CRISC IT Risk Assessment — Timed 20 Questions

Question 1

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

20 minute time limit — choose an answer to begin.

Accepted Answer

$140,000. The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

Answer

$100,000

Answer

$70,000

Answer

$1,400,000

Question 2

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

Accepted Answer

Transfer the risk through cyber insurance. The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

Answer

Avoid the risk by discontinuing the process

Answer

Accept the risk with formal sign-off

Answer

Mitigate the risk by implementing controls

Question 3

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Accepted Answer

Vulnerability severity. In FAIR, Loss Event Frequency (LEF) is directly influenced by the probability that a threat actor will successfully exploit a vulnerability. Vulnerability severity (how easily a vulnerability can be exploited) is a key component of the 'Vulnerability' factor in FAIR's decomposition, which feeds into LEF. Even with high threat capability and severe impact, if vulnerability is low (strong patching), LEF remains low because the attack is unlikely to succeed.

Answer

Threat actor capability and motivation

Answer

Control effectiveness

Answer

Business impact severity

Question 4

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

Accepted Answer

Control operating effectiveness. Residual risk is the risk that remains after controls are applied, and it is calculated by adjusting the inherent risk for how well controls are designed and how well they actually operate. Option C (Control design adequacy) is correct because a control must be properly designed to address the identified threat or vulnerability before it can reduce risk; a poorly designed control cannot lower residual risk regardless of how consistently it is applied. Option A (Control operating effectiveness) is correct because even a well-designed control only reduces residual risk if it functions as intended in practice, so its actual operating effectiveness must be factored in. Options B (Likelihood of threat events), D (Financial impact of the risk), and E (Inherent risk level) are inputs to the inherent risk assessment itself, not the control-based factors used to derive residual risk from inherent risk.

Answer

Likelihood of threat events

Answer

Financial impact of the risk

Answer

Inherent risk level

Question 5

After implementing a set of controls for a critical risk, the residual risk is calculated. The risk owner argues that the residual risk remains high and requires further treatment. Which of the following BEST describes the relationship between inherent risk, control effectiveness, and residual risk?

Accepted Answer

Residual risk = Inherent risk × (1 - Control effectiveness). Residual risk is calculated by applying control effectiveness as a percentage reduction to inherent risk. This is the standard formula used in risk management frameworks: Residual Risk = Inherent Risk × (1 - Control Effectiveness). If control effectiveness is 0.8 (80%), then only 20% of the inherent risk remains, reflecting the portion not mitigated by controls.

Answer

Residual risk = Inherent risk + Control effectiveness

Answer

Residual risk = Inherent risk - Control effectiveness

Answer

Residual risk = Inherent risk / Control effectiveness

Question 6

In a quantitative risk analysis, the annualized loss expectancy (ALE) is calculated as $1 million. If the organization implements a control that reduces the ARO from 0.5 to 0.1, and the SLE remains constant at $2 million, what is the new ALE?

Accepted Answer

$200,000. The annualized loss expectancy (ALE) is calculated as SLE × ARO. With SLE constant at $2 million and the new ARO reduced to 0.1, the new ALE is $2,000,000 × 0.1 = $200,000. This reflects the residual risk after the control is implemented.

Answer

$500,000

Answer

$100,000

Answer

$1 million

Question 7

A risk manager is evaluating the impact assessment for a potential data breach. Which THREE categories of impact should be considered in a comprehensive business impact analysis?

Accepted Answer

Operational impact (system downtime, productivity loss). Operational impact (C) is correct because a data breach directly affects system availability, business processes, and workforce productivity, which are core BIA considerations such as downtime and lost productivity. Regulatory impact (D) is correct because breaches trigger legal obligations including fines under regimes like GDPR or HIPAA and mandatory remediation and notification activities. Financial impact (E) is correct because a BIA must quantify direct costs (incident response, legal fees) and indirect costs (revenue loss, customer churn, reputational damage). Technological impact (A) is not a standard BIA impact category and describes hardware obsolescence rather than breach consequences, and environmental impact (B) concerns pollution and waste, which are unrelated to a data breach's business impact.

Answer

Technological impact (obsolescence of hardware)

Answer

Environmental impact (pollution, waste)

Question 8

An organization using the FAIR framework estimates that a threat event frequency (TEF) is 10 per year, vulnerability is 0.2, and loss magnitude per event is $500,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The FAIR framework calculates ALE as TEF × Vulnerability × Loss Magnitude. Here, 10 × 0.2 × $500,000 = $1,000,000. This correctly incorporates the vulnerability factor (0.2) as a probability of threat success, yielding the expected annual loss.

Answer

$500,000

Answer

$100,000

Answer

$2,500,000

Question 9

Which of the following best describes an advantage of qualitative risk analysis over quantitative risk analysis?

Accepted Answer

It is quick and easy to communicate. Qualitative risk analysis uses descriptive scales (e.g., high/medium/low) rather than numerical values, making it fast to perform and easy to communicate to non-technical stakeholders. Its speed and clarity are its primary advantages, especially when data is scarce or decisions are needed quickly.

Answer

It is objective and comparable across organizations

Answer

It requires less data than quantitative analysis

Answer

It provides financially meaningful results

Question 10

A risk assessment identifies that a critical application has a vulnerability with a high likelihood of exploitation. The risk owner proposes to implement a web application firewall (WAF) as a mitigating control. Which TWO of the following are likely benefits of this control?

Accepted Answer

Reduces the likelihood of successful exploitation. A WAF reduces the likelihood of successful exploitation by inspecting and filtering HTTP/HTTPS traffic for common attack patterns such as SQL injection and cross-site scripting (XSS). It blocks malicious payloads before they reach the application, directly lowering the probability that a vulnerability will be exploited. This aligns with the risk mitigation strategy of reducing threat exposure.

Answer

Transfers the risk to the vendor

Answer

Eliminates the need for other controls

Answer

Eliminates all residual risk

Question 11

An organization is evaluating the impact of a potential data breach. Which THREE of the following are considered indirect financial impacts?

Accepted Answer

Legal fees from lawsuits. Legal fees from lawsuits (B) are an indirect financial impact because they arise as a downstream consequence of the breach rather than as a direct cost of containing or remediating the incident itself. Lost customer business (D) is indirect because it reflects revenue erosion from diminished customer trust and churn rather than an immediate out-of-pocket breach expense. Reputation damage leading to lower stock price (E) is indirect because it manifests as a decline in market valuation and investor confidence, not as a direct operational cost. By contrast, incident response costs (A) and notification costs to affected individuals (C) are direct financial impacts, since they are immediate, breach-specific expenses the organization must incur to investigate, contain, and formally notify affected parties.

Answer

Incident response costs

Answer

Notification costs to affected individuals

Question 12

An organization is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, the vulnerability is 0.2, and the loss magnitude is $500,000 per event. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. FAIR calculates Annualized Loss Expectancy as: ALE = Threat Event Frequency (TEF) × Vulnerability (Vuln) × Loss Magnitude (LM). Here, 10 events/year × 0.2 vulnerability × $500,000 = $1,000,000. The vulnerability factor (0.2) represents the probability that a threat event becomes a loss event, so only 2 of the 10 annual events are expected to cause actual loss.

Answer

$500,000

Answer

$5,000,000

Answer

$100,000

Question 13

A company has an inherent risk score of 20 for a specific threat. After implementing controls, the control effectiveness is assessed as 60% (design adequacy 70%, operating effectiveness 85%). What is the approximate residual risk score?

Accepted Answer

8. Residual risk = Inherent risk × (1 - Control effectiveness). Control effectiveness = 0.6. Residual risk = 20 × 0.4 = 8.

Answer

14

Answer

6

Answer

12

Question 14

In qualitative risk analysis, a risk with a likelihood rating of 'High' and an impact rating of 'High' on a 5×5 heat map would typically be classified as:

Accepted Answer

Critical. A 5×5 heat map often uses 'Critical' for the highest risk level (5×5).

Answer

High

Answer

Low

Answer

Medium

Question 15

A risk practitioner is conducting a business impact assessment for a critical application. Which TWO of the following are examples of direct financial costs? (Select TWO)

Accepted Answer

Incident response costs. In a business impact assessment (BIA), direct financial costs are those that result in immediate monetary outflows. Incident response costs (A) involve expenditures for containment, investigation, and remediation. Regulatory fines (C) are penalties imposed by governing bodies, constituting a clear direct financial cost. Recovery costs (E) are also direct, but lost business (D) and reputation damage (B) are indirect costs. Since the question requires selecting two, A and C are the most unambiguous examples.

Answer

Reputation damage

Answer

Lost business due to downtime

Answer

Recovery costs

Question 16

An IT risk assessment team is using a 5×5 risk matrix with likelihood and impact ratings. A risk scenario is rated as likelihood = 4 (likely) and impact = 5 (catastrophic). According to the typical heat map, what would be the risk rating?

Accepted Answer

Critical. On a standard 5×5 risk matrix, likelihood 4 combined with impact 5 falls in the highest-risk zone, which is typically labeled Critical. The multiplicative score of 20 (4×5) sits at the top of the scale, and heat maps color this cell red to indicate immediate attention is required.

Answer

High

Answer

Medium

Answer

Low

Question 17

A company calculates the annualized loss expectancy (ALE) for a server failure as $150,000. After implementing a backup solution costing $20,000 per year, the ALE drops to $30,000. What is the annualized benefit of the control?

Accepted Answer

$100,000. The annualized benefit of a control is the reduction in annualized loss expectancy (ALE) minus the annualized cost of the control. The ALE drops from $150,000 to $30,000, a reduction of $120,000. Subtracting the $20,000 annual control cost yields a net annualized benefit of $100,000. This is the standard risk-treatment value calculation used in CRISC and quantitative risk analysis.

Answer

$130,000

Answer

$120,000

Answer

$20,000

Question 18

A risk is assessed with inherent risk score of 25 on a 5x5 matrix. After implementing controls, the residual risk score is 10. The control effectiveness is considered:

Accepted Answer

Moderately effective. Inherent risk of 25 (on a 5x5 matrix, this is the maximum, e.g., 5×5) was reduced to a residual risk of 10 after controls. This represents a reduction of 15 points, or 60% of the inherent risk, which indicates the controls are moderately effective—they meaningfully reduced risk but did not eliminate it or bring it to a low level.

Answer

Not measurable

Answer

Highly effective

Answer

Ineffective

Question 19

When prioritizing risk treatment actions, which of the following should be the primary consideration?

Accepted Answer

Risk level and cost-benefit analysis. Risk prioritization should balance the risk level (high vs low) and the cost-benefit of controls. High risks with cost-effective controls should be prioritized.

Answer

Ease of implementation

Answer

Regulatory compliance only

Answer

Risk owner preference

Question 20

A bank is evaluating the impact of a potential system outage. Which of the following is an example of a direct financial cost associated with this impact?

Accepted Answer

Cost of system restoration. The cost of system restoration is a direct financial cost because it represents an immediate, quantifiable expense incurred to recover from the outage—such as hardware replacement, overtime labor, or vendor support fees. These costs are directly attributable to the outage event and appear as line-item expenses. In contrast, share price decline, regulatory fines, and loss of customer trust are indirect or intangible consequences that may or may not materialize and are harder to quantify precisely.

Answer

Share price decline

Answer

Regulatory fines

Answer

Loss of customer trust