CRISC IT Risk Assessment Practice Test 1 — 15 Questions

Question 1

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

Accepted Answer

Control operating effectiveness. Residual risk is the remaining risk after considering the effectiveness of controls. To calculate residual risk, you need to know the control design adequacy (whether controls are properly designed) and control operating effectiveness (whether they work as intended). These two components together determine control effectiveness. Inherent risk is a given input, not a component for calculation.

Answer

Likelihood of threat events

Answer

Financial impact of the risk

Answer

Inherent risk level

Question 2

After implementing a set of controls for a critical risk, the residual risk is calculated. The risk owner argues that the residual risk remains high and requires further treatment. Which of the following BEST describes the relationship between inherent risk, control effectiveness, and residual risk?

Accepted Answer

Residual risk = Inherent risk × (1 - Control effectiveness). Residual risk is calculated by applying control effectiveness as a percentage reduction to inherent risk. This is the standard formula used in risk management frameworks: Residual Risk = Inherent Risk × (1 - Control Effectiveness). If control effectiveness is 0.8 (80%), then only 20% of the inherent risk remains, reflecting the portion not mitigated by controls.

Answer

Residual risk = Inherent risk + Control effectiveness

Answer

Residual risk = Inherent risk - Control effectiveness

Answer

Residual risk = Inherent risk / Control effectiveness

Question 3

A risk practitioner is conducting a business impact assessment for a critical application. Which TWO of the following are examples of direct financial costs? (Select TWO)

Accepted Answer

Incident response costs. In a business impact assessment (BIA), direct financial costs are those that result in immediate monetary outflows. Incident response costs (A) involve expenditures for containment, investigation, and remediation. Regulatory fines (C) are penalties imposed by governing bodies, constituting a clear direct financial cost. Recovery costs (E) are also direct, but lost business (D) and reputation damage (B) are indirect costs. Since the question requires selecting two, A and C are the most unambiguous examples.

Answer

Reputation damage

Answer

Lost business due to downtime

Answer

Recovery costs

Question 4

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Accepted Answer

Quick and easy to communicate. Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.

Answer

Eliminates subjectivity in risk assessment

Answer

Provides comparable results across organizations

Answer

Produces financially meaningful results

Question 5

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$140,000. The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

Answer

$100,000

Answer

$70,000

Answer

$1,400,000

Question 6

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

Accepted Answer

Transfer the risk through cyber insurance. The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

Answer

Avoid the risk by discontinuing the process

Answer

Accept the risk with formal sign-off

Answer

Mitigate the risk by implementing controls

Question 7

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Accepted Answer

Controls are effective in reducing the risk level. A reduction from 25 to 9 indicates controls are effective in reducing risk. High inherent risk does not automatically mean high residual risk; controls can reduce it significantly.

Answer

Additional controls are unnecessary

Answer

Controls are not effective because residual risk remains

Answer

The inherent risk was overestimated

Question 8

Which of the following is a detective control for an information system?

Accepted Answer

Intrusion detection system. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for malicious actions or policy violations and generates alerts when such events occur. Unlike preventive controls, an IDS does not block or stop the attack; it detects and reports it after the fact, enabling incident response.

Answer

Data backup

Answer

Encryption

Answer

Firewall

Question 9

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

Accepted Answer

ALE = $100,000; expected annual loss. ALE = ARO × SLE = 0.5 × $200,000 = $100,000. This means the expected annual loss from this risk is $100,000.

Answer

ALE = $400,000; maximum possible loss

Answer

ALE = $100,000; single loss expectancy

Answer

ALE = $200,000; annual cost of controls

Question 10

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Accepted Answer

Vulnerability severity. In FAIR, Loss Event Frequency (LEF) is directly influenced by the probability that a threat actor will successfully exploit a vulnerability. Vulnerability severity (how easily a vulnerability can be exploited) is a key component of the 'Vulnerability' factor in FAIR's decomposition, which feeds into LEF. Even with high threat capability and severe impact, if vulnerability is low (strong patching), LEF remains low because the attack is unlikely to succeed.

Answer

Threat actor capability and motivation

Answer

Control effectiveness

Answer

Business impact severity

Question 11

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. (Avoid) is correct because risk avoidance involves discontinuing the activity or process that gives rise to the risk. In IT risk management, this means removing the vulnerable system, decommissioning a service, or ceasing a business function entirely to eliminate the risk exposure. For example, if an organization decides to shut down a legacy FTP server to avoid the risk of data interception, it is applying the avoid treatment.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 12

A risk practitioner is prioritizing IT risks for treatment. Which factor should be the PRIMARY basis for prioritization?

Accepted Answer

Risk level (inherent or residual). Risk prioritization is primarily based on the level of risk (inherent or residual) to allocate resources to the most critical risks. Ease of mitigation, cost, and business unit preference are secondary.

Answer

Ease of implementing controls

Answer

Cost of controls

Answer

Business unit manager's preference

Question 13

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

Accepted Answer

Threat Event Frequency (TEF). In the FAIR model, Threat Event Frequency (TEF) is the component that estimates how often, within a given timeframe, a threat agent (such as a hacker or malware) will initiate an action against an asset. This directly matches the question's definition of 'probable frequency that a threat agent will act against an asset.' TEF is a primary input for calculating Loss Event Frequency (LEF) and ultimately risk.

Answer

Vulnerability

Answer

Loss Event Frequency (LEF)

Answer

Annualized Rate of Occurrence (ARO)

Question 14

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Accepted Answer

High. Risk score = 3 × 4 = 12, which falls in the high range (12-25).

Answer

Critical

Answer

Medium

Answer

Low

Question 15

Which type of control is designed to reduce the likelihood of a risk event occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

Answer

Corrective

Answer

Compensating

Answer

Detective