CRISC IT Risk Assessment Practice Test 7 — 15 Questions

Question 1

A risk assessment using a 5x5 heat map with likelihood and impact scores is an example of which type of risk analysis?

Accepted Answer

Qualitative risk analysis. A 5x5 heat map uses ordinal scales (e.g., 1–5) for likelihood and impact, which are subjective categories rather than precise numerical values. This places it in qualitative risk analysis, where risks are ranked by descriptive labels (e.g., Low, Medium, High) without monetary or statistical quantification.

Answer

Semi-quantitative risk analysis

Answer

Factor Analysis of Information Risk (FAIR)

Answer

Quantitative risk analysis

Question 2

Which of the following is a key advantage of using a quantitative risk analysis approach such as FAIR?

Accepted Answer

Produces objective, comparable financial metrics. Quantitative analysis provides objective, financially meaningful results that can be compared across organizations.

Answer

Quick to perform with minimal data

Answer

Provides subjective rankings easy to communicate

Answer

Eliminates uncertainty in risk estimates

Question 3

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer

$25,000

Answer

$50,000

Answer

$200,000

Question 4

In the FAIR framework, Loss Event Frequency (LEF) is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. FAIR defines LEF = Threat Event Frequency (TEF) multiplied by Vulnerability (Vuln).

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Answer

Threat Event Frequency × Loss Magnitude

Answer

Vulnerability × Loss Magnitude

Question 5

A risk manager decides to accept a risk because the cost of controls exceeds the potential loss. Which of the following is required for this risk treatment option?

Accepted Answer

Formal sign-off by the risk owner. When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

Answer

Elimination of the business process

Answer

Transfer of risk via insurance

Answer

Implementation of compensating controls

Question 6

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. Risk avoidance means stopping the activity that introduces the risk.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 7

An organization implements an intrusion detection system (IDS) to monitor for security incidents. This is an example of which type of control?

Accepted Answer

Detective. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for signs of malicious behavior or policy violations and generates alerts when such patterns are detected. Unlike preventive controls, an IDS does not block or stop the attack in real time; it only identifies and reports the incident for subsequent investigation and response.

Answer

Corrective

Answer

Compensating

Answer

Preventive

Question 8

After implementing controls, the risk remaining is called:

Accepted Answer

Residual risk. Residual risk is the risk remaining after controls are applied, calculated by adjusting inherent risk for control effectiveness.

Answer

Control risk

Answer

Acceptable risk

Answer

Inherent risk

Question 9

An organization has an inherent risk score of 20 for a process. After controls, the residual risk score is 8. If the control design is assessed as adequate but operating effectiveness is only 60%, what is the control effectiveness adjustment?

Accepted Answer

The controls reduce risk by 60%. The inherent risk score is 20, and the residual risk score is 8, meaning controls reduce risk by 12 points (20 – 8 = 12). This reduction of 12 out of 20 equals a 60% reduction (12/20 = 0.60). The control design is adequate, but operating effectiveness is only 60%, so the actual risk reduction achieved matches the operating effectiveness percentage. Thus, the control effectiveness adjustment is 60%.

Answer

The controls reduce risk by 20%

Answer

The controls have no effect

Answer

The controls reduce risk by 40%

Question 10

Which of the following best describes the primary limitation of qualitative risk analysis?

Accepted Answer

It is subjective and not comparable across organizations. Qualitative analysis is subjective and relies on ordinal scales, making results not directly comparable across different organizations.

Answer

It requires extensive historical data

Answer

It cannot produce financial loss estimates

Answer

It is time-consuming and complex

Question 11

A company uses cyber insurance to cover losses from data breaches. This is an example of which risk treatment?

Accepted Answer

Transfer. Transfer shifts risk to a third party, such as an insurance company.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 12

When prioritizing risk treatment actions, which factor is most important to consider alongside the risk level?

Accepted Answer

Cost-benefit analysis of controls. Risk treatment prioritization must balance the cost of controls against the expected reduction in risk. A cost-benefit analysis ensures that the selected controls provide a net positive value, preventing over-investment in low-impact risks or under-investment in high-impact ones. This aligns with the ISACA Risk IT Framework, which emphasizes that risk treatment decisions should be economically justified.

Answer

Number of stakeholders involved

Answer

Regulatory requirements only

Answer

Time required to implement controls

Question 13

Which TWO of the following are examples of corrective controls?

Accepted Answer

Disaster recovery plan execution. Disaster recovery plan execution (B) is a corrective control because it is activated after a disruptive event to restore normal operations. It directly addresses the impact of an incident by executing predefined procedures to recover systems and data, thereby correcting the damage caused by the outage or disaster.

Answer

Encryption of data at rest

Answer

Intrusion detection system

Answer

Access control lists

Question 14

Which THREE of the following are components of Loss Magnitude in the FAIR framework?

Accepted Answer

Reputational damage. FAIR splits Loss Magnitude into primary loss (direct costs) and secondary loss (indirect costs). Primary loss includes incident response and recovery; secondary loss includes reputation and lost business.

Answer

Vulnerability severity

Answer

Threat event frequency

Question 15

Which TWO of the following are considered direct costs in the financial impact assessment of a risk event?

Accepted Answer

Incident response team expenses. Incident response team expenses (C) are direct costs because they are immediate, quantifiable outlays incurred specifically to respond to and mitigate a risk event. Similarly, customer notification costs (E) are direct costs as they represent mandatory, traceable expenditures for informing affected parties, often required by regulations like GDPR or HIPAA. These costs are directly attributable to the incident and can be precisely measured.

Answer

Increased insurance premium

Answer

Reputation loss

Answer

Lost business opportunities