CRISC IT Risk Assessment Practice Test 4 — 15 Questions

Question 1

When performing a risk assessment, which TWO of the following are components of inherent risk?

Accepted Answer

Impact of the risk event. Inherent risk considers likelihood and impact without controls.

Answer

Residual risk level

Answer

Control effectiveness

Answer

Cost-benefit analysis of controls

Question 2

A risk practitioner is using a 5×5 heat map with likelihood and impact ratings. Which of the following is a key advantage of this qualitative risk analysis approach?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using a 5×5 heat map is designed to be quick to perform and easy to communicate visually to non-technical stakeholders. The color-coded matrix (e.g., red for high risk, green for low risk) allows immediate understanding of risk priorities without requiring complex calculations, making it ideal for initial risk assessments and board-level reporting.

Answer

It provides objective, financially meaningful results.

Answer

It eliminates the need for expert judgment in risk assessment.

Answer

It allows direct comparison of risk levels across different organizations.

Question 3

An organization is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, the vulnerability is 0.2, and the loss magnitude is $500,000 per event. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. ALE = ARO × SLE. In FAIR, LEF = TEF × Vulnerability = 10 × 0.2 = 2 events per year. SLE is the loss magnitude per event, $500,000. ALE = 2 × $500,000 = $1,000,000.

Answer

$500,000

Answer

$5,000,000

Answer

$100,000

Question 4

During an IT risk assessment, a risk owner identifies a risk that is within the organization's risk appetite. The recommended risk treatment option is to:

Accepted Answer

Accept the risk with formal sign-off.. When a risk is within appetite, the appropriate response is to accept it, with formal documentation and sign-off by the risk owner.

Answer

Avoid the risk by eliminating the activity.

Answer

Transfer the risk through cyber insurance.

Answer

Mitigate the risk by implementing additional controls.

Question 5

Which of the following is a limitation of quantitative risk analysis?

Accepted Answer

It is data-intensive and time-consuming.. Quantitative analysis requires detailed data and is time-consuming, which can be a significant limitation.

Answer

Results are not comparable across organizations.

Answer

It is subjective and difficult to communicate.

Answer

It does not provide financially meaningful values.

Question 6

A company has an inherent risk score of 20 for a specific threat. After implementing controls, the control effectiveness is assessed as 60% (design adequacy 70%, operating effectiveness 85%). What is the approximate residual risk score?

Accepted Answer

8. Residual risk = Inherent risk × (1 - Control effectiveness). Control effectiveness = 0.6. Residual risk = 20 × 0.4 = 8.

Answer

14

Answer

6

Answer

12

Question 7

Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system (IDS) alerts. An intrusion detection system (IDS) monitors network traffic for suspicious activity and generates alerts when it detects potential threats. This is a detective control because it identifies and reports security incidents after they occur, rather than preventing them. IDS alerts provide visibility into ongoing or past attacks, enabling incident response.

Answer

Backup restoration after data loss

Answer

Firewall rules blocking unauthorized traffic

Answer

Requiring two-factor authentication

Question 8

An organization is considering outsourcing its payroll processing to a third party. The risk assessment shows that the inherent risk of payroll errors is high, but the vendor contract includes liability clauses and the organization obtains cyber insurance. This risk treatment is best described as:

Accepted Answer

Risk transfer. Transfer involves shifting risk to a third party, such as through outsourcing with contractual liability transfer and insurance.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 9

When prioritizing risk treatment actions, which of the following should be the primary consideration?

Accepted Answer

Risk level and cost-benefit analysis. Prioritization should be based on the risk level (score) and the cost-benefit analysis of controls to ensure efficient resource allocation.

Answer

Ease of implementation

Answer

Compliance requirements only

Answer

Risk owner preference

Question 10

In the FAIR framework, Loss Event Frequency (LEF) is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. FAIR defines LEF = Threat Event Frequency × Vulnerability (probability that a threat event results in a loss event).

Answer

Threat Event Frequency + Vulnerability

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Answer

Loss Magnitude × Vulnerability

Question 11

Which of the following best describes residual risk?

Accepted Answer

Risk after assessing control effectiveness. Residual risk is the risk that remains after management has implemented risk responses and assessed the effectiveness of existing controls. It is calculated by considering the inherent risk (risk without controls) and the risk reduction provided by controls, factoring in control gaps or weaknesses. Option D correctly captures this definition by emphasizing the assessment of control effectiveness.

Answer

Risk that is transferred to a third party

Answer

Risk that is avoided by eliminating the activity

Answer

Risk without any controls in place

Question 12

A risk assessment reveals that the likelihood of a phishing attack is high, and the impact is moderate. The organization decides to implement security awareness training and email filtering. This is an example of which risk treatment?

Accepted Answer

Risk mitigation. Mitigation involves implementing controls to reduce likelihood (training reduces susceptibility) or impact (filtering reduces successful attacks).

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 13

In qualitative risk analysis, a risk with a likelihood rating of 'High' and an impact rating of 'High' on a 5×5 heat map would typically be classified as:

Accepted Answer

Critical. A 5×5 heat map often uses 'Critical' for the highest risk level (5×5).

Answer

High

Answer

Low

Answer

Medium

Question 14

An organization is assessing control effectiveness for a firewall. Which THREE factors should be evaluated to determine control effectiveness? (Select THREE)

Accepted Answer

Design adequacy of the firewall rules. Control effectiveness is a combination of design adequacy and operating effectiveness. Additionally, the control's ability to address the specific risk (relevance) is important. Frequency alone does not determine effectiveness.

Answer

Cost of the firewall

Answer

Frequency of rule updates

Question 15

A company is considering risk transfer for a new IT project. Which TWO options represent valid risk transfer mechanisms? (Select TWO)

Accepted Answer

Purchasing cyber insurance. Cyber insurance and outsourcing with contractual liability transfer are classic examples of risk transfer. Accepting, avoiding, and mitigating are not transfer.

Answer

Accepting the risk with sign-off

Answer

Implementing access controls

Answer

Discontinuing the project