CRISC IT Risk Assessment Practice Test 5 — 15 Questions

Question 1

A company decides to purchase cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment option?

Accepted Answer

Transfer. Purchasing cyber insurance shifts the financial consequences of a data breach to a third party (the insurer) in exchange for a premium. In risk treatment terminology, this is risk transfer (also called risk sharing). The organization still owns the risk of the breach occurring, but the financial impact is contractually transferred, making 'Transfer' the correct answer.

Answer

Mitigate

Answer

Accept

Answer

Avoid

Question 2

After implementing a set of controls, the risk owner calculates the residual risk. Which of the following is true about residual risk?

Accepted Answer

It is the risk that remains after controls are applied. Residual risk is by definition the risk that remains after controls have been applied and risk treatment has occurred. It represents the exposure the organization accepts or must further mitigate after existing safeguards are considered.

Answer

It is not considered in risk treatment decisions

Answer

It is always higher than inherent risk

Answer

It is the risk before any controls are implemented

Question 3

In the FAIR framework, which of the following correctly represents the calculation of Loss Event Frequency (LEF)?

Accepted Answer

LEF = Threat Event Frequency × Vulnerability. In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is calculated as the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This reflects that the frequency of loss events depends on how often a threat event occurs and the probability that the threat event will result in a loss, which is the vulnerability component. The multiplication captures the dependency: even if threats are frequent, low vulnerability reduces LEF, and vice versa.

Answer

LEF = Threat Event Frequency + Vulnerability

Answer

LEF = Asset Value × Vulnerability

Answer

LEF = Annualized Rate of Occurrence × Single Loss Expectancy

Question 4

A risk assessment reveals a high inherent risk that is within the organization's risk appetite. The risk owner documents the risk and formally accepts it. This is an example of which risk treatment option?

Accepted Answer

Accept. When a risk is within appetite, it may be formally accepted with sign-off.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 5

Which control type is primarily focused on identifying that a risk event has occurred?

Accepted Answer

Detective. Detective controls are designed to detect incidents after they happen.

Answer

Compensating

Answer

Preventive

Answer

Corrective

Question 6

An organization assesses a risk and determines the inherent risk score is 20 (critical). After implementing controls, the residual risk score is 8 (medium). What does this indicate about the controls?

Accepted Answer

Controls are effective in reducing risk to a lower level. The reduction from 20 to 8 indicates the controls are effective in reducing risk.

Answer

The residual risk is still critical

Answer

The inherent risk was overestimated

Answer

Controls are ineffective because residual risk is still above zero

Question 7

A company's risk assessment identifies that a threat actor has high capability and motivation to exploit a vulnerability. Which factor does this relate to?

Accepted Answer

Likelihood assessment. Threat actor capability and motivation are factors in likelihood assessment.

Answer

Risk appetite

Answer

Control effectiveness

Answer

Impact assessment

Question 8

Which of the following is an example of a preventive control?

Accepted Answer

Encryption of sensitive data. Encryption of sensitive data is a preventive control because it stops unauthorized parties from reading the data in the first place, even if they gain access to the storage or transmission medium. It acts before an incident causes harm by rendering the data unintelligible without the correct key. This aligns with the CRISC definition of preventive controls, which are designed to deter or stop an event from occurring or reduce its impact before it happens.

Answer

Incident response plan

Answer

Intrusion detection system

Answer

Security logs

Question 9

In assessing control effectiveness, an IS auditor evaluates both design adequacy and operating effectiveness. Which of the following indicates that a control is operating effectively?

Accepted Answer

The control has been tested and works as designed. Operating effectiveness means the control has been tested and consistently produces the intended result in practice. Even if a control is well-designed, it may fail during actual operation due to misconfiguration, human error, or environmental changes. Testing confirms that the control functions as designed under real conditions, which is the definitive indicator of operating effectiveness.

Answer

The control is approved by management

Answer

The control is inexpensive to implement

Answer

The control is documented in policy

Question 10

When performing a risk assessment, which TWO of the following are components of inherent risk?

Accepted Answer

Impact of the risk event. Inherent risk considers likelihood and impact without controls.

Answer

Residual risk level

Answer

Control effectiveness

Answer

Cost-benefit analysis of controls

Question 11

A risk practitioner is using a 5×5 heat map with likelihood and impact ratings. Which of the following is a key advantage of this qualitative risk analysis approach?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using a 5×5 heat map is designed to be quick to perform and easy to communicate visually to non-technical stakeholders. The color-coded matrix (e.g., red for high risk, green for low risk) allows immediate understanding of risk priorities without requiring complex calculations, making it ideal for initial risk assessments and board-level reporting.

Answer

It provides objective, financially meaningful results.

Answer

It eliminates the need for expert judgment in risk assessment.

Answer

It allows direct comparison of risk levels across different organizations.

Question 12

During an IT risk assessment, a risk owner identifies a risk that is within the organization's risk appetite. The recommended risk treatment option is to:

Accepted Answer

Accept the risk with formal sign-off.. When a risk is within appetite, the appropriate response is to accept it, with formal documentation and sign-off by the risk owner.

Answer

Avoid the risk by eliminating the activity.

Answer

Transfer the risk through cyber insurance.

Answer

Mitigate the risk by implementing additional controls.

Question 13

Which of the following is a limitation of quantitative risk analysis?

Accepted Answer

It is data-intensive and time-consuming.. Quantitative risk analysis assigns numeric, often monetary, values to risk using models such as ALE (SLE × ARO) or Monte Carlo simulation. Its principal drawback is that it requires substantial historical loss data, asset valuations, and modeling effort, making it resource-intensive and slow to perform compared with qualitative approaches like risk matrices. This data dependency and time cost is the recognized limitation tested here.

Answer

Results are not comparable across organizations.

Answer

It is subjective and difficult to communicate.

Answer

It does not provide financially meaningful values.

Question 14

Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system (IDS) alerts. An intrusion detection system (IDS) monitors network traffic for suspicious activity and generates alerts when it detects potential threats. This is a detective control because it identifies and reports security incidents after they occur, rather than preventing them. IDS alerts provide visibility into ongoing or past attacks, enabling incident response.

Answer

Backup restoration after data loss

Answer

Firewall rules blocking unauthorized traffic

Answer

Requiring two-factor authentication

Question 15

An organization is considering outsourcing its payroll processing to a third party. The risk assessment shows that the inherent risk of payroll errors is high, but the vendor contract includes liability clauses and the organization obtains cyber insurance. This risk treatment is best described as:

Accepted Answer

Risk transfer. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual liability clauses. Here, the vendor contract includes liability clauses and the organization obtains cyber insurance — both mechanisms shift financial consequences away from the organization. This is the defining characteristic of risk transfer, making it the correct answer.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance