CRISC IT Risk Assessment Practice Test 8 — 15 Questions

Question 1

A risk manager is using a 5x5 heat map to assess IT risks. Which of the following best describes the primary limitation of this qualitative risk analysis approach?

Accepted Answer

It is subjective and not comparable across organizations.. Qualitative risk analysis using heat maps is subjective and results are not comparable across different organizations due to varying risk appetites and cultural interpretations.

Answer

It requires extensive historical data to be accurate.

Answer

It is time-consuming and complex to implement.

Answer

It provides objective, financially meaningful results.

Question 2

An organization is evaluating the risk of a ransomware attack. Using the FAIR framework, which of the following components directly multiplies to calculate Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency and Vulnerability. In FAIR, Loss Event Frequency (LEF) is calculated as Threat Event Frequency (TEF) multiplied by Vulnerability (V).

Answer

Control Effectiveness and Residual Risk

Answer

Annual Loss Expectancy and Single Loss Expectancy

Answer

Primary Loss and Secondary Loss

Question 3

A company identifies a high inherent risk in its online payment system. After implementing a Web Application Firewall (WAF) and conducting quarterly penetration tests, the residual risk is assessed as medium. Which of the following best explains the relationship between inherent risk, controls, and residual risk?

Accepted Answer

Residual risk is the inherent risk adjusted for the effectiveness of controls in reducing likelihood and impact.. Residual risk is the risk remaining after controls are applied. It is calculated by adjusting inherent risk for control effectiveness (design adequacy and operating effectiveness).

Answer

Inherent risk is the risk after controls are applied, while residual risk is the risk before controls.

Answer

Residual risk equals inherent risk minus the total cost of controls implemented.

Answer

Inherent risk and residual risk are independent; residual risk is determined solely by threat intelligence.

Question 4

During an IT risk assessment, the risk owner decides to accept a risk that falls within the organization's risk appetite. Which of the following actions is most appropriate for the risk owner to take?

Accepted Answer

Document the risk and obtain formal sign-off from the risk owner.. When a risk falls within the organization's risk appetite, the most appropriate action is to formally accept it. The risk owner must document the risk and obtain formal sign-off to ensure accountability and auditability, as required by the risk management framework. This aligns with the principle that risks within appetite do not require additional treatment beyond formal acceptance.

Answer

Eliminate the business process that creates the risk.

Answer

Transfer the risk to a third party via insurance.

Answer

Implement additional controls to reduce the risk to zero.

Question 5

A quantitative risk analysis for a data breach yields an Annualized Loss Expectancy (ALE) of $500,000. The Single Loss Expectancy (SLE) is $100,000. What is the Annualized Rate of Occurrence (ARO)?

Accepted Answer

5. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). Given ALE = $500,000 and SLE = $100,000, the ARO is $500,000 / $100,000 = 5. This means the data breach is expected to occur 5 times per year.

Answer

50

Answer

0.2

Answer

500,000

Question 6

A company is considering outsourcing its data center operations to a cloud provider. Which risk treatment option is the company primarily exercising?

Accepted Answer

Risk transfer. Outsourcing shifts the risk of managing the data center to a third party, which is risk transfer. Contractual liability may also be transferred.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 7

In a qualitative risk assessment using a 5x5 heat map, an IT risk is rated with likelihood 4 and impact 5. According to typical heat map conventions (5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational), what is the overall risk rating?

Accepted Answer

Critical. In a typical 5x5 risk heat map, the overall risk rating is determined by the intersection of likelihood and impact values. With likelihood 4 and impact 5, the cell falls in the 'Critical' zone (commonly defined as likelihood 4-5 and impact 4-5). This aligns with the convention where 5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational, making D the correct answer.

Answer

Low

Answer

Medium

Answer

High

Question 8

Which of the following is an example of a detective control in IT risk management?

Accepted Answer

Intrusion Detection System (IDS). Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Answer

Firewall

Answer

Data encryption

Answer

Backup restoration

Question 9

A risk assessment identifies a vulnerability in a critical application. The threat actor is a script kiddie with low capability. Using the FAIR framework, which factor would most directly increase the Loss Event Frequency (LEF)?

Accepted Answer

Increasing the vulnerability severity. Loss Event Frequency (LEF) in FAIR is directly influenced by the probability that a threat agent will act against a vulnerability. Increasing the vulnerability severity makes the application more susceptible to exploitation, thereby raising the likelihood of a loss event occurring, even if the threat actor has low capability.

Answer

Reducing the vulnerability severity

Answer

Decreasing the threat event frequency

Answer

Increasing the threat actor's motivation

Question 10

After implementing controls for a high-risk IT process, the residual risk is calculated as medium. The risk owner argues that the controls are not adequate because the inherent risk was critical. Which of the following should be the primary basis for determining control adequacy?

Accepted Answer

The reduction from inherent risk to residual risk based on control effectiveness. Control adequacy is determined by assessing both design adequacy and operating effectiveness, which together reduce inherent risk to the desired residual risk level.

Answer

The number of controls implemented

Answer

The cost of controls relative to the asset value

Answer

The industry standards for similar processes

Question 11

An organization decides to discontinue a high-risk business process that cannot be effectively mitigated. This is an example of which risk treatment option?

Accepted Answer

Risk avoidance. Avoidance involves eliminating the activity that creates the risk, thus removing the risk entirely.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk mitigation

Question 12

In a quantitative risk analysis using FAIR, which of the following best represents Loss Magnitude (LM)?

Accepted Answer

Primary Loss + Secondary Loss. In FAIR, Loss Magnitude (LM) is the sum of Primary Loss (direct costs) and Secondary Loss (indirect costs) resulting from a loss event.

Answer

Single Loss Expectancy (SLE)

Answer

Threat Event Frequency × Vulnerability

Answer

Annualized Loss Expectancy (ALE)

Question 13

An organization is evaluating the business impact of a potential ransomware attack. Which TWO impact categories should be considered as direct financial losses? (Select TWO)

Accepted Answer

Incident response and recovery costs. Direct financial losses include costs directly incurred from the incident, such as incident response and recovery, and notification costs. Lost business and reputation damage are indirect costs.

Answer

Reputation damage and customer trust loss

Answer

Lost business due to downtime

Answer

Regulatory fines

Question 14

A risk assessment team is prioritizing IT risks for treatment. Which THREE factors should be considered when prioritizing risks? (Select THREE)

Accepted Answer

The inherent risk score of each risk. The inherent risk score provides a baseline measure of risk without considering controls, which is essential for prioritizing which risks require immediate attention. This score is typically calculated as a product of likelihood and impact, and it helps the team focus on the most severe potential threats first.

Answer

Industry standards for similar risks

Answer

The risk owner's personal preference

Question 15

An organization is implementing controls to mitigate the risk of data exfiltration. Which TWO control types would be considered preventive? (Select TWO)

Accepted Answer

Access controls to restrict data access. Preventive controls aim to stop a risk event from occurring. Access controls prevent unauthorized access, and encryption prevents data from being read if exfiltrated. Log monitoring is detective, and backup restoration is corrective.

Answer

Incident response plan

Answer

Backup restoration procedures

Answer

Log monitoring and analysis