CRISC IT Risk Assessment Practice Test 3 — 15 Questions

Question 1

A risk manager is evaluating the impact assessment for a potential data breach. Which THREE categories of impact should be considered in a comprehensive business impact analysis?

Accepted Answer

Operational impact (system downtime, productivity loss). Comprehensive business impact analysis considers various impact categories. For this data breach scenario, the three categories selected are operational (system downtime and productivity loss), regulatory (fines and mandatory remediation), and financial (direct and indirect costs). These three are commonly included in BIA. Reputational impact is also important but is not among the chosen options.

Answer

Technological impact (obsolescence of hardware)

Answer

Environmental impact (pollution, waste)

Question 2

A risk analyst uses a 5x5 heat map to evaluate a set of IT risks. For a particular risk, the likelihood is rated as 4 (likely) and impact as 5 (very high). What is the resulting risk rating?

Accepted Answer

Critical. In a 5x5 heat map, risk rating is typically the product or sum of likelihood and impact. With likelihood 4 and impact 5, the product is 20, which falls in the critical category.

Answer

Low

Answer

Medium

Answer

High

Question 3

An organization using the FAIR framework estimates that a threat event frequency (TEF) is 10 per year, vulnerability is 0.2, and loss magnitude per event is $500,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The FAIR framework calculates ALE as TEF × Vulnerability × Loss Magnitude. Here, 10 × 0.2 × $500,000 = $1,000,000. This correctly incorporates the vulnerability factor (0.2) as a probability of threat success, yielding the expected annual loss.

Answer

$500,000

Answer

$100,000

Answer

$2,500,000

Question 4

Which of the following best describes an advantage of qualitative risk analysis over quantitative risk analysis?

Accepted Answer

It is quick and easy to communicate. Qualitative analysis is quick and easy to communicate, while quantitative is more objective but data-intensive.

Answer

It is objective and comparable across organizations

Answer

It requires less data than quantitative analysis

Answer

It provides financially meaningful results

Question 5

A company decides to purchase cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment option?

Accepted Answer

Transfer. Transferring risk to a third party through insurance is a classic risk transfer strategy.

Answer

Mitigate

Answer

Accept

Answer

Avoid

Question 6

After implementing a set of controls, the risk owner calculates the residual risk. Which of the following is true about residual risk?

Accepted Answer

It is the risk that remains after controls are applied. Residual risk is the risk remaining after controls are applied, and it should be within the risk appetite.

Answer

It is not considered in risk treatment decisions

Answer

It is always higher than inherent risk

Answer

It is the risk before any controls are implemented

Question 7

In the FAIR framework, which of the following correctly represents the calculation of Loss Event Frequency (LEF)?

Accepted Answer

LEF = Threat Event Frequency × Vulnerability. In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is calculated as the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This reflects that the frequency of loss events depends on how often a threat event occurs and the probability that the threat event will result in a loss, which is the vulnerability component. The multiplication captures the dependency: even if threats are frequent, low vulnerability reduces LEF, and vice versa.

Answer

LEF = Threat Event Frequency + Vulnerability

Answer

LEF = Asset Value × Vulnerability

Answer

LEF = Annualized Rate of Occurrence × Single Loss Expectancy

Question 8

A risk assessment reveals a high inherent risk that is within the organization's risk appetite. The risk owner documents the risk and formally accepts it. This is an example of which risk treatment option?

Accepted Answer

Accept. When a risk is within appetite, it may be formally accepted with sign-off.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 9

Which control type is primarily focused on identifying that a risk event has occurred?

Accepted Answer

Detective. Detective controls are designed to detect incidents after they happen.

Answer

Compensating

Answer

Preventive

Answer

Corrective

Question 10

An organization assesses a risk and determines the inherent risk score is 20 (critical). After implementing controls, the residual risk score is 8 (medium). What does this indicate about the controls?

Accepted Answer

Controls are effective in reducing risk to a lower level. The reduction from 20 to 8 indicates the controls are effective in reducing risk.

Answer

The residual risk is still critical

Answer

The inherent risk was overestimated

Answer

Controls are ineffective because residual risk is still above zero

Question 11

A company's risk assessment identifies that a threat actor has high capability and motivation to exploit a vulnerability. Which factor does this relate to?

Accepted Answer

Likelihood assessment. Threat actor capability and motivation are factors in likelihood assessment.

Answer

Risk appetite

Answer

Control effectiveness

Answer

Impact assessment

Question 12

Which of the following is an example of a preventive control?

Accepted Answer

Encryption of sensitive data. Encryption prevents unauthorized access, making it preventive.

Answer

Incident response plan

Answer

Intrusion detection system

Answer

Security logs

Question 13

In assessing control effectiveness, an IS auditor evaluates both design adequacy and operating effectiveness. Which of the following indicates that a control is operating effectively?

Accepted Answer

The control has been tested and works as designed. Operating effectiveness means the control has been tested and consistently produces the intended result in practice. Even if a control is well-designed, it may fail during actual operation due to misconfiguration, human error, or environmental changes. Testing confirms that the control functions as designed under real conditions, which is the definitive indicator of operating effectiveness.

Answer

The control is approved by management

Answer

The control is inexpensive to implement

Answer

The control is documented in policy

Question 14

A risk assessment identifies that a critical application has a vulnerability with a high likelihood of exploitation. The risk owner proposes to implement a web application firewall (WAF) as a mitigating control. Which TWO of the following are likely benefits of this control?

Accepted Answer

Reduces the likelihood of successful exploitation. A WAF reduces the likelihood of successful exploitation by inspecting and filtering HTTP/HTTPS traffic for common attack patterns such as SQL injection and cross-site scripting (XSS). It blocks malicious payloads before they reach the application, directly lowering the probability that a vulnerability will be exploited. This aligns with the risk mitigation strategy of reducing threat exposure.

Answer

Transfers the risk to the vendor

Answer

Eliminates the need for other controls

Answer

Eliminates all residual risk

Question 15

An organization is evaluating the impact of a potential data breach. Which THREE of the following are considered indirect financial impacts?

Accepted Answer

Legal fees from lawsuits. Indirect financial impacts include lost business, reputation damage, and opportunity costs.

Answer

Incident response costs

Answer

Notification costs to affected individuals