CRISC IT Risk Assessment Practice Test 9 — 15 Questions

Question 1

In a qualitative risk assessment using a 5x5 heat map, an IT risk is rated with likelihood 4 and impact 5. According to typical heat map conventions (5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational), what is the overall risk rating?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Critical. In a typical 5x5 risk heat map, the overall risk rating is determined by the intersection of likelihood and impact values. With likelihood 4 and impact 5, the cell falls in the 'Critical' zone (commonly defined as likelihood 4-5 and impact 4-5). This aligns with the convention where 5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational, making D the correct answer.

Answer

Low

Answer

Medium

Answer

High

Question 2

Which of the following is an example of a detective control in IT risk management?

Accepted Answer

Intrusion Detection System (IDS). Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Answer

Firewall

Answer

Data encryption

Answer

Backup restoration

Question 3

After implementing controls for a high-risk IT process, the residual risk is calculated as medium. The risk owner argues that the controls are not adequate because the inherent risk was critical. Which of the following should be the primary basis for determining control adequacy?

Accepted Answer

The reduction from inherent risk to residual risk based on control effectiveness. Control adequacy should be determined by the reduction from inherent risk to residual risk based on control effectiveness. The goal of controls is to mitigate risk to an acceptable level; if residual risk is medium and within the organization's risk appetite, the controls may be adequate regardless of the inherent risk being critical. The risk owner's argument that controls are inadequate solely because inherent risk was critical is flawed; what matters is the effectiveness of the controls in reducing risk.

Answer

The number of controls implemented

Answer

The cost of controls relative to the asset value

Answer

The industry standards for similar processes

Question 4

An organization decides to discontinue a high-risk business process that cannot be effectively mitigated. This is an example of which risk treatment option?

Accepted Answer

Risk avoidance. Risk avoidance is the deliberate decision to eliminate the activity, process, or asset that gives rise to the risk rather than trying to control it. Discontinuing a high-risk business process removes the risk entirely because the underlying activity no longer exists. This is the only treatment option that makes the risk disappear rather than reducing, sharing, or tolerating it.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk mitigation

Question 5

In a quantitative risk analysis using FAIR, which of the following best represents Loss Magnitude (LM)?

Accepted Answer

Primary Loss + Secondary Loss. In FAIR, Loss Magnitude (LM) is the sum of Primary Loss (direct costs) and Secondary Loss (indirect costs) resulting from a loss event.

Answer

Single Loss Expectancy (SLE)

Answer

Threat Event Frequency × Vulnerability

Answer

Annualized Loss Expectancy (ALE)

Question 6

A risk assessment team is prioritizing IT risks for treatment. Which THREE factors should be considered when prioritizing risks? (Select THREE)

Accepted Answer

The inherent risk score of each risk. The inherent risk score provides a baseline measure of risk without considering controls, which is essential for prioritizing which risks require immediate attention. This score is typically calculated as a product of likelihood and impact, and it helps the team focus on the most severe potential threats first.

Answer

Industry standards for similar risks

Answer

The risk owner's personal preference

Question 7

An organization is implementing controls to mitigate the risk of data exfiltration. Which TWO control types would be considered preventive? (Select TWO)

Accepted Answer

Access controls to restrict data access. Option D (access controls to restrict data access) is preventive because it stops unauthorized users from reaching sensitive data in the first place, enforcing least privilege and authorization before any exfiltration attempt can succeed. Option E (data encryption at rest and in transit) is preventive because it renders intercepted or stolen data unreadable without the keys, blocking the exfiltration objective even if data is copied or transmitted. By contrast, A (incident response plan) is reactive, guiding actions after a breach has occurred, and B (backup restoration procedures) is corrective/recovery-oriented, restoring data after loss or corruption. Option C (log monitoring and analysis) is detective, since it identifies and alerts on suspicious activity rather than stopping it beforehand.

Answer

Incident response plan

Answer

Backup restoration procedures

Answer

Log monitoring and analysis

Question 8

A risk manager uses a 5x5 heat map to plot the likelihood and impact of identified risks. This approach is an example of which type of risk analysis?

Accepted Answer

Qualitative risk analysis. A 5x5 heat map is a qualitative risk analysis technique that uses ordinal scales for likelihood and impact to derive risk ratings.

Answer

Quantitative risk analysis

Answer

Hybrid risk analysis

Answer

Semi-quantitative risk analysis

Question 9

A risk owner decides to accept a risk because the cost of mitigation exceeds the potential loss, and the risk level is within the organization's risk appetite. What should the risk owner do next?

Accepted Answer

Document the risk and obtain formal sign-off. When a risk owner decides to accept a risk because mitigation costs exceed potential loss and the risk is within appetite, the next step is to document the risk and obtain formal sign-off. This ensures accountability, creates an audit trail, and aligns with governance requirements. Acceptance must be an informed, documented decision.

Answer

Implement detective controls to monitor the risk

Answer

Reassess the risk using quantitative analysis

Answer

Transfer the risk to a third party via insurance

Question 10

A company is evaluating controls for a high-risk process. Which control type is designed to stop a risk event from occurring?

Accepted Answer

Preventive. A preventive control is designed to stop a risk event from occurring by implementing barriers or safeguards before the event can happen. For a high-risk process, this might include access control lists (ACLs) on a firewall that block unauthorized traffic, or input validation routines in an application that reject malformed data before it can trigger a buffer overflow. By proactively eliminating the threat vector, preventive controls reduce the likelihood of the risk event to zero for the protected path.

Answer

Detective

Answer

Corrective

Answer

Compensating

Question 11

An organization calculated the inherent risk for a critical system as 'High' using a 5x5 heat map. After implementing controls, the residual risk is assessed as 'Medium'. What does this indicate about the control effectiveness?

Accepted Answer

Controls are partially effective, reducing risk but not to the target level. The movement from 'High' inherent risk to 'Medium' residual risk indicates that the implemented controls have reduced the risk level by one step on the 5x5 heat map, but have not eliminated it entirely. Since the residual risk is still 'Medium' rather than 'Low' or 'Very Low', the controls are only partially effective—they mitigate some of the risk but do not bring it down to the organization's target risk appetite or tolerance level.

Answer

Controls are fully effective and risk is now acceptable

Answer

Controls are ineffective and need replacement

Answer

Residual risk should equal inherent risk if controls are effective

Question 12

In the FAIR framework, what does Loss Event Frequency (LEF) represent?

Accepted Answer

The expected number of loss events per year. LEF is the product of Threat Event Frequency (TEF) and Vulnerability (V), representing how often a loss event is expected to occur.

Answer

The number of threat events per year

Answer

The probability that a threat event will result in a loss

Answer

The total financial loss per event

Question 13

Which risk treatment option involves purchasing cyber insurance?

Accepted Answer

Transfer. Cyber insurance is a form of risk transfer, where the financial impact of a loss is shifted to the insurer.

Answer

Avoid

Answer

Mitigate

Answer

Accept

Question 14

During an IT risk assessment, the risk team identifies a high inherent risk for a legacy application. The team is evaluating control options. Which THREE are considered preventive controls?

Accepted Answer

Encryption of data at rest. Preventive controls aim to stop risk events. Access controls, encryption, and change management are preventive. Logs are detective, backup restoration is corrective.

Answer

Log monitoring

Answer

Backup restoration procedures

Question 15

A company is assessing the impact of a potential ransomware attack. Which TWO impact categories are considered operational impacts?

Accepted Answer

System downtime. Operational impacts are those that directly affect the day-to-day functioning of the business, so B (System downtime) is correct because a ransomware attack encrypting servers or endpoints halts services and prevents normal operations until systems are restored. D (Productivity loss) is also correct because employees cannot perform their tasks while systems, files, and applications are unavailable, directly reducing operational output. A (Share price impact) is a financial/market impact rather than an operational one, and C (Regulatory fines) is a legal/compliance impact. E (Customer trust loss) is a reputational impact, so it does not belong in the operational category.

Answer

Share price impact

Answer

Regulatory fines

Answer

Customer trust loss