (C) are penalties imposed by governing bodies, constituting a clear direct financial cost. Recovery costs (E) are also direct, but lost business (D) and reputation damage (B) are indirect costs. Since the question requires selecting two, A and C are the most unambiguous examples.

Answer

Reputation damage

Answer

Lost business due to downtime

Answer

Recovery costs

Question 4

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Accepted Answer

Quick and easy to communicate. Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.

Answer

Eliminates subjectivity in risk assessment

Answer

Provides comparable results across organizations

Answer

Produces financially meaningful results

Question 5

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$140,000. The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

Answer

$100,000

Answer

$70,000

Answer

$1,400,000

Question 6

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

Accepted Answer

Transfer the risk through cyber insurance. The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

Answer

Avoid the risk by discontinuing the process

Answer

Accept the risk with formal sign-off

Answer

Mitigate the risk by implementing controls

Question 7

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Accepted Answer

Controls are effective in reducing the risk level. A reduction from 25 to 9 indicates controls are effective in reducing risk. High inherent risk does not automatically mean high residual risk; controls can reduce it significantly.

Answer

Additional controls are unnecessary

Answer

Controls are not effective because residual risk remains

Answer

The inherent risk was overestimated

Question 8

Which of the following is a detective control for an information system?

Accepted Answer

Intrusion detection system. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for malicious actions or policy violations and generates alerts when such events occur. Unlike preventive controls, an IDS does not block or stop the attack; it detects and reports it after the fact, enabling incident response.

Answer

Data backup

Answer

Encryption

Answer

Firewall

Question 9

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

Accepted Answer

ALE = $100,000; expected annual loss. ALE = ARO × SLE = 0.5 × $200,000 = $100,000. This means the expected annual loss from this risk is $100,000.

Answer

ALE = $400,000; maximum possible loss

Answer

ALE = $100,000; single loss expectancy

Answer

ALE = $200,000; annual cost of controls

Question 10

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Accepted Answer

Vulnerability severity. In FAIR, Loss Event Frequency (LEF) is directly influenced by the probability that a threat actor will successfully exploit a vulnerability. Vulnerability severity (how easily a vulnerability can be exploited) is a key component of the 'Vulnerability' factor in FAIR's decomposition, which feeds into LEF. Even with high threat capability and severe impact, if vulnerability is low (strong patching), LEF remains low because the attack is unlikely to succeed.

Answer

Threat actor capability and motivation

Answer

Control effectiveness

Answer

Business impact severity