CRISC IT Risk Assessment Practice Test 6 — 15 Questions

Question 1

When prioritizing risk treatment actions, which of the following should be the primary consideration?

Accepted Answer

Risk level and cost-benefit analysis. Risk treatment prioritization should be driven by the level of risk (likelihood and impact) combined with a cost-benefit analysis of the treatment options. This ensures that resources are allocated to the most significant risks where the treatment provides the greatest reduction in risk relative to its cost, aligning with business objectives and risk appetite.

Answer

Ease of implementation

Answer

Compliance requirements only

Answer

Risk owner preference

Question 2

In the FAIR framework, Loss Event Frequency (LEF) is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is the probable frequency of loss events in a given timeframe. It is derived by multiplying Threat Event Frequency (TEF) — how often a threat agent acts — by Vulnerability, which is the probability that a threat event becomes a loss event. This product yields LEF.

Answer

Threat Event Frequency + Vulnerability

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Answer

Loss Magnitude × Vulnerability

Question 3

Which of the following best describes residual risk?

Accepted Answer

Risk after assessing control effectiveness. Residual risk is the risk that remains after management has implemented risk responses and assessed the effectiveness of existing controls. It is calculated by considering the inherent risk (risk without controls) and the risk reduction provided by controls, factoring in control gaps or weaknesses. Option D correctly captures this definition by emphasizing the assessment of control effectiveness.

Answer

Risk that is transferred to a third party

Answer

Risk that is avoided by eliminating the activity

Answer

Risk without any controls in place

Question 4

A risk assessment reveals that the likelihood of a phishing attack is high, and the impact is moderate. The organization decides to implement security awareness training and email filtering. This is an example of which risk treatment?

Accepted Answer

Risk mitigation. Risk mitigation (also called risk reduction) involves taking actions to reduce the likelihood and/or impact of a risk. Implementing security awareness training reduces the likelihood of successful phishing, and email filtering reduces both likelihood and impact. This is the classic definition of mitigation.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 5

An organization is assessing control effectiveness for a firewall. Which THREE factors should be evaluated to determine control effectiveness? (Select THREE)

Accepted Answer

Design adequacy of the firewall rules. Design adequacy of the firewall rules (A) is correct because control effectiveness begins with whether the ruleset is properly architected to enforce the intended security policy, including correct default-deny posture, rule ordering, and coverage of required traffic flows. Operating effectiveness of the firewall (B) is correct because even a well-designed ruleset must be verified to actually function as intended in production, through testing, monitoring, and evidence that the control operates consistently over time. Relevance to the specific risk scenario (D) is correct because a control is only effective if it directly addresses the identified risk; a technically sound firewall that does not mitigate the specific threat in scope provides no assurance for that scenario. Cost of the firewall (C) is not a factor in determining control effectiveness, as it relates to budgeting and cost-benefit rather than whether the control actually mitigates risk. Frequency of rule updates (E) is not itself an effectiveness factor, since the quality and appropriateness of changes matter more than how often they occur, and it is subsumed under design adequacy and operating effectiveness.

Answer

Cost of the firewall

Answer

Frequency of rule updates

Question 6

A company is considering risk transfer for a new IT project. Which TWO options represent valid risk transfer mechanisms? (Select TWO)

Accepted Answer

Purchasing cyber insurance. Option B (Purchasing cyber insurance) is a valid risk transfer mechanism because the organization pays a premium to shift the financial impact of covered cyber events, such as data breaches or ransomware, to the insurer. Option E (Outsourcing with liability clauses) is also valid risk transfer because contractual liability clauses shift specified responsibilities and financial consequences for incidents to the third-party vendor. Option A (Accepting the risk with sign-off) is risk acceptance, not transfer, since the organization retains the risk. Option C (Implementing access controls) is risk mitigation/reduction through preventive controls. Option D (Discontinuing the project) is risk avoidance, as the activity creating the risk is eliminated.

Answer

Accepting the risk with sign-off

Answer

Implementing access controls

Answer

Discontinuing the project

Question 7

A company uses the FAIR model to perform a quantitative risk analysis. The threat event frequency (TEF) is estimated at 10 per year, vulnerability (V) is 0.5, and loss magnitude (LM) per event is $50,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. In the FAIR model, ALE = TEF × Vulnerability × Loss Magnitude. Here, TEF = 10, V = 0.5, LM = $50,000. So ALE = 10 × 0.5 × $50,000 = $250,000. This represents the expected annual loss from the risk event.

Answer

$25,000

Answer

$50,000

Answer

$500,000

Question 8

A risk analyst is assessing a critical application's inherent risk. After implementing controls, the residual risk is calculated as high. The analyst determines that the control design is adequate but operating effectiveness is poor. Which factor most likely explains the high residual risk?

Accepted Answer

Control operating effectiveness is poor. Residual risk is the risk remaining after controls are applied, and it is a function of both control design and control operating effectiveness. The scenario explicitly states the design is adequate but operating effectiveness is poor, meaning the controls exist on paper but are not functioning as intended in practice. Poor operating effectiveness therefore leaves the original inherent risk largely unmitigated, producing a high residual risk despite good design.

Answer

Control design is inadequate

Answer

Risk appetite was misstated

Answer

Inherent risk is too low

Question 9

Which risk treatment option is being used when an organization decides to stop a business activity that creates a high-risk exposure?

Accepted Answer

Avoid. When an organization stops a business activity that creates high-risk exposure, it is applying the risk avoidance treatment option. This is a deliberate decision to eliminate the risk entirely by discontinuing the associated process, system, or operation, rather than attempting to reduce or transfer the residual risk. In IT risk management, avoidance is often chosen when the cost or impact of mitigation exceeds the benefit of the activity, or when the risk level is intolerable under any control scenario.

Answer

Accept

Answer

Mitigate

Answer

Transfer

Question 10

An organization is considering purchasing cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment option?

Accepted Answer

Transfer. Purchasing cyber insurance transfers the financial consequences of a data breach to an insurer in exchange for premiums, which is the definition of risk transfer. The organization retains some residual risk (deductibles, uncovered losses, reputational damage), but the primary treatment mechanism is transfer. This is distinct from mitigation, which reduces likelihood or impact through controls.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 11

In a qualitative risk assessment, a risk owner argues that the likelihood of a cyberattack is low because the organization has strong perimeter defenses. However, the analyst notes that the impact would be catastrophic. Which limitation of qualitative analysis is most relevant?

Accepted Answer

It relies on subjective judgments. Qualitative risk assessment relies on subjective judgments, such as the risk owner's belief that strong perimeter defenses make an attack unlikely, despite the analyst's view that impact would be catastrophic. This subjectivity can lead to inconsistent or biased risk ratings. The scenario highlights how personal opinion can skew likelihood estimates, which is a core limitation of qualitative analysis.

Answer

It is not comparable across organizations

Answer

It is time-consuming and data-intensive

Answer

It does not produce financial values

Question 12

Which of the following is a detective control?

Accepted Answer

Intrusion detection system. Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.

Answer

Data encryption

Answer

Backup and restore

Answer

Firewall

Question 13

In the FAIR model, 'Loss Event Frequency' is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. In the FAIR model, Loss Event Frequency (LEF) is the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This represents how often a threat agent successfully exploits a weakness, making option B correct. The formula is LEF = TEF × Vuln, where Vulnerability is the probability that a threat event will result in a loss.

Answer

Threat Event Frequency × Asset Value

Answer

Threat Event Frequency × Loss Magnitude

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Question 14

Which of the following is an example of a corrective control?

Accepted Answer

Incident response plan. A corrective control is designed to remediate or restore after an incident has occurred, reducing the impact and returning the environment to normal operation. An incident response plan is the canonical example: it defines the procedures, roles, and steps to contain, eradicate, and recover from a security incident. It acts after the fact, which is the defining characteristic of a corrective control.

Answer

Access control list

Answer

Security awareness training

Answer

Log monitoring

Question 15

An organization is evaluating whether to accept a risk. Which TWO conditions must be met for risk acceptance to be appropriate?

Accepted Answer

The risk owner formally documents and accepts the risk. Risk acceptance is only appropriate when the risk owner formally documents and accepts the risk (B), because accountability for the residual risk must be explicitly acknowledged by the party who owns it, ensuring the decision is authorized and auditable. It is also required that the risk falls within the organization's risk appetite (E), since accepting a risk that exceeds the defined tolerance would violate the risk management framework and require treatment instead. Options A, C, and D do not justify acceptance: transferring risk to an insurer (A) is risk transference, not acceptance; a high but unavoidable risk (C) still needs to be within appetite and formally accepted, and 'unavoidable' alone is not a valid criterion; and having a cost-effective control available (D) argues for risk mitigation rather than acceptance.

Answer

The risk can be transferred to an insurer

Answer

The risk is high but unavoidable

Answer

A cost-effective control is available