CRISC IT Risk Assessment Practice Test 6 — 15 Questions

Question 1

A risk practitioner is using a 5×5 heat map to assess IT risks. Which of the following is the primary advantage of this qualitative approach?

Accepted Answer

Requires less data and time to implement. A 5×5 heat map is a qualitative risk assessment tool that uses ordinal scales (e.g., low, medium, high) for likelihood and impact. Its primary advantage is that it requires less data and time to implement compared to quantitative methods, which demand detailed financial data and complex calculations. This makes it practical for rapid, high-level IT risk prioritization when precise data is unavailable.

Answer

Produces financially meaningful loss estimates

Answer

Provides objective and comparable risk scores across organizations

Answer

Eliminates subjectivity in risk ratings

Question 2

An organization is evaluating the risk of a data breach using the FAIR framework. Which of the following components is part of Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency. In FAIR, Loss Event Frequency = Threat Event Frequency × Vulnerability.

Answer

Annualized Loss Expectancy

Answer

Primary Loss

Answer

Secondary Loss

Question 3

Which risk treatment option involves formally acknowledging the risk and taking no further action, provided the risk is within the organization's risk appetite?

Accepted Answer

Accept. Acceptance is a formal decision to tolerate a risk within appetite, with documented sign-off.

Answer

Avoid

Answer

Transfer

Answer

Mitigate

Question 4

A company is assessing the risk of a ransomware attack. The security team estimates the threat event frequency as 2 attacks per year, vulnerability as 0.3 (30% chance of success), primary loss as $500,000, and secondary loss as $200,000. What is the annualized loss expectancy (ALE) using the FAIR framework?

Accepted Answer

$420,000. The FAIR framework calculates ALE as Threat Event Frequency × Vulnerability × (Primary Loss + Secondary Loss). Here, 2 × 0.3 × ($500,000 + $200,000) = 2 × 0.3 × $700,000 = $420,000. This correctly accounts for the probability of a successful attack and the total loss per incident.

Answer

$700,000

Answer

$210,000

Answer

$1,400,000

Question 5

During an IT risk assessment, the risk owner identifies a high inherent risk for a legacy system. After implementing a firewall and intrusion detection system, the residual risk is calculated. Which of the following best describes residual risk?

Accepted Answer

The risk level after considering control effectiveness. Residual risk is the level of risk that remains after controls have been implemented and their effectiveness has been factored in. In this scenario, the firewall and intrusion detection system are controls that reduce the inherent risk, but some risk (e.g., from zero-day exploits or misconfigurations) will persist, which is the residual risk.

Answer

The risk level before any controls are implemented

Answer

The risk that is transferred to a third party

Answer

The risk that is accepted without action

Question 6

A bank is evaluating the impact of a potential system outage. Which of the following is an example of a direct financial cost associated with this impact?

Accepted Answer

Cost of system restoration. Direct financial costs include incident response, recovery, and notification costs.

Answer

Share price decline

Answer

Regulatory fines

Answer

Loss of customer trust

Question 7

An organization decides to outsource its data center operations to a cloud provider with strict contractual penalties for security breaches. This is an example of which risk treatment option?

Accepted Answer

Transfer. Transferring risk shifts the financial consequences to a third party, such as through outsourcing or insurance.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 8

A risk assessment identifies a critical vulnerability in a web application. Which control type would be most effective in preventing exploitation of this vulnerability?

Accepted Answer

Preventive control such as patching the vulnerability. Preventive controls aim to stop the risk event from occurring; patching is a classic preventive control.

Answer

Compensating control such as additional monitoring

Answer

Corrective control such as backup restoration

Answer

Detective control such as log monitoring

Question 9

During a risk assessment, a risk is assigned a likelihood of 'High' and an impact of 'Medium' on a 5×5 heat map. What is the risk rating?

Accepted Answer

High. On a 5×5 matrix, High likelihood × Medium impact typically results in a High risk rating (e.g., 4×3 = 12, which is often in the high range).

Answer

Critical

Answer

Low

Answer

Medium

Question 10

A risk manager is prioritizing risks based on their inherent risk scores. Which of the following factors should be considered when prioritizing treatment actions?

Accepted Answer

The cost-benefit analysis of controls. Prioritization should consider the risk level and the cost-benefit of controls to ensure efficient use of resources.

Answer

The residual risk after controls

Answer

Only the inherent risk score

Answer

The likelihood of control failure

Question 11

A quantitative risk analysis for a phishing campaign estimates that threat event frequency is 50 per year, vulnerability is 0.1 (10% of users will click), and loss magnitude per successful attack is $10,000. However, the analyst notes a 90% confidence interval of $5,000 to $20,000 for loss magnitude. Which of the following best describes a limitation of this quantitative analysis?

Accepted Answer

The analysis requires extensive data and is time-consuming. Quantitative analysis often produces uncertainty ranges, making results less precise than they appear, and requiring careful interpretation.

Answer

The analysis is subjective and not comparable across organizations

Answer

The results are always accurate and reliable

Answer

The results are easy to communicate to non-technical stakeholders

Question 12

An organization has implemented a firewall (preventive), intrusion detection system (detective), and a backup restoration plan (corrective) to address a specific risk. The risk manager assesses the control effectiveness as follows: design adequacy is strong, but operating effectiveness is weak due to inconsistent patching. Which of the following best describes the residual risk?

Accepted Answer

Residual risk is lower than inherent risk but still significant due to weak operating effectiveness. Residual risk is inherent risk adjusted for control effectiveness. Weak operating effectiveness means controls are not fully effective, so residual risk remains relatively high.

Answer

Residual risk cannot be determined without a quantitative analysis

Answer

Residual risk is negligible because multiple controls are in place

Answer

Residual risk is equal to inherent risk because controls are ineffective

Question 13

A risk assessment of a critical financial application identifies a high inherent risk due to outdated software. The risk manager is considering mitigation options. Which TWO of the following would be considered preventive controls?

Accepted Answer

Configuring access controls. Configuring access controls is a preventive control because it proactively restricts unauthorized users from accessing the financial application, reducing the likelihood of a security incident. By enforcing least privilege and authentication mechanisms, it directly mitigates the risk of exploitation of the outdated software by limiting who can interact with it.

Answer

Deploying an intrusion detection system

Answer

Establishing a backup and recovery plan

Answer

Conducting regular security audits

Question 14

A company is performing a qualitative risk analysis for a new cloud migration project. Which TWO of the following are recognized limitations of qualitative risk analysis?

Accepted Answer

Risk ratings are not easily comparable across different organizations. Qualitative analysis is subjective and not comparable across organizations due to lack of standardized scales.

Answer

It requires extensive historical data

Answer

It is time-consuming and complex to perform

Answer

It provides financially precise loss estimates

Question 15

A risk assessment identifies a threat with high likelihood and high impact. The risk owner proposes transferring the risk via cyber insurance. However, the insurance policy has a high deductible and excludes certain attack types. Which THREE of the following should be considered when evaluating the effectiveness of this risk transfer?

Accepted Answer

The cost of the insurance premium relative to the expected loss. Risk transfer effectiveness depends on policy coverage, residual risk after transfer, and cost-benefit. Likelihood reduction is not directly applicable as transfer does not reduce likelihood.

Answer

The impact of the risk on operational productivity

Answer

The likelihood of the threat event occurring