How should I use these IT Risk Assessment practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just IT Risk Assessment questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the IT Risk Assessment domain.

CRISC · topic practice

IT Risk Assessment practice questions

Practise Certified in Risk and Information Systems Control CRISC IT Risk Assessment practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: IT Risk Assessment

Practice 10 questions Browse domain →

What the exam tests

What to know about IT Risk Assessment

IT Risk Assessment questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common IT Risk Assessment exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

IT Risk Assessment questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full IT Risk Assessment explanation →

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Trap 1: Eliminates subjectivity in risk assessment

Qualitative analysis is inherently subjective.

Trap 2: Provides comparable results across organizations

Qualitative results are not easily comparable across organizations due to subjective judgments.

Trap 3: Produces financially meaningful results

Financial meaning is a characteristic of quantitative analysis, not qualitative.

Study all IT Risk Assessment common traps →

A
Eliminates subjectivity in risk assessment
Why wrong: Qualitative analysis is inherently subjective.
B
Provides comparable results across organizations
Why wrong: Qualitative results are not easily comparable across organizations due to subjective judgments.
C
Quick and easy to communicate
Heat maps are simple to create and understand, facilitating communication.
D
Produces financially meaningful results
Why wrong: Financial meaning is a characteristic of quantitative analysis, not qualitative.

IT Risk Assessment practice questions

What to know about IT Risk Assessment

Common IT Risk Assessment exam traps

IT Risk Assessment questions

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Which of the following is a detective control for an information system?

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Which risk treatment option involves eliminating the activity that creates the risk?

A risk practitioner is prioritizing IT risks for treatment. Which factor should be the PRIMARY basis for prioritization?

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Which type of control is designed to reduce the likelihood of a risk event occurring?

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

An organization is performing a quantitative risk analysis using the FAIR framework. Which THREE of the following are direct components of the FAIR model?

An organization is evaluating risk treatment options for a critical vulnerability. Which TWO options would be considered risk mitigation?

A risk manager is using a 5×5 likelihood-impact matrix to assess a set of identified risks. What is the PRIMARY advantage of using this qualitative method?

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

A risk assessment identifies a high-likelihood, high-impact risk associated with a legacy system. The business owner decides to decommission the system to eliminate the risk. Which risk treatment option is being applied?

During a quantitative risk analysis, the risk team calculates the loss event frequency (LEF) using the FAIR framework. If the threat event frequency (TEF) is 10 per year and the vulnerability (V) is 0.3, what is the LEF?

Track your progress over time

Start a IT Risk Assessment only practice session

Related CRISC topic practice pages

IT Risk Identification practice questions

IT Risk Assessment practice questions

Risk Response and Reporting practice questions

Information Technology and Security practice questions

Risk Response and Mitigation practice questions

Risk and Control Monitoring and Reporting practice questions

CRISC fundamentals practice questions

CRISC scenario practice questions

CRISC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid