How should I use these IT Risk Assessment practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just IT Risk Assessment questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the IT Risk Assessment domain.

CRISC · topic practice

IT Risk Assessment practice questions

Practise Certified in Risk and Information Systems Control CRISC IT Risk Assessment practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: IT Risk Assessment

Practice 10 questions Browse domain →

What the exam tests

What to know about IT Risk Assessment

IT Risk Assessment questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common IT Risk Assessment exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

IT Risk Assessment questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full IT Risk Assessment explanation →

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

Trap 1: Likelihood of threat events

Likelihood is part of inherent risk assessment.

Trap 2: Financial impact of the risk

Financial impact is already factored into inherent risk.

Trap 3: Inherent risk level

Inherent risk level is a starting point, but it is not one of the two components needed for the calculation; you need the components of control effectiveness.

Study all IT Risk Assessment common traps →

A
Control operating effectiveness
Control operating effectiveness is necessary to determine how well controls are implemented and functioning, which reduces inherent risk.
B
Likelihood of threat events
Why wrong: Likelihood is part of inherent risk assessment.
C
Control design adequacy
Control design adequacy is necessary to assess whether controls are properly designed to address the risk.
D
Financial impact of the risk
Why wrong: Financial impact is already factored into inherent risk.
E
Inherent risk level
Why wrong: Inherent risk level is a starting point, but it is not one of the two components needed for the calculation; you need the components of control effectiveness.

IT Risk Assessment practice questions

What to know about IT Risk Assessment

Common IT Risk Assessment exam traps

IT Risk Assessment questions

A risk assessment for a cloud migration identifies high inherent risk. The risk practitioner evaluates controls. Which TWO components are necessary to calculate residual risk?

A risk practitioner is conducting a business impact assessment for a critical application. Which TWO of the following are examples of direct financial costs? (Select TWO)

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

An organization has identified a high-risk IT process that, if continued, could result in significant regulatory fines. The risk owner recommends implementing additional controls. However, the cost of controls exceeds the potential financial loss. Which risk treatment option is MOST appropriate?

During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?

Which of the following is a detective control for an information system?

A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?

An organization is assessing the risk of a ransomware attack. The threat actor capability is high, but vulnerability is low due to strong patching. However, the business impact is severe. According to FAIR, which factor most directly influences Loss Event Frequency (LEF)?

Which risk treatment option involves eliminating the activity that creates the risk?

A risk practitioner is prioritizing IT risks for treatment. Which factor should be the PRIMARY basis for prioritization?

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

An organization uses a qualitative risk assessment and assigns a likelihood of '3' and impact of '4' on a 5-point scale. The heat map defines risk scores 12-25 as high. What is the risk rating?

Which type of control is designed to reduce the likelihood of a risk event occurring?

An organization is performing a quantitative risk analysis using the FAIR framework. Which THREE of the following are direct components of the FAIR model?

An organization is evaluating risk treatment options for a critical vulnerability. Which TWO options would be considered risk mitigation?

A risk manager is using a 5×5 likelihood-impact matrix to assess a set of identified risks. What is the PRIMARY advantage of using this qualitative method?

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

A risk assessment identifies a high-likelihood, high-impact risk associated with a legacy system. The business owner decides to decommission the system to eliminate the risk. Which risk treatment option is being applied?

Track your progress over time

Start a IT Risk Assessment only practice session

Related CRISC topic practice pages

IT Risk Identification practice questions

IT Risk Assessment practice questions

Risk Response and Reporting practice questions

Information Technology and Security practice questions

Risk Response and Mitigation practice questions

CRISC fundamentals practice questions

CRISC scenario practice questions

CRISC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid