CRISC IT Risk Assessment Practice Test 8 — 15 Questions

Question 1

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer

$25,000

Answer

$50,000

Answer

$200,000

Question 2

A risk manager decides to accept a risk because the cost of controls exceeds the potential loss. Which of the following is required for this risk treatment option?

Accepted Answer

Formal sign-off by the risk owner. When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

Answer

Elimination of the business process

Answer

Transfer of risk via insurance

Answer

Implementation of compensating controls

Question 3

An organization implements an intrusion detection system (IDS) to monitor for security incidents. This is an example of which type of control?

Accepted Answer

Detective. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for signs of malicious behavior or policy violations and generates alerts when such patterns are detected. Unlike preventive controls, an IDS does not block or stop the attack in real time; it only identifies and reports the incident for subsequent investigation and response.

Answer

Corrective

Answer

Compensating

Answer

Preventive

Question 4

After implementing controls, the risk remaining is called:

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls have been implemented to mitigate the original (inherent) risk. It represents the exposure the organization still carries and must consciously accept, transfer, or further mitigate. This is a core CRISC definition tested repeatedly.

Answer

Control risk

Answer

Acceptable risk

Answer

Inherent risk

Question 5

Which of the following best describes the primary limitation of qualitative risk analysis?

Accepted Answer

It is subjective and not comparable across organizations. Qualitative risk analysis relies on expert judgment, ordinal scales (e.g., high/medium/low), and subjective ratings rather than numerical data. Its primary limitation is that these ratings are subjective and organization-specific, making them difficult to compare across different organizations or even across teams using different scales. This lack of standardization and comparability is the core weakness.

Answer

It requires extensive historical data

Answer

It cannot produce financial loss estimates

Answer

It is time-consuming and complex

Question 6

A company uses cyber insurance to cover losses from data breaches. This is an example of which risk treatment?

Accepted Answer

Transfer. Transfer shifts risk to a third party, such as an insurance company.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 7

When prioritizing risk treatment actions, which factor is most important to consider alongside the risk level?

Accepted Answer

Cost-benefit analysis of controls. Risk treatment prioritization must balance the cost of controls against the expected reduction in risk. A cost-benefit analysis ensures that the selected controls provide a net positive value, preventing over-investment in low-impact risks or under-investment in high-impact ones. This aligns with the ISACA Risk IT Framework, which emphasizes that risk treatment decisions should be economically justified.

Answer

Number of stakeholders involved

Answer

Regulatory requirements only

Answer

Time required to implement controls

Question 8

Which TWO of the following are examples of corrective controls?

Accepted Answer

Disaster recovery plan execution. Disaster recovery plan execution (B) is a corrective control because it is activated after a disruptive event to restore normal operations. It directly addresses the impact of an incident by executing predefined procedures to recover systems and data, thereby correcting the damage caused by the outage or disaster.

Answer

Encryption of data at rest

Answer

Intrusion detection system

Answer

Access control lists

Question 9

Which THREE of the following are components of Loss Magnitude in the FAIR framework?

Accepted Answer

Reputational damage. In the FAIR (Factor Analysis of Information Risk) framework, Loss Magnitude is the probable loss resulting from a risk event and is decomposed into primary and secondary loss forms, each with six loss categories: productivity, response, replacement, fines and judgments, competitive advantage, and reputation. Option A (Reputational damage) is correct because reputation loss is one of the six secondary loss categories that make up Loss Magnitude. Option C (Incident response costs) is correct because response costs — the expense of managing an incident (forensics, communications, management time) — are one of the six loss categories within Loss Magnitude. Option D (Recovery costs) is correct because replacement/recovery costs, the expense of restoring or replacing assets after an event, are likewise one of the six Loss Magnitude categories. Option B (Vulnerability severity) is not part of Loss Magnitude; vulnerability is a factor in the Frequency/Loss Event Probability side of the FAIR ontology (resistance strength against threat capability). Option E (Threat event frequency) is not part of Loss Magnitude either; it is a primary factor under Loss Event Frequency in FAIR.

Answer

Vulnerability severity

Answer

Threat event frequency

Question 10

A risk manager is using a 5x5 heat map to assess IT risks. Which of the following best describes the primary limitation of this qualitative risk analysis approach?

Accepted Answer

It is subjective and not comparable across organizations.. A 5x5 heat map is a qualitative technique: likelihood and impact are assigned ordinal ratings (e.g., 1–5) based on expert judgment rather than measured data. Because the scales are defined locally and the ratings are subjective, results are not directly comparable across organizations or even across business units with different risk appetites. This subjectivity is the primary limitation.

Answer

It requires extensive historical data to be accurate.

Answer

It is time-consuming and complex to implement.

Answer

It provides objective, financially meaningful results.

Question 11

An organization is evaluating the risk of a ransomware attack. Using the FAIR framework, which of the following components directly multiplies to calculate Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency and Vulnerability. In FAIR, Loss Event Frequency (LEF) is calculated as Threat Event Frequency (TEF) multiplied by Vulnerability (V).

Answer

Control Effectiveness and Residual Risk

Answer

Annual Loss Expectancy and Single Loss Expectancy

Answer

Primary Loss and Secondary Loss

Question 12

A company identifies a high inherent risk in its online payment system. After implementing a Web Application Firewall (WAF) and conducting quarterly penetration tests, the residual risk is assessed as medium. Which of the following best explains the relationship between inherent risk, controls, and residual risk?

Accepted Answer

Residual risk is the inherent risk adjusted for the effectiveness of controls in reducing likelihood and impact.. Residual risk is defined as the risk that remains after controls have been applied to reduce the likelihood and/or impact of a threat exploiting a vulnerability. In this scenario, the high inherent risk was reduced to medium residual risk by the WAF and quarterly penetration tests, which is exactly the relationship described. This is the foundational risk equation in CRISC and ISO 31000.

Answer

Inherent risk is the risk after controls are applied, while residual risk is the risk before controls.

Answer

Residual risk equals inherent risk minus the total cost of controls implemented.

Answer

Inherent risk and residual risk are independent; residual risk is determined solely by threat intelligence.

Question 13

During an IT risk assessment, the risk owner decides to accept a risk that falls within the organization's risk appetite. Which of the following actions is most appropriate for the risk owner to take?

Accepted Answer

Document the risk and obtain formal sign-off from the risk owner.. When a risk falls within the organization's risk appetite, the most appropriate action is to formally accept it. The risk owner must document the risk and obtain formal sign-off to ensure accountability and auditability, as required by the risk management framework. This aligns with the principle that risks within appetite do not require additional treatment beyond formal acceptance.

Answer

Eliminate the business process that creates the risk.

Answer

Transfer the risk to a third party via insurance.

Answer

Implement additional controls to reduce the risk to zero.

Question 14

A quantitative risk analysis for a data breach yields an Annualized Loss Expectancy (ALE) of $500,000. The Single Loss Expectancy (SLE) is $100,000. What is the Annualized Rate of Occurrence (ARO)?

Accepted Answer

5. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). Given ALE = $500,000 and SLE = $100,000, the ARO is $500,000 / $100,000 = 5. This means the data breach is expected to occur 5 times per year.

Answer

50

Answer

0.2

Answer

500,000

Question 15

A company is considering outsourcing its data center operations to a cloud provider. Which risk treatment option is the company primarily exercising?

Accepted Answer

Risk transfer. Risk transfer shifts the financial and operational impact of a risk to a third party, typically through contracts, insurance, or outsourcing arrangements. By outsourcing data center operations to a cloud provider, the company contractsually shifts responsibility for the physical, operational, and infrastructure risks (power, cooling, hardware failure, physical security) to the provider. The risk itself still exists, but the ownership of its consequences is transferred via the service agreement and SLAs.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance