CRISC IT Risk Assessment — Timed 25 Questions

Question 1

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Accepted Answer

Quick and easy to communicate. Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.

Answer

Eliminates subjectivity in risk assessment

Answer

Provides comparable results across organizations

Answer

Produces financially meaningful results

Question 2

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$140,000. The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

Answer

$100,000

Answer

$70,000

Answer

$1,400,000

Question 3

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

Accepted Answer

Transfer the risk through cyber insurance. The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

Answer

Avoid the risk by discontinuing the process

Answer

Accept the risk with formal sign-off

Answer

Mitigate the risk by implementing controls

Question 4

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Accepted Answer

Controls are effective in reducing the risk level. A reduction from 25 to 9 indicates controls are effective in reducing risk. High inherent risk does not automatically mean high residual risk; controls can reduce it significantly.

Answer

Additional controls are unnecessary

Answer

Controls are not effective because residual risk remains

Answer

The inherent risk was overestimated

Question 5

Which of the following is a detective control for an information system?

Accepted Answer

Intrusion detection system. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for malicious actions or policy violations and generates alerts when such events occur. Unlike preventive controls, an IDS does not block or stop the attack; it detects and reports it after the fact, enabling incident response.

Answer

Data backup

Answer

Encryption

Answer

Firewall

Question 6

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

Accepted Answer

ALE = $100,000; expected annual loss. ALE = ARO × SLE = 0.5 × $200,000 = $100,000. This means the expected annual loss from this risk is $100,000.

Answer

ALE = $400,000; maximum possible loss

Answer

ALE = $100,000; single loss expectancy

Answer

ALE = $200,000; annual cost of controls

Question 7

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Accepted Answer

Vulnerability severity. In FAIR, Loss Event Frequency (LEF) is directly influenced by the probability that a threat actor will successfully exploit a vulnerability. Vulnerability severity (how easily a vulnerability can be exploited) is a key component of the 'Vulnerability' factor in FAIR's decomposition, which feeds into LEF. Even with high threat capability and severe impact, if vulnerability is low (strong patching), LEF remains low because the attack is unlikely to succeed.

Answer

Threat actor capability and motivation

Answer

Control effectiveness

Answer

Business impact severity

Question 8

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. Option C (Avoid) is correct because risk avoidance involves discontinuing the activity or process that gives rise to the risk. In IT risk management, this means removing the vulnerable system, decommissioning a service, or ceasing a business function entirely to eliminate the risk exposure. For example, if an organization decides to shut down a legacy FTP server to avoid the risk of data interception, it is applying the avoid treatment.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 9

A risk practitioner is prioritizing IT risks for treatment. Which factor should be the PRIMARY basis for prioritization?

Accepted Answer

Risk level (inherent or residual). Risk prioritization is primarily based on the level of risk (inherent or residual) to allocate resources to the most critical risks. Ease of mitigation, cost, and business unit preference are secondary.

Answer

Ease of implementing controls

Answer

Cost of controls

Answer

Business unit manager's preference

Question 10

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

Accepted Answer

Threat Event Frequency (TEF). In the FAIR model, Threat Event Frequency (TEF) is the component that estimates how often, within a given timeframe, a threat agent (such as a hacker or malware) will initiate an action against an asset. This directly matches the question's definition of 'probable frequency that a threat agent will act against an asset.' TEF is a primary input for calculating Loss Event Frequency (LEF) and ultimately risk.

Answer

Vulnerability

Answer

Loss Event Frequency (LEF)

Answer

Annualized Rate of Occurrence (ARO)

Question 11

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Accepted Answer

High. Risk score = 3 × 4 = 12, which falls in the high range (12-25).

Answer

Critical

Answer

Medium

Answer

Low

Question 12

Which type of control is designed to reduce the likelihood of a risk event occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

Answer

Corrective

Answer

Compensating

Answer

Detective

Question 13

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

Accepted Answer

Control operating effectiveness. Control operating effectiveness is necessary to calculate residual risk because it measures how well a control actually reduces risk in practice. Even if a control is well-designed, poor implementation or maintenance can leave residual risk higher than expected. This aligns with the CRISC formula: Residual Risk = Inherent Risk × (1 - Control Effectiveness).

Answer

Likelihood of threat events

Answer

Financial impact of the risk

Question 14

An organization is performing a quantitative risk analysis using the FAIR framework. Which THREE of the following are direct components of the FAIR model?

Accepted Answer

Loss Event Frequency. FAIR components include Loss Event Frequency (LEF), Threat Event Frequency (TEF), Vulnerability, and Loss Magnitude. Annualized Loss Expectancy (ALE) is a derived metric, not a direct component. Single Loss Expectancy is a component of ALE but not a separate FAIR component.

Answer

Single Loss Expectancy

Answer

Annualized Loss Expectancy

Question 15

An organization is evaluating risk treatment options for a critical vulnerability. Which TWO options would be considered risk mitigation?

Accepted Answer

Deploy an intrusion prevention system. Deploying an intrusion prevention system (IPS) is a risk mitigation measure because it actively monitors and blocks malicious traffic targeting the vulnerability, reducing the likelihood of exploitation. Implementing a security patch directly removes the vulnerability, thereby reducing both the likelihood and impact of a potential attack. Both actions modify the risk by applying technical controls to lower the residual risk level.

Answer

Purchase cyber insurance

Answer

Accept the risk with formal sign-off

Answer

Discontinue the vulnerable service

Question 16

A risk manager is using a 5×5 likelihood-impact matrix to assess a set of identified risks. What is the PRIMARY advantage of using this qualitative method?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using heat maps is quick and easy to communicate to stakeholders, making it a common initial assessment tool.

Answer

It provides objective and comparable risk scores across organizations.

Answer

It produces financially meaningful results for cost-benefit analysis.

Answer

It requires less data but is time-consuming to complete.

Question 17

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

Accepted Answer

$10,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given SLE = $50,000 and ARO = 0.2, the ALE is $50,000 × 0.2 = $10,000. This aligns with the FAIR framework's quantitative risk analysis formula.

Answer

$250,000

Answer

$100,000

Answer

$50,000

Question 18

After implementing a set of controls for a critical risk, the residual risk is calculated. The risk owner argues that the residual risk remains high and requires further treatment. Which of the following BEST describes the relationship between inherent risk, control effectiveness, and residual risk?

Accepted Answer

Residual risk = Inherent risk × (1 - Control effectiveness). Option C is correct because residual risk is calculated by applying control effectiveness as a percentage reduction to inherent risk. This is the standard formula used in risk management frameworks: Residual Risk = Inherent Risk × (1 - Control Effectiveness). If control effectiveness is 0.8 (80%), then only 20% of the inherent risk remains, reflecting the portion not mitigated by controls.

Answer

Residual risk = Inherent risk + Control effectiveness

Answer

Residual risk = Inherent risk - Control effectiveness

Answer

Residual risk = Inherent risk / Control effectiveness

Question 19

A risk assessment identifies a high-likelihood, high-impact risk associated with a legacy system. The business owner decides to decommission the system to eliminate the risk. Which risk treatment option is being applied?

Accepted Answer

Avoid. Avoidance involves eliminating the activity that creates the risk, such as decommissioning a system.

Answer

Mitigate

Answer

Accept

Answer

Transfer

Question 20

During a quantitative risk analysis, the risk team calculates the loss event frequency (LEF) using the FAIR framework. If the threat event frequency (TEF) is 10 per year and the vulnerability (V) is 0.3, what is the LEF?

Accepted Answer

3 per year. In the FAIR framework, loss event frequency (LEF) is calculated as the product of threat event frequency (TEF) and vulnerability (V). Given TEF = 10 per year and V = 0.3, LEF = 10 × 0.3 = 3 per year. This represents the expected number of loss events per year, accounting for the probability that a threat event will actually result in a loss.

Answer

10.3 per year

Answer

30 per year

Answer

0.3 per year