CRISC IT Risk Assessment Practice Test 7 — 15 Questions

Question 1

A quantitative risk analysis using FAIR requires estimating which THREE primary factors?

Accepted Answer

Vulnerability. In FAIR (Factor Analysis of Information Risk), the primary factors estimated for quantitative risk analysis are threat event frequency (D), vulnerability (B), and loss magnitude (C). Threat event frequency (D) captures how often a threat agent is expected to act against an asset, which drives the likelihood side of the risk equation. Vulnerability (B) is the probability that a threat event becomes a loss event, given the resistance strength of the asset's controls, and it modifies threat event frequency into loss event frequency. Loss magnitude (C) represents the probable financial impact per loss event, combining primary and secondary loss forms, and it is multiplied by loss event frequency to produce annualized loss exposure. Risk appetite (A) is a governance-level tolerance statement rather than a FAIR-estimated factor, and control cost (E) is an input to cost-benefit analysis of mitigations, not one of the three primary FAIR estimation factors.

Answer

Risk appetite

Answer

Control cost

Question 2

A risk analyst is assessing the impact of a potential ransomware attack. Which THREE categories of business impact should be considered?

Accepted Answer

Operational downtime. Operational downtime (B) is a direct consequence of a ransomware attack, as encryption of critical systems halts business processes, leading to lost productivity and revenue. This category is essential for impact assessment because it quantifies the duration and scope of service disruption, which directly affects operational continuity.

Answer

Geographic diversity

Answer

Technical complexity

Question 3

A risk practitioner is using a 5×5 heat map to assess IT risks. Which of the following is the primary advantage of this qualitative approach?

Accepted Answer

Requires less data and time to implement. A 5×5 heat map is a qualitative risk assessment tool that uses ordinal scales (e.g., low, medium, high) for likelihood and impact. Its primary advantage is that it requires less data and time to implement compared to quantitative methods, which demand detailed financial data and complex calculations. This makes it practical for rapid, high-level IT risk prioritization when precise data is unavailable.

Answer

Produces financially meaningful loss estimates

Answer

Provides objective and comparable risk scores across organizations

Answer

Eliminates subjectivity in risk ratings

Question 4

An organization is evaluating the risk of a data breach using the FAIR framework. Which of the following components is part of Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency. In the FAIR (Factor Analysis of Information Risk) ontology, Loss Event Frequency (LEF) is composed of Threat Event Frequency (TEF) and Vulnerability (the probability that a threat event becomes a loss event). Threat Event Frequency is therefore a direct component of LEF. Annualized Loss Expectancy, Primary Loss, and Secondary Loss belong to the loss magnitude side of the model, not LEF.

Answer

Annualized Loss Expectancy

Answer

Primary Loss

Answer

Secondary Loss

Question 5

Which risk treatment option involves formally acknowledging the risk and taking no further action, provided the risk is within the organization's risk appetite?

Accepted Answer

Accept. Risk acceptance is the treatment option where the organization formally acknowledges a risk and decides to take no action because the risk falls within its defined risk appetite. It is a deliberate, documented decision — not neglect — and typically requires management sign-off. This matches the question's description exactly.

Answer

Avoid

Answer

Transfer

Answer

Mitigate

Question 6

A company is assessing the risk of a ransomware attack. The security team estimates the threat event frequency as 2 attacks per year, vulnerability as 0.3 (30% chance of success), primary loss as $500,000, and secondary loss as $200,000. What is the annualized loss expectancy (ALE) using the FAIR framework?

Accepted Answer

$420,000. The FAIR framework calculates ALE as Threat Event Frequency × Vulnerability × (Primary Loss + Secondary Loss). Here, 2 × 0.3 × ($500,000 + $200,000) = 2 × 0.3 × $700,000 = $420,000. This correctly accounts for the probability of a successful attack and the total loss per incident.

Answer

$700,000

Answer

$210,000

Answer

$1,400,000

Question 7

During an IT risk assessment, the risk owner identifies a high inherent risk for a legacy system. After implementing a firewall and intrusion detection system, the residual risk is calculated. Which of the following best describes residual risk?

Accepted Answer

The risk level after considering control effectiveness. Residual risk is the level of risk that remains after controls have been implemented and their effectiveness has been factored in. In this scenario, the firewall and intrusion detection system are controls that reduce the inherent risk, but some risk (e.g., from zero-day exploits or misconfigurations) will persist, which is the residual risk.

Answer

The risk level before any controls are implemented

Answer

The risk that is transferred to a third party

Answer

The risk that is accepted without action

Question 8

An organization decides to outsource its data center operations to a cloud provider with strict contractual penalties for security breaches. This is an example of which risk treatment option?

Accepted Answer

Transfer. Outsourcing data center operations to a cloud provider with contractual penalties for security breaches shifts the financial impact of a risk event to a third party. This is the definition of risk transfer, where the organization pays another party (via contract, insurance, or outsourcing) to bear the risk. The strict contractual penalties ensure the provider absorbs the cost if a breach occurs, which is the hallmark of transfer.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 9

A risk assessment identifies a critical vulnerability in a web application. Which control type would be most effective in preventing exploitation of this vulnerability?

Accepted Answer

Preventive control such as patching the vulnerability. A preventive control stops an incident before it occurs, and patching the vulnerability removes the exploitable condition entirely, which is the most effective way to prevent exploitation. Since the vulnerability is identified as critical, remediation via patching directly addresses the root cause rather than merely detecting or recovering from an exploit.

Answer

Compensating control such as additional monitoring

Answer

Corrective control such as backup restoration

Answer

Detective control such as log monitoring

Question 10

During a risk assessment, a risk is assigned a likelihood of 'High' and an impact of 'Medium' on a 5×5 heat map. What is the risk rating?

Accepted Answer

High. On a 5x5 heat map, likelihood and impact are typically rated on a scale of 1 to 5. A likelihood of 'High' (often 4) and impact of 'Medium' (often 3) combine to a risk rating that is usually 'High' in most standard risk matrices. The exact rating depends on the organization's risk matrix, but in common CRISC contexts, High likelihood and Medium impact yield a High risk rating.

Answer

Critical

Answer

Low

Answer

Medium

Question 11

A risk manager is prioritizing risks based on their inherent risk scores. Which of the following factors should be considered when prioritizing treatment actions?

Accepted Answer

The cost-benefit analysis of controls. When prioritizing treatment actions, the risk manager must weigh the cost of implementing controls against the benefit (risk reduction) they deliver. A high inherent risk may not justify an expensive control if the residual risk is already acceptable or the control cost exceeds the expected loss. Cost-benefit analysis ensures treatment is economically justified and resources are allocated where they reduce risk most efficiently.

Answer

The residual risk after controls

Answer

Only the inherent risk score

Answer

The likelihood of control failure

Question 12

An organization has implemented a firewall (preventive), intrusion detection system (detective), and a backup restoration plan (corrective) to address a specific risk. The risk manager assesses the control effectiveness as follows: design adequacy is strong, but operating effectiveness is weak due to inconsistent patching. Which of the following best describes the residual risk?

Accepted Answer

Residual risk is lower than inherent risk but still significant due to weak operating effectiveness. Residual risk is lower than inherent risk because the three controls (preventive, detective, corrective) do reduce the risk, but it remains significant because weak operating effectiveness — inconsistent patching — means the controls are not functioning as designed. Design adequacy alone does not guarantee risk reduction; actual operating effectiveness determines the true residual level.

Answer

Residual risk cannot be determined without a quantitative analysis

Answer

Residual risk is negligible because multiple controls are in place

Answer

Residual risk is equal to inherent risk because controls are ineffective

Question 13

A risk assessment of a critical financial application identifies a high inherent risk due to outdated software. The risk manager is considering mitigation options. Which TWO of the following would be considered preventive controls?

Accepted Answer

Configuring access controls. Configuring access controls is a preventive control because it proactively restricts unauthorized users from accessing the financial application, reducing the likelihood of a security incident. By enforcing least privilege and authentication mechanisms, it directly mitigates the risk of exploitation of the outdated software by limiting who can interact with it.

Answer

Deploying an intrusion detection system

Answer

Establishing a backup and recovery plan

Answer

Conducting regular security audits

Question 14

A company is performing a qualitative risk analysis for a new cloud migration project. Which TWO of the following are recognized limitations of qualitative risk analysis?

Accepted Answer

Risk ratings are not easily comparable across different organizations. Option A is correct because qualitative risk analysis produces ordinal ratings (such as High/Medium/Low) that are defined by each organization's own scales and risk criteria, so the resulting ratings lack a common quantitative baseline and cannot be reliably compared across different organizations. Option D is correct because qualitative analysis relies on expert opinion, experience, and judgment rather than numeric measurement, making the ratings inherently subjective and dependent on the assessor's bias, expertise, and interpretation. Options B, C, and E are not limitations of qualitative analysis: it is specifically chosen because it requires little historical data (B is wrong), it is generally faster and simpler than quantitative analysis (C is wrong), and it does not produce financially precise loss estimates—that is the domain of quantitative risk analysis using techniques like Monte Carlo simulation or expected monetary value (E is wrong).

Answer

It requires extensive historical data

Answer

It is time-consuming and complex to perform

Answer

It provides financially precise loss estimates

Question 15

A risk assessment identifies a threat with high likelihood and high impact. The risk owner proposes transferring the risk via cyber insurance. However, the insurance policy has a high deductible and excludes certain attack types. Which THREE of the following should be considered when evaluating the effectiveness of this risk transfer?

Accepted Answer

The cost of the insurance premium relative to the expected loss. Option C is correct because the premium is the direct cost of transferring the risk, and it must be weighed against the expected loss (likelihood × impact) to determine whether the transfer is economically worthwhile. Option D is correct because insurance rarely eliminates a risk entirely; the high deductible and any uncovered portions leave a residual risk that the organization still owns and must evaluate. Option E is correct because the policy's coverage limits and exclusions define exactly which attack types and loss amounts are actually transferred, directly determining the transfer's effectiveness. Option A is not correct here because operational productivity impact is a factor in assessing the risk itself, not in evaluating whether the insurance transfer works. Option B is likewise not correct because the likelihood of the threat event is an input to the original risk assessment, not a measure of the transfer's effectiveness.

Answer

The impact of the risk on operational productivity

Answer

The likelihood of the threat event occurring