hardMultiple SelectObjective-mapped
CRISC Practice Question: Which THREE factors should be considered when…
Which THREE factors should be considered when determining the likelihood of a threat exploiting a vulnerability?
⚠ Common exam trap
Many candidates confuse factors that determine likelihood (probability of occurrence) with factors that determine impact (consequences), leading candidates to incorrectly select asset value or regulatory fines as likelihood inputs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ease of exploitation
Ease of exploitation (A) is a key factor because it directly influences how readily a threat actor can leverage a vulnerability. For example, a vulnerability with a public exploit script or one that requires only low privileges is far more likely to be exploited than one requiring complex, custom tooling. This aligns with the CVSS exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) that quantify how easy it is to trigger the vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ease of exploitation
Why this is correct
Easier exploitation increases likelihood.
- ✗
Regulatory fines
Why it's wrong here
Fines are impact consequences.
- ✗
Asset value
Why it's wrong here
Asset value is an impact factor.
- ✓
Existing controls
Why this is correct
Controls reduce likelihood.
- ✓
Threat actor capability
Why this is correct
Capability affects the chance of exploitation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.