CRISC IT Risk Assessment Practice Test 9 — 15 Questions

Question 1

A risk manager uses a 5x5 heat map to plot the likelihood and impact of identified risks. This approach is an example of which type of risk analysis?

Accepted Answer

Qualitative risk analysis. A 5x5 heat map is a qualitative risk analysis technique that uses ordinal scales for likelihood and impact to derive risk ratings.

Answer

Quantitative risk analysis

Answer

Hybrid risk analysis

Answer

Semi-quantitative risk analysis

Question 2

During an IT risk assessment, the risk team calculates the Annualized Loss Expectancy (ALE) for a critical application. Which quantitative risk analysis framework is most commonly used for this calculation?

Accepted Answer

FAIR. The Factor Analysis of Information Risk (FAIR) framework is the most commonly used quantitative risk analysis framework for calculating Annualized Loss Expectancy (ALE) because it provides a structured, probabilistic approach to decompose risk into loss event frequency and loss magnitude. Unlike qualitative frameworks, FAIR enables precise ALE computation by modeling threat event frequency, vulnerability, and probable loss, making it the standard for quantitative IT risk assessments in the CRISC domain.

Answer

NIST SP 800-30

Answer

ISO 31000

Answer

COBIT 5

Question 3

An organization uses the FAIR framework to assess the risk of a data breach. The risk analyst estimates that the Threat Event Frequency (TEF) is 10 per year, the Vulnerability (V) is 0.2, the Primary Loss per event is $50,000, and the Secondary Loss per event is $30,000. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$160,000. ALE = LEF × LM. LEF = TEF × V = 10 × 0.2 = 2. LM = Primary Loss + Secondary Loss = $50,000 + $30,000 = $80,000. ALE = 2 × $80,000 = $160,000.

Answer

$100,000

Answer

$800,000

Answer

$80,000

Question 4

A risk owner decides to accept a risk because the cost of mitigation exceeds the potential loss, and the risk level is within the organization's risk appetite. What should the risk owner do next?

Accepted Answer

Document the risk and obtain formal sign-off. The risk owner should formally document the risk acceptance decision and obtain approval from management as per policy.

Answer

Implement detective controls to monitor the risk

Answer

Reassess the risk using quantitative analysis

Answer

Transfer the risk to a third party via insurance

Question 5

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. Risk avoidance means avoiding the risk by discontinuing the activity that generates it.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 6

A company is evaluating controls for a high-risk process. Which control type is designed to stop a risk event from occurring?

Accepted Answer

Preventive. A preventive control is designed to stop a risk event from occurring by implementing barriers or safeguards before the event can happen. For a high-risk process, this might include access control lists (ACLs) on a firewall that block unauthorized traffic, or input validation routines in an application that reject malformed data before it can trigger a buffer overflow. By proactively eliminating the threat vector, preventive controls reduce the likelihood of the risk event to zero for the protected path.

Answer

Detective

Answer

Corrective

Answer

Compensating

Question 7

An organization calculated the inherent risk for a critical system as 'High' using a 5x5 heat map. After implementing controls, the residual risk is assessed as 'Medium'. What does this indicate about the control effectiveness?

Accepted Answer

Controls are partially effective, reducing risk but not to the target level. The movement from 'High' inherent risk to 'Medium' residual risk indicates that the implemented controls have reduced the risk level by one step on the 5x5 heat map, but have not eliminated it entirely. Since the residual risk is still 'Medium' rather than 'Low' or 'Very Low', the controls are only partially effective—they mitigate some of the risk but do not bring it down to the organization's target risk appetite or tolerance level.

Answer

Controls are fully effective and risk is now acceptable

Answer

Controls are ineffective and need replacement

Answer

Residual risk should equal inherent risk if controls are effective

Question 8

In the FAIR framework, what does Loss Event Frequency (LEF) represent?

Accepted Answer

The expected number of loss events per year. LEF is the product of Threat Event Frequency (TEF) and Vulnerability (V), representing how often a loss event is expected to occur.

Answer

The number of threat events per year

Answer

The probability that a threat event will result in a loss

Answer

The total financial loss per event

Question 9

Which risk treatment option involves purchasing cyber insurance?

Accepted Answer

Transfer. Cyber insurance is a form of risk transfer, where the financial impact of a loss is shifted to the insurer.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 10

A risk analyst is performing a quantitative risk analysis using the FAIR framework. Which TWO factors are multiplied to calculate Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency. LEF = Threat Event Frequency (TEF) × Vulnerability (V).

Answer

Loss Magnitude

Answer

Annualized Rate of Occurrence

Answer

Single Loss Expectancy

Question 11

During an IT risk assessment, the risk team identifies a high inherent risk for a legacy application. The team is evaluating control options. Which THREE are considered preventive controls?

Accepted Answer

Encryption of data at rest. Preventive controls aim to stop risk events. Access controls, encryption, and change management are preventive. Logs are detective, backup restoration is corrective.

Answer

Log monitoring

Answer

Backup restoration procedures

Question 12

A company is assessing the impact of a potential ransomware attack. Which TWO impact categories are considered operational impacts?

Accepted Answer

System downtime. Operational impacts include system downtime and productivity loss. Financial impacts like fines and reputation are separate categories.

Answer

Share price impact

Answer

Regulatory fines

Answer

Customer trust loss

Question 13

A risk practitioner is calculating the residual risk for a critical asset. Which THREE factors should be considered?

Accepted Answer

Control design adequacy. Residual risk is the risk remaining after controls are applied. To calculate it, you must know the inherent risk level (the risk before controls) and then assess how effectively controls reduce that risk. Control design adequacy and operating effectiveness determine how much the inherent risk is mitigated, directly impacting the residual risk calculation.

Answer

Cost of controls

Answer

Risk appetite

Question 14

In a qualitative risk assessment, which TWO elements are typically used to determine the risk rating?

Accepted Answer

Likelihood. In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Answer

Risk appetite

Answer

Cost of mitigation

Answer

Control effectiveness

Question 15

A company is prioritizing risk treatment actions. Which THREE factors should be considered when prioritizing risks?

Accepted Answer

Cost-benefit analysis of controls. Cost-benefit analysis ensures that the resources invested in controls are justified by the reduction in risk, which is a core principle of risk management. Without this analysis, an organization might over-invest in low-impact risks or under-invest in high-impact ones, leading to inefficient allocation of budget and effort.

Answer

Industry best practices

Answer

Number of vulnerabilities