CRISC IT Risk Assessment Practice Test 5 — 15 Questions

Question 1

An IT risk assessment team is using a 5×5 risk matrix with likelihood and impact ratings. A risk scenario is rated as likelihood = 4 (likely) and impact = 5 (catastrophic). According to the typical heat map, what would be the risk rating?

Accepted Answer

Critical. In a 5×5 matrix, likelihood 4 and impact 5 give a product of 20, which is typically in the 'critical' range. Common thresholds: 1-5 low, 6-10 medium, 11-15 high, 16-25 critical.

Answer

High

Answer

Medium

Answer

Low

Question 2

A company uses the FAIR model to perform a quantitative risk analysis. The threat event frequency (TEF) is estimated at 10 per year, vulnerability (V) is 0.5, and loss magnitude (LM) per event is $50,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. FAIR: LEF = TEF × V = 10 × 0.5 = 5 events/year. ALE = LEF × LM = 5 × $50,000 = $250,000.

Answer

$25,000

Answer

$50,000

Answer

$500,000

Question 3

A risk analyst is assessing a critical application's inherent risk. After implementing controls, the residual risk is calculated as high. The analyst determines that the control design is adequate but operating effectiveness is poor. Which factor most likely explains the high residual risk?

Accepted Answer

Control operating effectiveness is poor. Residual risk = inherent risk adjusted for control effectiveness. If controls are well-designed but not operating effectively, they fail to reduce risk as intended, leading to high residual risk.

Answer

Control design is inadequate

Answer

Risk appetite was misstated

Answer

Inherent risk is too low

Question 4

Which risk treatment option is being used when an organization decides to stop a business activity that creates a high-risk exposure?

Accepted Answer

Avoid. When an organization stops a business activity that creates high-risk exposure, it is applying the risk avoidance treatment option. This is a deliberate decision to eliminate the risk entirely by discontinuing the associated process, system, or operation, rather than attempting to reduce or transfer the residual risk. In IT risk management, avoidance is often chosen when the cost or impact of mitigation exceeds the benefit of the activity, or when the risk level is intolerable under any control scenario.

Answer

Accept

Answer

Mitigate

Answer

Transfer

Question 5

An organization is considering purchasing cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment option?

Accepted Answer

Transfer. Transferring risk to a third party, such as an insurance company, is a risk transfer strategy. The insurance company assumes the financial risk in exchange for premiums.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 6

In a qualitative risk assessment, a risk owner argues that the likelihood of a cyberattack is low because the organization has strong perimeter defenses. However, the analyst notes that the impact would be catastrophic. Which limitation of qualitative analysis is most relevant?

Accepted Answer

It relies on subjective judgments. Qualitative analysis is subjective; different stakeholders may interpret likelihood and impact differently based on their perspectives. The risk owner's judgment may be biased by existing controls.

Answer

It is not comparable across organizations

Answer

It is time-consuming and data-intensive

Answer

It does not produce financial values

Question 7

A company calculates the annualized loss expectancy (ALE) for a server failure as $150,000. After implementing a backup solution costing $20,000 per year, the ALE drops to $30,000. What is the annualized benefit of the control?

Accepted Answer

$100,000. Annualized benefit = reduction in ALE - annual control cost. Reduction in ALE = $150k - $30k = $120k. Benefit = $120k - $20k = $100k.

Answer

$130,000

Answer

$120,000

Answer

$20,000

Question 8

Which of the following is a detective control?

Accepted Answer

Intrusion detection system. Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.

Answer

Data encryption

Answer

Backup and restore

Answer

Firewall

Question 9

A risk is assessed with inherent risk score of 25 on a 5x5 matrix. After implementing controls, the residual risk score is 10. The control effectiveness is considered:

Accepted Answer

Moderately effective. Control effectiveness can be measured as reduction in risk score. Inherent 25 to residual 10 is a 60% reduction (15/25). This indicates controls are moderately effective, but not extremely.

Answer

Not measurable

Answer

Highly effective

Answer

Ineffective

Question 10

When prioritizing risk treatment actions, which of the following should be the primary consideration?

Accepted Answer

Risk level and cost-benefit analysis. Risk prioritization should balance the risk level (high vs low) and the cost-benefit of controls. High risks with cost-effective controls should be prioritized.

Answer

Ease of implementation

Answer

Regulatory compliance only

Answer

Risk owner preference

Question 11

In the FAIR model, 'Loss Event Frequency' is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. In the FAIR model, Loss Event Frequency (LEF) is the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This represents how often a threat agent successfully exploits a weakness, making option B correct. The formula is LEF = TEF × Vuln, where Vulnerability is the probability that a threat event will result in a loss.

Answer

Threat Event Frequency × Asset Value

Answer

Threat Event Frequency × Loss Magnitude

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Question 12

Which of the following is an example of a corrective control?

Accepted Answer

Incident response plan. Corrective controls respond to and recover from risk events. Incident response procedures are corrective because they address incidents after they occur.

Answer

Access control list

Answer

Security awareness training

Answer

Log monitoring

Question 13

An organization is evaluating whether to accept a risk. Which TWO conditions must be met for risk acceptance to be appropriate?

Accepted Answer

The risk owner formally documents and accepts the risk. Acceptance requires that the risk is within the organization's risk appetite and that the risk owner formally documents and signs off the acceptance. It is not appropriate if controls are available or if the risk exceeds appetite.

Answer

The risk can be transferred to an insurer

Answer

The risk is high but unavoidable

Answer

A cost-effective control is available

Question 14

A quantitative risk analysis using FAIR requires estimating which THREE primary factors?

Accepted Answer

Vulnerability. FAIR decomposes risk into threat event frequency, vulnerability, and loss magnitude. These are the main input factors for calculating risk.

Answer

Risk appetite

Answer

Control cost

Question 15

A risk analyst is assessing the impact of a potential ransomware attack. Which THREE categories of business impact should be considered?

Accepted Answer

Operational downtime. Operational downtime (B) is a direct consequence of a ransomware attack, as encryption of critical systems halts business processes, leading to lost productivity and revenue. This category is essential for impact assessment because it quantifies the duration and scope of service disruption, which directly affects operational continuity.

Answer

Geographic diversity

Answer

Technical complexity