Question bank
ISACA CRISC
41 ISACA CRISC questions with the correct answer and a written explanation, organised across 4 exam domains.
- 41 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Governance
11 questions in this domain
- Question 1Single Choice
Who is ultimately accountable for ensuring that IT-related risks are managed consistently with the enterprise's business strategy?
- ABoard of directorsCorrect answer
- BChief information officer
- CChief information security officer
- DInternal audit
Why this is the answer
Accountability for IT risk governance resides with the board of directors; management implements controls but does not hold ultimate accountability.
- Question 2Multiple Select
Which of the following are management responsibilities in IT risk governance? (Select all that apply.)
- AIdentifying and assessing IT risksCorrect answer
- BImplementing internal controlsCorrect answer
- CApproving high-level IT risk policies
- DReporting residual risk exposure to the boardCorrect answer
Why this is the answer
Management identifies, assesses, implements controls, and reports residual risk. The board approves high-level policies and sets risk appetite.
- Question 3Interactive
Review the code block containing a list of duties. Select the two duties that are assigned to the board of directors.
- AImplement controls
- BSet risk appetiteCorrect answer
- CApprove the IT governance frameworkCorrect answer
- DOperationalize policies
Why this is the answer
Setting risk appetite and approving the governance framework are board duties. Implementing controls and operationalizing policies are management duties.
- Question 4Single Choice
Risk appetite is best defined as:
- AThe amount of risk the enterprise is willing to accept in pursuit of objectivesCorrect answer
- BA specific measurable tolerance threshold for a risk category
- CThe residual risk after controls are applied
- DThe total amount of risk transferred to third parties
Why this is the answer
Risk appetite is the board-approved amount of risk the enterprise is willing to accept. Risk tolerance is the specific measurable limit.
- Question 5Multiple Select
Which two statements are true regarding risk tolerance?
- AIt is the measurable translation of risk appetiteCorrect answer
- BIt is typically set by management within board-approved appetiteCorrect answer
- CIt is a high-level statement approved by the board
- DIt replaces risk appetite for strategic decisions
Why this is the answer
Risk tolerance converts appetite into specific measurable limits, normally defined by management under board guidance.
- Question 6Interactive
Examine the items in the code block. Which entry represents a risk tolerance rather than a risk appetite statement?
- AMaximum acceptable downtime: 4 hoursCorrect answer
- BWilling to accept high market risk for innovation
- CGeneral appetite for cost reduction initiatives
- DBoard preference for diversified revenue
Why this is the answer
A maximum downtime limit is a measurable tolerance. Broad willingness or preference statements reflect risk appetite, not tolerance.
- Question 7Single Choice
Corporate governance is best described as:
- AThe system by which organizations are directed and controlledCorrect answer
- BThe process of implementing security controls
- CA tool for IT service management
- DA technique for financial auditing
Why this is the answer
Corporate governance is the system of direction and control involving the board, management, shareholders, and stakeholders.
- Question 8Multiple Select
Which statements about the three lines of defense are correct? (Select all that apply.)
- AOperational management is the first line and owns riskCorrect answer
- BRisk management and compliance form the second lineCorrect answer
- CInternal audit is the third line and provides independent assuranceCorrect answer
- DInternal audit reports functionally to the chief risk officer
Why this is the answer
The first line owns risk, the second line monitors risk, and internal audit provides independent assurance. Internal audit must remain independent.
- Question 9Interactive
Based on the code block, which item represents a first-line operational management responsibility?
- AOwn and manage operational riskCorrect answer
- BMonitor risk and provide guidance
- CProvide independent assurance
- DApprove the enterprise risk appetite
Why this is the answer
Operational management is the first line and owns risk. Monitoring, assurance, and appetite approval belong to other governance lines.
- Question 10Single Choice
Which committee typically provides oversight of internal audit and financial reporting?
- AAudit committeeCorrect answer
- BRisk committee
- CIT steering committee
- DCompensation committee
Why this is the answer
The audit committee typically oversees internal audit, financial reporting, and the independent assurance process.
- Question 11Multiple Select
Which are characteristics of effective delegation of authority in governance? (Select all that apply.)
- AA documented delegation of authority matrixCorrect answer
- BClear escalation pathways for risk acceptanceCorrect answer
- CAd hoc approval decisions with no thresholds
- DDelegation without relieving the board of accountabilityCorrect answer
Why this is the answer
Effective delegation uses documented matrices and escalation paths. The board remains accountable even when authority is delegated.
IT Risk Assessment
9 questions in this domain
- Question 12Single Choice
In the CRISC framework, which statement best defines a risk event?
- AA distinct occurrence that may affect objectivesCorrect answer
- BA weakness in an asset
- CA potential cause of harm
- DA control designed to reduce impact
Why this is the answer
A risk event is a distinct occurrence or change of circumstances that could affect objectives. A weakness is a vulnerability, and a potential cause is a threat.
- Question 13Multiple Select
Which of the following are examples of threat actors recognized in CRISC? (Select all that apply.)
- AMalicious hackersCorrect answer
- BDisgruntled employeesCorrect answer
- CUnpatched servers
- DNation-state actorsCorrect answer
Why this is the answer
Unpatched servers are vulnerabilities, not threat actors. Malicious hackers, disgruntled employees, and nation-state actors can all initiate threat events.
- Question 14Interactive
Review the risk register excerpt in the code block. Which required field is missing from this entry?
- ARisk description
- BRisk ownerCorrect answer
- CLikelihood score
- DRisk response
Why this is the answer
Every risk register entry must include a designated risk owner who is accountable for managing the risk. This entry omits the risk owner.
- Question 15Single Choice
An employee leaves a laptop unattended in a public area. Which term best describes this situation?
- AVulnerabilityCorrect answer
- BThreat event
- CRisk impact
- DControl gap
Why this is the answer
It is a weakness in physical security procedure. Theft or unauthorized access would be the threat event.
- Question 16Multiple Select
Which statements about vulnerabilities and control gaps are correct? (Select all that apply.)
- AA vulnerability is a weakness in an asset or processCorrect answer
- BA control gap is a missing or ineffective controlCorrect answer
- CAll vulnerabilities require immediate remediation
- DVulnerabilities can be technical or non-technicalCorrect answer
Why this is the answer
Vulnerabilities can be technical or non-technical; control gaps are missing or ineffective controls. Not all vulnerabilities need immediate remediation.
- Question 17Interactive
Using the elements in the code block, identify the threat event in this risk scenario.
- AExternal hacker
- BExploits missing patch in web portalCorrect answer
- CCustomer database
- D$2M regulatory fine
Why this is the answer
The threat event is the specific occurrence where an actor exploits a vulnerability. The hacker is the threat actor, and the fine is the impact.
- Question 18Single Choice
What is the primary purpose of risk quantification in CRISC?
- ATo support risk response prioritization and resource allocationCorrect answer
- BTo eliminate all threats
- CTo replace expert judgment
- DTo create documentation
Why this is the answer
Risk quantification translates risk into comparable terms so management can prioritize responses and allocate resources effectively.
- Question 19Multiple Select
Which metrics are used in quantitative risk analysis? (Select all that apply.)
- ASingle Loss Expectancy (SLE)Correct answer
- BAnnualized Rate of Occurrence (ARO)Correct answer
- CAnnualized Loss Expectancy (ALE)Correct answer
- DKey Risk Indicator (KRI)
Why this is the answer
SLE, ARO, and ALE are quantitative risk metrics. KRIs are monitoring indicators, not quantitative risk analysis metrics.
- Question 20Interactive
Using the calculation in the code block, what is the annualized loss expectancy?
- A$5,000Correct answer
- B$10,000
- C$20,000
- D$15,000
Why this is the answer
ALE is SLE times ARO. With SLE of $10,000 and ARO of 0.5, the ALE is $5,000.
Risk Response and Reporting
13 questions in this domain
- Question 21Single Choice
Which risk response option involves discontinuing the activity that creates the risk?
- AAvoidanceCorrect answer
- BAcceptance
- CMitigation
- DTransfer
Why this is the answer
Avoidance eliminates the risk by discontinuing the activity that creates it, such as decommissioning a service or refusing to enter a market.
- Question 22Multiple Select
Which of the following are recognized risk response categories in the CRISC framework? (Select all that apply.)
- AAvoidanceCorrect answer
- BAcceptanceCorrect answer
- CMitigationCorrect answer
- DElimination of all uncertainty
Why this is the answer
The four risk response categories are avoid, accept, mitigate, and transfer. Complete elimination of uncertainty is not a valid response.
- Question 23Interactive
Based on the risk register entry in the code block, which risk response option is being applied?
- AAcceptanceCorrect answer
- BAvoidance
- CMitigation
- DTransfer
Why this is the answer
The code block describes a documented decision to retain the risk at a level within appetite, indicating acceptance.
- Question 24Single Choice
What is the primary objective of risk mitigation?
- AReduce likelihood or impactCorrect answer
- BTransfer financial risk
- CEliminate every possible risk
- DRetain risk without action
Why this is the answer
Mitigation reduces the likelihood or impact of a risk through controls and actions; residual risk remains.
- Question 25Multiple Select
Which of the following are examples of risk transfer? (Select all that apply.)
- APurchasing cyber insuranceCorrect answer
- BOutsourcing with an indemnification clauseCorrect answer
- CImplementing a firewall
- DAccepting budgeted loss
Why this is the answer
Insurance and indemnification clauses shift financial risk to another party. Firewalls mitigate, and budgeted losses indicate acceptance.
- Question 26Interactive
Based on the figures in the code block, why is the mitigation response justified?
- AThe cost is less than the expected reduction in lossCorrect answer
- BThe cost exceeds the expected benefit
- CThe transfer option is always cheaper
- DThere is no benefit from the control
Why this is the answer
Mitigation is justified when implementation cost is less than expected loss avoided, as shown by 50,000 versus 120,000.
- Question 27Single Choice
Who is accountable for implementing a risk response and reporting its outcomes?
- ARisk ownerCorrect answer
- BInternal audit
- CExternal auditor
- DVendor manager
Why this is the answer
Every risk response must have a risk owner accountable for implementation, monitoring, and reporting outcomes.
- Question 28Multiple Select
Which inputs are used to prioritize risk responses? (Select all that apply.)
- AInherent risk scoresCorrect answer
- BResidual riskCorrect answer
- CCost-benefit ratioCorrect answer
- DMarketing budget
Why this is the answer
Prioritization uses inherent risk, residual risk, appetite thresholds, and cost-benefit; marketing budget is not relevant.
- Question 29Interactive
Based on the risk scores in the code block, which risk should be prioritized first?
- ARisk CCorrect answer
- BRisk A
- CRisk B
- DAll risks equally
Why this is the answer
Risk C has the highest score at 25 and exceeds the appetite threshold, so it should be prioritized first.
- Question 30Single Choice
Which response is appropriate when a risk is within tolerance and further treatment is not economically justified?
- AAcceptanceCorrect answer
- BAvoidance
- CMitigation
- DTransfer
Why this is the answer
Acceptance is a deliberate decision to retain risk when it is within tolerance or further action is not cost-effective.
- Question 31Multiple Select
Which statements about risk acceptance are true? (Select all that apply.)
- AIt requires a documented decisionCorrect answer
- BIt is the same as inaction
- CIt may be chosen when mitigation is too expensiveCorrect answer
- DRisk owner sign-off is appropriateCorrect answer
Why this is the answer
Acceptance is formal and deliberate, may be cost-based, and requires risk-owner approval; it is not inaction.
- Question 32Interactive
Based on the code block, which statement best describes the risk treatment?
- AThe risk is still partly retainedCorrect answer
- BThe risk is fully transferred
- CThe risk is avoided
- DThe risk is accepted without oversight
Why this is the answer
Outsourcing can transfer financial loss, but regulatory and reputational risk remain with the enterprise, so risk is partly retained.
- Question 33Single Choice
Which control category is designed to stop an undesirable event from occurring?
- APreventiveCorrect answer
- BDetective
- CCorrective
- DDirective
Why this is the answer
Preventive controls deter or stop unwanted events before they occur, such as firewalls and authentication.
Technology and Security
8 questions in this domain
- Question 34Single Choice
Which principle requires multiple layers of security control across network, host, application, data, and administrative domains?
- ALeast Privilege
- BDefense in DepthCorrect answer
- CSeparation of Duties
- DDeny-by-Default
Why this is the answer
Defense in depth is the principle of using multiple layers of security control so that if one control fails, another is in place to protect the asset.
- Question 35Multiple Select
Which of the following are core objectives that security architecture must address? (Select all that apply)
- AConfidentialityCorrect answer
- BIntegrityCorrect answer
- CAvailabilityCorrect answer
- DAnonymity
Why this is the answer
Security architecture addresses the core objectives of confidentiality, integrity, and availability (CIA). Anonymity is not one of these core objectives.
- Question 36Interactive
Review the following architecture decision. Which principle is being violated by allowing the same individual to both initiate and approve a financial transaction?
- AFail Secure
- BSeparation of DutiesCorrect answer
- CDefense in Depth
- DDeny-by-Default
Why this is the answer
Separation of duties requires breaking critical actions such as initiating and approving a financial transaction into distinct roles to prevent fraud and reduce errors.
- Question 37Single Choice
What does the principle of least privilege require for users, processes, and applications?
- AMaximum rights necessary to perform any possible future duty
- BOnly the minimum rights necessary to perform assigned dutiesCorrect answer
- CThe same level of access as all other users
- DAccess based on a manager's approval only
Why this is the answer
Least privilege requires that users, processes, and applications have only the minimum rights necessary to perform their assigned duties, reducing the attack surface and limiting blast radius.
- Question 38Multiple Select
Which of the following are characteristics of deny-by-default and whitelisting? (Select all that apply)
- ATraffic is allowed only when explicitly authorizedCorrect answer
- BIt leads to predictable behavior and easier policy enforcementCorrect answer
- CIt relies on blocklisting known bad entities
- DIt is less robust than blocklisting in high-risk environments
Why this is the answer
Deny-by-default allows traffic or applications only when explicitly authorized. It makes behavior predictable and is more robust than blocklisting for high-risk environments.
- Question 39Interactive
Given the following configuration, which security architecture principle is being ignored?
- ASecure by Default and Fail SecureCorrect answer
- BDefense in Depth
- CSeparation of Duties
- DArchitecture Alignment with Enterprise Objectives
Why this is the answer
Systems should start from a secure configuration with unnecessary services and ports disabled, and should fail into a safe state that denies access. The configuration violates secure-by-default and fail-secure principles.
- Question 40Single Choice
Which type of control is a firewall classified as in network security architecture?
- ADetective
- BPreventiveCorrect answer
- CCorrective
- DCompensating
Why this is the answer
Firewalls are preventive and logical controls that enforce allowed and disallowed traffic based on predefined rules.
- Question 41Multiple Select
Which of the following are categories of controls that infrastructure and network controls support? (Select all that apply)
- APreventiveCorrect answer
- BDetectiveCorrect answer
- CCorrectiveCorrect answer
- DFinancial
Why this is the answer
Infrastructure and network controls can be preventive, detective, or corrective. Financial is not a standard control category in this context.
Frequently asked questions
Everything about the ISACA CRISC question bank and how to use it.