CRISC IT Risk Assessment Practice Question
A risk analyst uses a 5x5 heat map to evaluate a set of IT risks. For a particular risk, the likelihood is rated as 4 (likely) and impact as 5 (very high). What is the resulting risk rating?
⚠ Common exam trap
The trap is that candidates may misremember the banding thresholds or assume a 4x5 score is only 'High' — CRISC expects you to compute the product (20) and recognize it lands in the Critical/Extreme top band of a 5x5 matrix.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Critical
On a standard 5x5 risk heat map, the risk score is the product of likelihood and impact: 4 × 5 = 20. A score of 20 falls in the highest band of the matrix, which is typically labeled Critical (or Extreme). This reflects that a likely event with very high impact demands immediate executive attention and treatment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Low
Why it's wrong here
A likelihood of 4 combined with an impact of 5 produces the maximum product on a 5×5 heat map, placing the risk in the Critical band rather than Low. Low applies to pairings such as 1×2 or 2×1. The option is tempting because Low feels safe, but the arithmetic contradicts it.
- ✗
Medium
Why it's wrong here
Multiplying likelihood 4 by impact 5 yields 20, which lands in the highest band of a 5×5 matrix, not Medium. Medium suits mid-range products such as 3×3 or 2×4. The option tempts because Medium is the default middle rating, yet the numeric product here exceeds it.
- ✓
Critical
Why this is correct
Multiplying likelihood 4 by impact 5 yields a score of 20 on the 5x5 matrix. That score falls within the highest band, which the heat map labels Critical, reflecting a risk demanding immediate treatment and escalation.
- ✗
High
Why it's wrong here
A 4×5 pairing on a 5×5 heat map sits in the extreme band, so the rating is Critical, not High. High typically covers mid-to-upper combinations such as 4×4 or 3×5. The option is tempting because High sounds severe, but the matrix's own thresholds place this likelihood-impact product above it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.