hardMultiple ChoiceObjective-mapped
CRISC Practice Question: A risk practitioner is analyzing the results of a…
A risk practitioner is analyzing the results of a phishing simulation. The simulation had a 15% click rate on a test email targeting finance department staff. Which of the following conclusions is MOST valid regarding IT risk identification?
⚠ Common exam trap
Many exam-takers confuse a user awareness test result with a direct assessment of technical controls like email filtering, when in fact the simulation is designed to bypass those controls to measure human risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is an increased risk of successful targeted phishing attacks against finance staff
A 15% click rate on a targeted phishing simulation indicates that a significant portion of finance staff are susceptible to social engineering, which directly increases the risk of a successful targeted phishing attack. This finding is a key input for IT risk identification because it reveals a control weakness (user awareness) that could be exploited by attackers to gain unauthorized access or initiate fraudulent transactions. The click rate itself is a risk indicator, not a definitive measure of control effectiveness like email filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The email filtering system is ineffective
Why it's wrong here
Simulation bypasses filters by design; doesn't test filtering.
- ✓
There is an increased risk of successful targeted phishing attacks against finance staff
Why this is correct
Directly identifies a risk from human factors.
- ✗
This is an effective red team exercise
Why it's wrong here
It's a simulation, not a full red team; also not a risk identification conclusion.
- ✗
The organization has a low risk of credential theft
Why it's wrong here
High click rate indicates higher risk, not low.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.