CRISC IT Risk Assessment Practice Test 3 — 15 Questions

Question 1

An organization uses the FAIR framework to assess the risk of a data breach. The risk analyst estimates that the Threat Event Frequency (TEF) is 10 per year, the Vulnerability (V) is 0.2, the Primary Loss per event is $50,000, and the Secondary Loss per event is $30,000. What is the Annualized Loss Expectancy (ALE)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$160,000. FAIR ALE is calculated as TEF × Vulnerability × (Primary Loss + Secondary Loss). Here: 10 × 0.2 = 2 expected loss events per year; 2 × ($50,000 + $30,000) = 2 × $80,000 = $160,000. So the Annualized Loss Expectancy is $160,000.

Answer

$100,000

Answer

$800,000

Answer

$80,000

Question 2

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. Risk avoidance is the treatment option that involves completely eliminating the activity or process that gives rise to the risk. By not performing the activity, the organization removes the risk entirely rather than trying to reduce, transfer, or tolerate it. This is the correct answer because the question explicitly asks for the option that involves eliminating the activity that creates the risk.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 3

A risk analyst is performing a quantitative risk analysis using the FAIR framework. Which TWO factors are multiplied to calculate Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency. LEF = Threat Event Frequency (TEF) × Vulnerability (V).

Answer

Loss Magnitude

Answer

Annualized Rate of Occurrence

Answer

Single Loss Expectancy

Question 4

A financial services firm is conducting an IT risk assessment for a legacy trading platform. The risk team identifies that the platform has a high likelihood of failure due to outdated hardware, but the impact is considered low because a redundant system can take over within minutes. The risk owner proposes to replace the hardware next fiscal year. Which risk response is being applied?

Accepted Answer

Risk mitigation. The risk owner is choosing to replace outdated hardware to reduce the high likelihood of failure, which is a classic risk mitigation strategy. Mitigation aims to lower risk to an acceptable level through controls or improvements. Since the action directly addresses the root cause, it is not avoidance, acceptance, or transfer.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 5

A financial services firm is assessing risk for a new mobile banking application. The risk team has identified that the application's backend API has no rate limiting, allowing attackers to enumerate account numbers. The business owner argues that because the mobile app itself uses certificate pinning, the risk is already mitigated. Which risk assessment concept should the risk practitioner use to explain why the API vulnerability still represents a significant risk?

Accepted Answer

Control gap analysis. Control gap analysis is the correct approach because it maps required controls to existing controls and reveals that certificate pinning addresses only the client communication channel, leaving the API rate-limiting control objective unmet. This structured comparison directly counters the assumption that one implemented control secures the entire transaction path, and it provides the business owner with a clear view of the residual exposure that still requires treatment.

Answer

Business impact analysis

Answer

Risk appetite statement review

Answer

Threat modeling using STRIDE

Question 6

A risk analyst is evaluating the effectiveness of a set of controls designed to mitigate the risk of unauthorized access to a database containing personally identifiable information. The analyst must identify which controls are preventive. (Choose two.)

Accepted Answer

Role-based access control restricting database permissions to authorized job roles.. Preventive controls stop unauthorized access before it occurs. Role-based access control enforces least privilege at the point of access, and multi-factor authentication adds a strong verification step that blocks credential-based attacks. Both act proactively. Monitoring and log review are detective, and encryption at rest addresses impact rather than access prevention.

Answer

Database activity monitoring generating alerts on anomalous queries.

Answer

Reviewing database access logs monthly for unusual activity.

Answer

Encryption of the database at rest using strong cryptographic algorithms.

Question 7

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Accepted Answer

Quick and easy to communicate. A 5×5 risk heat map is a qualitative tool that plots likelihood against impact using ordinal scales, making it fast to produce and easy for executives and non-technical stakeholders to interpret at a glance. Its primary advantage is communication and speed, not quantitative precision.

Answer

Eliminates subjectivity in risk assessment

Answer

Provides comparable results across organizations

Answer

Produces financially meaningful results

Question 8

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Accepted Answer

Controls are effective in reducing the risk level. Inherent risk of 25 (5×5 matrix, maximum) dropping to residual risk of 9 after control evaluation demonstrates that the controls materially reduced the risk exposure. A reduction from 25 to 9 is significant, indicating the controls are functioning as intended to mitigate the identified threat. This is the standard interpretation in CRISC risk analysis.

Answer

Additional controls are unnecessary

Answer

Controls are not effective because residual risk remains

Answer

The inherent risk was overestimated

Question 9

Which of the following is a detective control for an information system?

Accepted Answer

Intrusion detection system. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for malicious actions or policy violations and generates alerts when such events occur. Unlike preventive controls, an IDS does not block or stop the attack; it detects and reports it after the fact, enabling incident response.

Answer

Data backup

Answer

Encryption

Answer

Firewall

Question 10

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

Accepted Answer

ALE = $100,000; expected annual loss. ALE (Annualized Loss Expectancy) is calculated as ARO × SLE. With an ARO of 0.5 (the event is expected to occur once every two years) and an SLE of $200,000, the ALE is 0.5 × $200,000 = $100,000. This figure represents the expected average annual financial loss from this risk, which is the value used to justify the cost of controls.

Answer

ALE = $400,000; maximum possible loss

Answer

ALE = $100,000; single loss expectancy

Answer

ALE = $200,000; annual cost of controls

Question 11

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. (Avoid) is correct because risk avoidance involves discontinuing the activity or process that gives rise to the risk. In IT risk management, this means removing the vulnerable system, decommissioning a service, or ceasing a business function entirely to eliminate the risk exposure. For example, if an organization decides to shut down a legacy FTP server to avoid the risk of data interception, it is applying the avoid treatment.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 12

A risk practitioner is prioritizing IT risks for treatment. Which factor should be the PRIMARY basis for prioritization?

Accepted Answer

Risk level (inherent or residual). Risk prioritization must be driven by the level of risk itself — whether inherent or residual — because that reflects the likelihood and impact the organization actually faces. CRISC frames risk treatment as a response to evaluated risk, so the magnitude of risk determines what gets addressed first. Ease, cost, and personal preference are inputs to the treatment decision, not the primary basis for ranking risks.

Answer

Ease of implementing controls

Answer

Cost of controls

Answer

Business unit manager's preference

Question 13

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

Accepted Answer

Threat Event Frequency (TEF). In the FAIR model, Threat Event Frequency (TEF) is the component that estimates how often, within a given timeframe, a threat agent (such as a hacker or malware) will initiate an action against an asset. This directly matches the question's definition of 'probable frequency that a threat agent will act against an asset.' TEF is a primary input for calculating Loss Event Frequency (LEF) and ultimately risk.

Answer

Vulnerability

Answer

Loss Event Frequency (LEF)

Answer

Annualized Rate of Occurrence (ARO)

Question 14

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Accepted Answer

High. Risk score = 3 × 4 = 12, which falls in the high range (12-25).

Answer

Critical

Answer

Medium

Answer

Low

Question 15

Which type of control is designed to reduce the likelihood of a risk event occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

Answer

Corrective

Answer

Compensating

Answer

Detective