Skip to content
Tags: crisc risk-management governance

ISACA Certified in Risk and Information Systems Control (CRISC) - Full Practice Exam 1

Suggested duration: 240 minutes

By Oleksandr Andrushchenko — Published on

150 questions ยท Free

Prepare for ISACA Certified in Risk and Information Systems Control (CRISC) with 150 original questions, realistic scenarios, and explanations for every choice. Practice across the official topic domains with a suggested time of 240 minutes.

Study instructions

Select the single best answer unless a question explicitly asks for multiple answers. Multiple-answer questions require the exact set. Suggested time: 240 minutes.

Questions — 150

  1. A board-approved strategy changes, but risk reporting still emphasizes the discontinued product line. What should be reviewed?
  2. A board asks who may authorize operation outside an approved tolerance. What should provide the answer?
  3. A board receives only a count of high risks. What additional information best supports its decisions?
  4. A business asks whether a zero-trust initiative removes the need for asset inventory. What is the best answer?
  5. A business decides not to launch a service because its unavoidable risk is unacceptable. What response is this?
  6. A business deploys Internet-connected sensors with default credentials and no update process. What is the main risk pattern?
  7. A business owner says a loss estimate double-counts the same customer compensation under two scenarios that cannot occur together. What should be reviewed?
  8. A business owner wants to compare a fast temporary fix with a slower permanent redesign. What should the recommendation show?
  9. A business process changed from daily batch settlement to real-time settlement. What risk assumption most clearly needs review?
  10. A business process tolerates a four-hour outage. A supplier's recovery commitment is twelve hours. What should the assessment highlight?
  11. A business stores backups in the same administrative account as production, and the account can delete both. What risk is most important?
  12. A business unit defines its own risk framework that conflicts with enterprise reporting requirements. What should the practitioner seek?
  13. A business unit exceeds tolerance repeatedly but receives only routine monthly reporting. What should the practitioner recommend?
  14. A business wants faster onboarding, but a proposed control adds a week to every application. How should the practitioner frame the decision?
  15. A business wants to stop a risk treatment halfway because costs increased. What should support the decision?
  16. A CI/CD pipeline can deploy production code using a long-lived secret stored in source control. What should treatment address?
  17. A company enters a joint venture and shares a critical data platform. What should be clarified early?
  18. A company evaluates projects individually but never examines their combined dependence on one cloud region. What is missing?
  19. A company has a general risk appetite statement but no operational limits for a critical service. What should the practitioner help develop?
  20. A company purchases cyber insurance but continues operating the service. What response does the policy primarily represent?
  21. A company transfers data processing to a supplier but retains legal accountability for the records. What should treatment include?
  22. A company uses a managed database. The provider patches the engine, but the customer controls users and table grants. What should the assessment distinguish?
  23. A company uses anonymized data, but a practical linkage with another dataset can identify individuals. What should be reassessed?
  24. A control costs $70,000 annually and is expected to reduce annualized loss from $100,000 to $50,000. Ignoring other benefits and obligations, what is its estimated annual net financial benefit?
  25. A control detects unauthorized changes after they occur but does not block them. How should it be classified?
  26. A control exception is justified by a business benefit that has since disappeared. What should the practitioner do?
  27. A control is documented as enabled, but tests show it fails for one production path. What should residual-risk analysis use?
  28. A control owner changes a threshold without approval, reducing reported breaches. What should be reviewed?
  29. A control owner says a screenshot from installation proves year-round effectiveness. What evidence is needed?
  30. A control owner's self-report conflicts with independent test evidence. How should governance respond?
  31. A control plan lists a remediation task but no accountable owner. What is the best correction?
  32. A control test identifies one failure in a high-consequence transaction path. What should determine the response?
  33. A control test samples only the best-managed branch, while the risk covers fifty branches. What should the practitioner question?
  34. A control tests well in one application but is deployed differently across the enterprise. What should assurance consider?
  35. A critical application uses third-party libraries but has no dependency inventory. What risk-management limitation follows?
  36. A critical process has no recent loss history. What is the most defensible interpretation for assessment?
  37. A critical process is protected by several controls that all depend on one identity service. What should the practitioner highlight?
  38. A critical process's recovery target is defined by IT without consulting business owners. What should happen?
  39. A critical service depends on one DNS provider and one identity provider. What should a resilience assessment include?
  40. A critical system's data is encrypted, but all application administrators can retrieve the keys. What should the assessment evaluate?
  41. A critical workload is replicated across availability zones but remains in one region. What assumption should be challenged?
  42. A database is backed up daily, but records are corrupted silently for a week before detection. What should be assessed?
  43. A detective control produces findings, but no team is responsible for responding. What is the key gap?
  44. A division wants to accept a risk whose potential loss exceeds its delegated approval limit. What is the appropriate next step?
  45. A KRI has no reliable data source and is frequently estimated by intuition. What should be improved?
  46. A KRI threshold has been breached, but no response is defined. What should be established?
  47. A legacy integration uses an unsupported protocol with no strong authentication. What should risk treatment consider?
  48. A manager asks to remove an overdue treatment from reporting because it affects a performance target. What should the practitioner do?
  49. A manager suppresses adverse risk reports to protect performance bonuses. What is the most significant concern?
  50. A merger introduces overlapping privileged accounts in two directories. What should the risk assessment consider?
  51. A microservice trusts every request from the internal network without checking identity or authorization. What is the main concern?
  52. A mobile application stores an access token in logs accessible to a broad support group. What should be prioritized?
  53. A monitoring measure counts controls deployed. Why might it be insufficient as a KRI?
  54. A network segmentation control is documented but permits unrestricted lateral traffic between sensitive and ordinary workloads. What evidence matters most?
  55. A new acquisition has stronger local controls than the enterprise baseline. What should the practitioner recommend?
  56. A new attacker technique is technically possible, but its relevance to the organization is unknown. What should happen before increasing the rating?
  57. A new control creates many false alarms that staff routinely ignore. What should the practitioner assess?
  58. A new control reduces fraud but creates a single point of service failure. What should the practitioner assess?
  59. A new legal requirement conflicts with the organization's previously accepted practice. What should the risk practitioner do first?
  60. A new risk owner is assigned after reorganization. What should be transferred?
  61. A patch program excludes containers because the hosts are patched. What exposure may remain?
  62. A policy exception is approved for six months, but no review owner is recorded. What is the best correction?
  63. A practitioner must report a material risk while its estimate is still being refined. What is the best approach?
  64. A preventive control is unavailable for a legacy system. What should the practitioner consider?
  65. A process can lose at most ten minutes of transactions. Backups occur every four hours with no additional replication. What gap is indicated?
  66. A process owner accepts a low residual risk within delegated authority. What should the practitioner ensure?
  67. A process owner approves access while the same person can create users and conceal audit records. What principle should guide remediation?
  68. A process owner claims a security risk belongs only to IT because it involves software. What should the practitioner explain?
  69. A process owner's impact estimate excludes customer compensation required by contract. What should the practitioner do?
  70. A process relies on a SaaS provider, but no internal owner is assigned because the system is outsourced. What is the primary governance gap?
  71. A project sponsor asks the risk practitioner to guarantee that no security loss will occur. What should the practitioner explain?
  72. A proposed KRI is useful only after a large loss has occurred. What should the practitioner consider adding?
  73. A quantitative model is highly sensitive to the estimated outage duration. What should the practitioner prioritize?
  74. A recovery control is implemented but never exercised. Which test would best validate the required outcome?
  75. A recovery test restores data successfully but omits application dependencies and user transactions. What assurance is missing?
  76. A remediation is complete, but the same weakness recurs after each deployment. What should treatment address?
  77. A remediation plan uses a successful vulnerability scan as its only completion criterion, but the risk concerns unauthorized business transactions. What should be added?
  78. A remote-access design uses MFA but grants every authenticated user access to all internal services. What gap remains?
  79. A restore procedure returns service after a damaging event. What is its primary control function?
  80. A retail group expands online sales, increasing dependence on one payment platform. What should the risk practitioner establish before recommending new controls?
  81. A risk appetite statement is approved but unknown to project decision-makers. What is the most useful next step?
  82. A risk committee asks whether its process itself is effective. Which evidence is most relevant?
  83. A risk committee asks why IT risk should be integrated with enterprise risk management. What is the strongest reason?
  84. A risk committee wants evidence that treatment spending supports strategy. Which linkage is most useful?
  85. A risk dashboard omits accepted risks. What limitation does this create?
  86. A risk is accepted because further mitigation is disproportionate. A mandatory contractual control remains unmet. What should be clarified?
  87. A risk owner asks for 'best practice' controls without defining the target exposure. What should the practitioner clarify?
  88. A risk owner chooses a control that reduces likelihood but does not change impact if the event occurs. What should the report show?
  89. A risk policy was approved five years ago and has not changed after major acquisitions. What should the practitioner recommend?
  90. A risk practitioner finds that managers define acceptable exposure differently to improve their scores. What should be strengthened?
  91. A risk practitioner is asked to approve their own assessment as independent assurance. What is the concern?
  92. A risk practitioner receives evidence that a compensating control covers only half the affected systems. What should be done?
  93. A risk practitioner reviews an assessment based only on average annual losses. What important issue may need separate consideration?
  94. A risk rating decreases after a control purchase, although implementation has not begun. What should the practitioner challenge?
  95. A risk register lists only malicious attacks. Which additional sources should be considered?
  96. A risk report includes no changes since the previous month even though a critical supplier failed. What should be updated?
  97. A risk report mixes current and target residual risk without labels. What improvement is most important?
  98. A risk report ranks every issue critical to secure more funding. What is the main consequence?
  99. A risk scenario assumes employees will report fraud promptly, but the reporting channel is anonymous only in policy and not in practice. What is the concern?
  100. A risk treatment depends on training employees to recognize a rare scenario. What should effectiveness testing include?
  101. A risk treatment is judged successful solely because it complied with the implementation schedule. What additional evidence is needed?
  102. A risk workshop includes IT staff but excludes business owners and legal specialists. What is the main assessment concern?
  103. A SaaS application is configured to allow public access to sensitive customer exports. Which responsibility needs immediate clarification?
  104. A scanner identifies a critical weakness on an isolated laboratory host with no sensitive data. What should the practitioner do before assigning business risk?
  105. A scenario says, 'Credential theft could allow unauthorized payment approval, causing fraudulent transfers.' Which element is the business consequence?
  106. A scenario's SLE is $80,000 and its estimated annual rate of occurrence is 0.25. What is annualized loss expectancy under these assumptions?
  107. A second-line risk team is asked to operate the control it must independently challenge. What should be considered?
  108. A security control has strong design but insufficient staffing to operate it consistently. What should the practitioner assess?
  109. A strategic objective requires rapid partner onboarding. Which risk-governance approach best supports it?
  110. A supplier assurance report is current but excludes the data center used by the organization. What is the best assessment response?
  111. A supplier contract shifts some liability but caps damages far below the customer's plausible loss. What should be reported?
  112. A supplier stores customer data in multiple regions, but the organization has not mapped applicable location restrictions. What should be done?
  113. A system's audit logs can be modified by the same administrator whose actions are being reviewed. What control concern should be assessed?
  114. A team asks whether to quantify reputational damage precisely despite limited evidence. What is the best approach?
  115. A team discovers unauthorized access that has already occurred. How should it distinguish the event from prospective risk?
  116. A team lists 'ransomware' without identifying affected processes or outcomes. What is the best next step?
  117. A team wants to send production records to an external AI service without assessing its retention or training terms. What should happen first?
  118. A threat-modeling exercise identifies a public API trust boundary but no authorization check before sensitive operations. What risk factor is being identified?
  119. A treatment deadline passes while an exception remains active. What should happen?
  120. A treatment depends on a third party completing work, but no dependency milestone is tracked. What should be added?
  121. A treatment is marked implemented, but the risk owner has not reviewed the resulting residual exposure. What remains necessary?
  122. A treatment project is delayed six months while current exposure remains high. What should the practitioner do?
  123. A treatment reduces exposure but leaves residual risk above tolerance. What should the practitioner recommend?
  124. A vendor promises a control will reduce risk by 90%, but provides no environment-specific evidence. What should happen before relying on the estimate?
  125. A vulnerability exists, but the only proposed attack requires access that no credible threat actor can currently obtain. What should the practitioner assess?
  126. An accepted risk's monitoring shows that the original likelihood assumption was too low. What should happen?
  127. An access review is completed by approving every entitlement without checking current duties. What should the practitioner conclude?
  128. An AI assistant can invoke a payment tool using an unrestricted administrator credential. What should the risk practitioner prioritize?
  129. An AI workflow retrieves external documents that can contain malicious instructions. Which risk should be assessed?
  130. An API rate limit reduces abusive traffic but does not validate whether a user may read a particular account. What remains necessary?
  131. An application validates a user in the browser but does not enforce authorization on its API. What is the primary weakness?
  132. An approval workflow blocks an unauthorized payment before release. What is its primary function?
  133. An assessment concludes that residual risk is acceptable but never states the applicable tolerance. What is missing?
  134. An assessment labels a supplier 'low risk' based on company size. The supplier holds all production recovery keys. What should be examined?
  135. An assessment relies on an asset inventory that omits newly deployed cloud workloads. What is the most important limitation?
  136. An assessment uses the same high/medium/low likelihood words but different time horizons across departments. What should be clarified?
  137. An asset worth $500,000 has an estimated exposure factor of 20% for one event. What is the single loss expectancy under this model?
  138. An enterprise inventory records systems but not the business processes they support. What should be added to improve risk decisions?
  139. An executive asks for a single net-risk number across unrelated ordinal scores. What should the practitioner explain?
  140. An executive requests a new KRI for every available metric. What should the practitioner recommend?
  141. An external auditor identifies a control weakness. Who should ordinarily own the resulting business risk?
  142. An organization encrypts stored data but lets every application account decrypt it. What should the practitioner evaluate?
  143. An organization grants a service account broad privileges because it is not used by a human. What should the practitioner explain?
  144. An organization moves to infrastructure as code. What risk-control opportunity is most relevant?
  145. An organization requires administrators to approve their own production changes. What risk principle is implicated?
  146. An organization wants a risk-aware culture. Which behavior is strongest evidence of progress?
  147. Historical losses suggest a risk's annual frequency could range from 0.1 to 0.8. How should the practitioner present the estimate?
  148. The risk register contains no mapping between risks and business objectives. Why is this a problem?
  149. Two business units use different meanings of 'high impact,' preventing consolidation. What should be established?
  150. Two critical services depend on the same identity provider. Separate assessments assume their outages are independent. What should be corrected?

Comments — 0

Related exams