CRISC IT Risk Assessment Practice Test 10 — 15 Questions

Question 1

A risk practitioner is calculating the residual risk for a critical asset. Which THREE factors should be considered?

Accepted Answer

Control design adequacy. Residual risk is the risk remaining after controls are applied. To calculate it, you must know the inherent risk level (the risk before controls) and then assess how effectively controls reduce that risk. Control design adequacy and operating effectiveness determine how much the inherent risk is mitigated, directly impacting the residual risk calculation.

Answer

Cost of controls

Answer

Risk appetite

Question 2

In a qualitative risk assessment, which TWO elements are typically used to determine the risk rating?

Accepted Answer

Likelihood. In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Answer

Risk appetite

Answer

Cost of mitigation

Answer

Control effectiveness

Question 3

A company is prioritizing risk treatment actions. Which THREE factors should be considered when prioritizing risks?

Accepted Answer

Cost-benefit analysis of controls. Cost-benefit analysis ensures that the resources invested in controls are justified by the reduction in risk, which is a core principle of risk management. Without this analysis, an organization might over-invest in low-impact risks or under-invest in high-impact ones, leading to inefficient allocation of budget and effort.

Answer

Industry best practices

Answer

Number of vulnerabilities

Question 4

A company is considering using a qualitative risk assessment approach to evaluate IT risks. Which TWO of the following are advantages of qualitative risk analysis over quantitative risk analysis?

Accepted Answer

Quick to perform. Option C is correct because qualitative risk analysis relies on relative scales such as High/Medium/Low or ordinal rankings rather than collecting precise monetary values and statistical data, so assessments can be completed quickly with far less data gathering and calculation effort. Option D is correct because qualitative outputs expressed in simple descriptive terms (for example, a risk matrix rating of High) are readily understood by non-technical stakeholders, executives, and business owners who may lack a financial or statistical background. By contrast, option A is wrong because qualitative ratings are subjective and scale-dependent, so results are not easily comparable across different organizations that use different criteria or rating scales. Option B is wrong because financially meaningful results, such as annualized loss expectancy (ALE) derived from single loss expectancy (SLE) and annualized rate of occurrence (ARO), are a hallmark of quantitative analysis, not qualitative. Option E is wrong because qualitative analysis is inherently subjective and depends on expert judgment, making it less objective and repeatable than quantitative methods.

Answer

Easily comparable across organizations

Answer

Provides financially meaningful results

Answer

Objective and repeatable

Question 5

An organization is using the FAIR framework to perform a quantitative risk analysis for a data breach scenario. Which TWO of the following are components of the Annualized Loss Expectancy (ALE) calculation in FAIR?

Accepted Answer

Loss Event Frequency (LEF). In FAIR, ALE is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM), so option B (Loss Event Frequency) and option D (Loss Magnitude) are the two correct components. LEF represents how often a loss event is expected to occur per year, while LM represents the probable magnitude of loss from a single event, and their product yields the annualized loss expectancy. Option A (ARO) and option C (SLE) belong to the classic SLE × ARO = ALE formula, not to FAIR's terminology, even though they are conceptually related. Option E (Exposure Factor) is an input used to derive SLE in the traditional formula (SLE = AV × EF) and is not a direct component of FAIR's ALE calculation.

Answer

Annualized Rate of Occurrence (ARO)

Answer

Single Loss Expectancy (SLE)

Answer

Exposure Factor (EF)

Question 6

During an IT risk assessment, a risk owner has identified a risk with a high inherent risk score. After reviewing control effectiveness, the residual risk remains medium. The organization decides to accept the residual risk. Which TWO of the following actions should the risk owner take?

Accepted Answer

Obtain sign-off from the risk owner. The risk owner must formally acknowledge and accept the residual risk after the decision to accept has been made. This sign-off demonstrates that the risk owner is aware of the remaining exposure and agrees to the risk acceptance, which is a key governance step in the risk management process. Without this sign-off, the acceptance is not formally recognized, and accountability remains unclear.

Answer

Transfer the risk to a third party

Answer

Eliminate the activity that creates the risk

Answer

Implement additional controls to reduce risk further

Question 7

A company is evaluating control types for a new system. The security team proposes implementing an intrusion detection system (IDS) and a backup restoration process. Which TWO control types do these represent, respectively?

Accepted Answer

Detective. An IDS is a detective control (D) because it monitors network or host activity and generates alerts on suspicious or malicious events, but it does not block them, so it identifies rather than prevents incidents. A backup restoration process is a corrective control (E) because it restores systems and data to a known-good state after an incident, directly remediating the impact. Deterrent (A) controls discourage attackers (e.g., warning banners, guards) and do not detect or recover, so they do not fit. Preventive (B) controls such as firewalls, IPS, or access controls stop events before they occur, which an IDS does not do. Compensating (C) controls are alternative measures used when a primary control cannot be implemented, which is not the case for either IDS or backup restoration here.

Answer

Deterrent

Answer

Preventive

Answer

Compensating

Question 8

An organization is conducting a risk assessment and finds that the inherent risk for a critical asset is very high due to a high threat event frequency and high vulnerability. The current controls are assessed as adequate in design but not operating effectively. Which THREE of the following should be considered when calculating residual risk?

Accepted Answer

Inherent risk score. Inherent risk score (A) is correct because residual risk is calculated by considering the inherent risk level and the effectiveness of controls in reducing that risk. Since the inherent risk is very high due to high threat frequency and vulnerability, this baseline score must be factored into the residual risk calculation to determine the remaining risk after controls are applied.

Answer

Cost-benefit analysis of controls

Answer

Risk appetite statement

Question 9

A risk analyst is assessing a newly discovered vulnerability in an internet-facing server. The analyst collects several data points: the vulnerability has a CVSS base score of 9.8, there are known exploits in the wild, and the server is critical for processing customer transactions. However, the organization's intrusion detection system has a signature that blocks the specific exploit, and the server is patched monthly. The analyst must determine the risk level. Which of the following should the analyst use to BEST assess the risk?

Accepted Answer

A qualitative risk assessment using a likelihood-impact matrix that incorporates the effectiveness of existing controls and threat intelligence.. The analyst must assess risk by combining vulnerability severity, threat activity, existing controls, and asset criticality. A qualitative matrix that incorporates control effectiveness and threat intelligence provides a business-contextualized risk rating, which is essential for prioritization. CVSS base scores or subscores are inputs but not sufficient alone, and financial impact alone misses likelihood and control factors.

Answer

The CVSS base score alone, because it provides a standardized severity rating.

Answer

The exploitability subscore of CVSS, because it measures the difficulty of exploiting the vulnerability.

Answer

The asset's replacement cost, because risk is a function of financial impact.

Question 10

A risk analyst is preparing a risk register for a new customer relationship management (CRM) system hosted in a public cloud. For each identified risk, the analyst assigns a likelihood rating (1–5) and an impact rating (1–5) based on team consensus, and then multiplies the two scores to produce a risk score. Which risk assessment approach is the analyst using?

Accepted Answer

Semi-quantitative risk analysis. Multiplying ordinal likelihood and impact ratings generates a relative risk score, which is characteristic of semi-quantitative analysis. The ratings originate from expert consensus rather than measured frequencies or financial values, so the result is not a true quantitative loss estimate, and it is more structured than a purely qualitative high/medium/low label.

Answer

Quantitative risk analysis

Answer

Monte Carlo simulation

Answer

Qualitative risk analysis

Question 11

A financial services company is conducting a risk assessment for a new mobile banking application. The risk team identifies that the application will store sensitive customer data on the device. The team must determine the appropriate risk response. The CISO suggests implementing encryption and tokenization to protect the data. The business sponsor argues that these controls will delay the launch and increase costs. The risk owner must decide how to proceed. Which of the following is the MOST appropriate action for the risk owner to take?

Accepted Answer

Document the risk and propose a risk treatment plan that includes the suggested controls, then escalate to senior management for a decision if the business sponsor does not agree.. The risk owner must balance business needs with risk mitigation. Documenting the risk, proposing controls, and escalating disagreements to senior management ensures a risk-informed decision. This approach respects the business sponsor's concerns while upholding the risk owner's duty to manage risk within appetite. It also aligns with CRISC's emphasis on communication and escalation.

Answer

Accept the risk because the business sponsor has authority over the project timeline and budget.

Answer

Implement the controls without consulting the business sponsor to avoid further delays.

Answer

Transfer the risk by purchasing cyber insurance to cover potential data breaches.

Question 12

A risk analyst at a healthcare provider is assessing the risk of a ransomware attack on a clinical data repository. The analyst estimates that a ransomware event would cost $800,000 in recovery and downtime, and that such an event is likely to occur once every four years. What is the annualized loss expectancy (ALE) for this risk?

Accepted Answer

$200,000. Annualized loss expectancy expresses expected yearly loss as single loss expectancy multiplied by annualized rate of occurrence. With an $800,000 single loss and a four-year recurrence, the ARO is 0.25, producing an ALE of $200,000. This normalized annual figure lets the healthcare provider compare the ransomware risk directly against other risks and against the cost of proposed controls.

Answer

$800,000

Answer

$3,200,000

Answer

$100,000

Question 13

A hospital's risk team is assessing a clinical imaging archive. The team determines that a ransomware event would encrypt the archive and disrupt diagnostic services, with an estimated single-loss magnitude of $2,000,000. Existing controls reduce the likelihood of a successful attack to an estimated 0.4 occurrences per year. What is the annualized loss expectancy (ALE) for this risk?

Accepted Answer

$800,000. Annualized loss expectancy is the product of the loss from a single event and the estimated number of such events per year. Multiplying the $2,000,000 single-loss magnitude by the 0.4 annualized rate of occurrence yields an expected average annual loss of $800,000, which the hospital can use to compare against the cost of additional ransomware controls.

Answer

$2,000,000

Answer

$2,400,000

Answer

$5,000,000

Question 14

A financial services firm has completed a risk assessment of its trading platform. The chief risk officer wants to ensure the assessment results are comparable across business units and that the reasoning behind each likelihood and impact rating is transparent to auditors. Which action BEST supports this objective?

Accepted Answer

Document the rating scales and the specific criteria and evidence used to assign each likelihood and impact value. Comparability and auditability depend on defined rating scales, explicit criteria for each level, and documented evidence supporting each likelihood and impact assignment. These elements let different business units apply the same methodology and let auditors trace how each score was derived, which is more valuable than changing matrix size or centralizing decisions.

Answer

Increase the number of risks in the register to ensure no scenario is overlooked

Answer

Recalculate all risk scores using a 10×10 matrix instead of a 5×5 matrix

Answer

Assign all risk scoring decisions to a single central analyst

Question 15

A risk analyst is building a risk register for a newly deployed customer relationship management (CRM) system that stores personally identifiable information (PII). The analyst needs to document the risk that an attacker could exfiltrate the PII database. Which of the following BEST represents the threat component of this risk statement?

Accepted Answer

An external attacker with data exfiltration capability.. A well-formed risk statement links a threat source to a vulnerability and an impact. The attacker with exfiltration capability is the threat source, while the unencrypted PII fields are the vulnerability and the dollar figure is the impact. Identifying the threat source correctly lets the risk analyst select appropriate controls, such as monitoring for exfiltration behavior, and enables meaningful comparison across other risks in the register.

Answer

The CRM database contains unencrypted PII fields.

Answer

The financial impact of a PII breach is estimated at $2 million.

Answer

The likelihood of a PII breach is rated as high.