CRISC IT Risk Assessment Practice Question
In the FAIR framework, loss magnitude (LM) is composed of primary loss and secondary loss. Which of the following is an example of secondary loss?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lost business due to reputation damage
Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Incident response costs
Why it's wrong here
Incident response is a direct cost, typically primary loss.
- ✓
Lost business due to reputation damage
Why this is correct
Lost business from reputation damage is an indirect secondary loss.
- ✗
Legal notification costs
Why it's wrong here
Notification costs are direct costs of a breach, primary loss.
- ✗
System restoration expenses
Why it's wrong here
System restoration is a direct recovery cost, primary loss.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.