Match each risk management term to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Risk level before controls are applied
Risk level after controls are applied
Amount of risk the organization is willing to accept
Acceptable deviation from risk appetite
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Risk: The effect of uncertainty on objectives.
The correct matches are Risk with 'effect of uncertainty on objectives', Threat with 'circumstance/event that can adversely impact', and Vulnerability with 'weakness that can be exploited'. Common confusions include swapping definitions between these terms.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Risk: The effect of uncertainty on objectives.
Why this is correct
This is the standard definition of risk from ISO 31000.
Threat: Any circumstance or event with the potential to adversely impact organizational operations or assets.
Why this is correct
This definition aligns with NIST SP 800-30.
Vulnerability: A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
Why this is correct
This is the NIST definition of vulnerability.
Risk: A weakness that could be exploited.
Why it's wrong here
Incorrect — this describes vulnerability, not risk.
Threat: The effect of uncertainty on objectives.
Why it's wrong here
Incorrect — this describes risk, not threat.
Vulnerability: Any circumstance or event with potential to adversely impact.
Why it's wrong here
Incorrect — this describes threat, not vulnerability.
Go deeper
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.