20+ practice questions focused on IT Risk Assessment — one of the most tested topics on the Certified in Risk and Information Systems Control CRISC exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start IT Risk Assessment PracticeA risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?
Explanation: Residual risk is the remaining risk after considering the effectiveness of controls. To calculate residual risk, you need to know the control design adequacy (whether controls are properly designed) and control operating effectiveness (whether they work as intended). These two components together determine control effectiveness. Inherent risk is a given input, not a component for calculation.
After implementing a set of controls for a critical risk, the residual risk is calculated. The risk owner argues that the residual risk remains high and requires further treatment. Which of the following BEST describes the relationship between inherent risk, control effectiveness, and residual risk?
Explanation: Residual risk is calculated by applying control effectiveness as a percentage reduction to inherent risk. This is the standard formula used in risk management frameworks: Residual Risk = Inherent Risk × (1 - Control Effectiveness). If control effectiveness is 0.8 (80%), then only 20% of the inherent risk remains, reflecting the portion not mitigated by controls.
A risk practitioner is conducting a business impact assessment for a critical application. Which TWO of the following are examples of direct financial costs? (Select TWO)
Explanation: In a business impact assessment (BIA), direct financial costs are those that result in immediate monetary outflows. Incident response costs (A) involve expenditures for containment, investigation, and remediation. Regulatory fines (C) are penalties imposed by governing bodies, constituting a clear direct financial cost. Recovery costs (E) are also direct, but lost business (D) and reputation damage (B) are indirect costs. Since the question requires selecting two, A and C are the most unambiguous examples.
An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?
Explanation: Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.
A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?
Explanation: The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.
+15 more IT Risk Assessment questions available
Practice all IT Risk Assessment questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of IT Risk Assessment. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
IT Risk Assessment questions on the CRISC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. IT Risk Assessment is tested as part of the Certified in Risk and Information Systems Control CRISC blueprint. Practicing with targeted IT Risk Assessment questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CRISC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but IT Risk Assessment is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full IT Risk Assessment practice session with instant scoring and detailed explanations.
Start IT Risk Assessment Practice →