CRISC IT Risk Assessment Practice Test 2 — 15 Questions

Question 1

An organization is performing a quantitative risk analysis using the FAIR framework. Which THREE of the following are direct components of the FAIR model?

Accepted Answer

Loss Event Frequency. FAIR components include Loss Event Frequency (LEF), Threat Event Frequency (TEF), Vulnerability, and Loss Magnitude. Annualized Loss Expectancy (ALE) is a derived metric, not a direct component. Single Loss Expectancy is a component of ALE but not a separate FAIR component.

Answer

Single Loss Expectancy

Answer

Annualized Loss Expectancy

Question 2

An organization is evaluating risk treatment options for a critical vulnerability. Which TWO options would be considered risk mitigation?

Accepted Answer

Deploy an intrusion prevention system. Deploying an intrusion prevention system (IPS) is a risk mitigation measure because it actively monitors and blocks malicious traffic targeting the vulnerability, reducing the likelihood of exploitation. Implementing a security patch directly removes the vulnerability, thereby reducing both the likelihood and impact of a potential attack. Both actions modify the risk by applying technical controls to lower the residual risk level.

Answer

Purchase cyber insurance

Answer

Accept the risk with formal sign-off

Answer

Discontinue the vulnerable service

Question 3

A risk manager is using a 5×5 likelihood-impact matrix to assess a set of identified risks. What is the PRIMARY advantage of using this qualitative method?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using heat maps is quick and easy to communicate to stakeholders, making it a common initial assessment tool.

Answer

It provides objective and comparable risk scores across organizations.

Answer

It produces financially meaningful results for cost-benefit analysis.

Answer

It requires less data but is time-consuming to complete.

Question 4

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

Accepted Answer

$10,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given SLE = $50,000 and ARO = 0.2, the ALE is $50,000 × 0.2 = $10,000. This aligns with the FAIR framework's quantitative risk analysis formula.

Answer

$250,000

Answer

$100,000

Answer

$50,000

Question 5

A risk assessment identifies a high-likelihood, high-impact risk associated with a legacy system. The business owner decides to decommission the system to eliminate the risk. Which risk treatment option is being applied?

Accepted Answer

Avoid. Avoidance involves eliminating the activity that creates the risk, such as decommissioning a system.

Answer

Mitigate

Answer

Accept

Answer

Transfer

Question 6

During a quantitative risk analysis, the risk team calculates the loss event frequency (LEF) using the FAIR framework. If the threat event frequency (TEF) is 10 per year and the vulnerability (V) is 0.3, what is the LEF?

Accepted Answer

3 per year. In the FAIR framework, loss event frequency (LEF) is calculated as the product of threat event frequency (TEF) and vulnerability (V). Given TEF = 10 per year and V = 0.3, LEF = 10 × 0.3 = 3 per year. This represents the expected number of loss events per year, accounting for the probability that a threat event will actually result in a loss.

Answer

10.3 per year

Answer

30 per year

Answer

0.3 per year

Question 7

Which control type is designed to stop a risk event from occurring?

Accepted Answer

Preventive. Preventive controls aim to prevent risk events from happening, e.g., access controls, encryption.

Answer

Detective

Answer

Compensating

Answer

Corrective

Question 8

An organization is evaluating risks and decides to purchase cyber insurance to cover potential financial losses from data breaches. Which risk treatment option does this represent?

Accepted Answer

Transfer. Transfer involves shifting risk to a third party, such as through insurance or outsourcing with liability transfer.

Answer

Accept

Answer

Mitigate

Answer

Avoid

Question 9

A risk assessment report includes both inherent and residual risk ratings. The inherent risk for a process is rated as 'high' based on a 5×5 heat map. After applying a set of controls, the residual risk is rated as 'medium'. What does this indicate about the control effectiveness?

Accepted Answer

Controls are partially effective in reducing risk.. The reduction from high to medium indicates that controls are partially effective in reducing risk, but not completely.

Answer

Controls increased the risk level.

Answer

Controls are fully effective and eliminate all risk.

Answer

Controls are not effective at all.

Question 10

In the FAIR framework, loss magnitude (LM) is composed of primary loss and secondary loss. Which of the following is an example of secondary loss?

Accepted Answer

Lost business due to reputation damage. Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.

Answer

Incident response costs

Answer

Legal notification costs

Answer

System restoration expenses

Question 11

Which of the following is a limitation of qualitative risk analysis?

Accepted Answer

It provides subjective results that are not comparable across organizations.. Qualitative analysis is subjective and results may not be comparable across different organizations due to varying risk appetites and interpretations.

Answer

It cannot be used for regulatory compliance.

Answer

It requires specialized software to perform.

Answer

It is too data-intensive and time-consuming.

Question 12

An organization identifies a risk that is within its risk appetite. The risk owner decides to formally document the risk and accept it without implementing additional controls. Which of the following is required for this risk acceptance?

Accepted Answer

Formal sign-off by the risk owner. Acceptance requires formal documentation and sign-off by the risk owner, acknowledging the risk within appetite.

Answer

Avoidance of the business process

Answer

Transfer of risk to an insurance provider

Answer

Implementation of compensating controls

Question 13

In a quantitative risk analysis, the annualized loss expectancy (ALE) is calculated as $1 million. If the organization implements a control that reduces the ARO from 0.5 to 0.1, and the SLE remains constant at $2 million, what is the new ALE?

Accepted Answer

$200,000. The annualized loss expectancy (ALE) is calculated as SLE × ARO. With SLE constant at $2 million and the new ARO reduced to 0.1, the new ALE is $2,000,000 × 0.1 = $200,000. This reflects the residual risk after the control is implemented.

Answer

$500,000

Answer

$100,000

Answer

$1 million

Question 14

A risk assessment team is prioritizing risks for treatment using inherent risk ratings. Which TWO factors should be considered when deciding which risks to treat first?

Accepted Answer

Cost-benefit analysis of potential controls. Risk ranking by inherent risk score and cost-benefit analysis of controls are key factors in prioritization.

Answer

The asset's replacement value

Answer

The risk owner's department budget

Answer

The number of controls already in place

Question 15

An organization is assessing control effectiveness for a key process. Which TWO aspects should be evaluated to determine if a control is effective?

Accepted Answer

Operating effectiveness. Control effectiveness is assessed based on design adequacy (whether the control is properly designed) and operating effectiveness (whether it works as intended).

Answer

Compliance with industry standards

Answer

Number of control owners

Answer

Cost of implementation