ISACA
ISACA Certified in Risk and Information Systems Control (CRISC) Practice Questions
332
questions
2026-06-21
updated
Online quiz simulator
Domain coverage
- Governance (26%)
- IT Risk Assessment (20%)
- Risk Response and Reporting (32%)
- Information Technology and Security (22%)
Sample Questions (34 of 332 shown)
Q4
Which of the following BEST mitigates the risk associated with sensitive data loss due to theft of an organization's removable media?
✓ Correct Answer: A
The BEST mitigation for sensitive data loss due to theft of removable media is data encryption (A). Encryption ensures that even if the media is stolen, the data cannot be read without the decryption key. Option B (asset management policy) helps track media but doesn't protect data if stolen. Option C (code of conduct) is administrative. Option D (DLP system) can prevent data from being copied to removable media but is not as effective as encryption when theft occurs. Encryption is the most direct and reliable control for this specific risk.
Q5
Which of the following should be the PRIMARY consideration when quantifying the risk associated with regulatory noncompliance?
✓ Correct Answer: D
The PRIMARY consideration when quantifying risk associated with regulatory noncompliance is the value of punitive penalties and fines (D). Regulatory noncompliance risk is primarily quantified by the financial impact of penalties, fines, and sanctions. Option A (remediation time/cost) is a secondary cost. Option B (continuous compliance cost) is an operational expense. Option C (historical events) informs likelihood but doesn't quantify impact. The value of penalties and fines is the direct financial quantification of noncompliance risk per ISACA's risk quantification guidance.
Q6
Which of the following is the BEST way to maintain a current list of organizational risk scenarios?
✓ Correct Answer: A
The BEST way to maintain a current list of organizational risk scenarios is to conduct periodic risk reviews with stakeholders (A). Risk scenarios must be regularly reviewed and updated with stakeholders who understand the business environment. Stakeholder engagement ensures risk scenarios remain relevant and complete. Option B (reviewing key controls) addresses controls, not risk scenarios. Option C (compliance reviews) is narrower in scope. Option D (automated workflow) can help track updates but doesn't ensure completeness and relevance like stakeholder reviews.
Q7
When developing a risk awareness training program, which of the following is the BEST way to promote a risk-aware culture?
✓ Correct Answer: C
The BEST way to promote a risk-aware culture in a risk awareness training program is to emphasize individual responsibility for managing risk (C). When employees understand they are individually accountable for risk management in their roles, culture change happens. Option A (challenging business processes) is too adversarial. Option B (illustrating threat identification methods) is technical training, not culture building. Option D (communicating escalation procedures) is procedural. Individual responsibility is the foundation of a risk-aware culture per ISACA's culture guidance.
Q8
Which of the following is the PRIMARY reason to periodically assess risk management capabilities?
✓ Correct Answer: D
The PRIMARY reason to periodically assess risk management capabilities is to determine opportunities for improvement (D). Assessment of capabilities identifies gaps and areas for enhancement. Option A (determining changes in risk profile) is a result of risk assessment, not capability assessment. Option B (monitoring risk factors) is ongoing monitoring. Option C (measuring ROI on controls) is a specific metric. Capability assessment's main purpose is continuous improvement of the risk management function itself.
Q9
Which of the following is the PRIMARY purpose of periodically updating an organization's risk profile?
✓ Correct Answer: A
The PRIMARY purpose of periodically updating an organization's risk profile is to inform senior management of changes in the risk environment (A). The risk profile is a communication tool for senior leadership to understand current risk status. Option B (providing risk-based audit program) is a secondary use. Option C (identifying policy-procedure gaps) is an operational outcome. Option D (prioritizing management reviews) is a process outcome. The primary purpose is senior management awareness and decision-making support.
Q10
Continuous monitoring of key risk indicators (KRIs) will:
✓ Correct Answer: B
Continuous monitoring of KRIs provides an early warning so that proactive action can be taken (B). KRIs are leading indicators designed to signal emerging risk before it materializes. Option A (ensuring risk tolerance/appetite alignment) is a governance activity. Option C (ensuring risk won't exceed appetite) is unrealistic - KRIs warn but don't prevent. Option D (providing a snapshot) is what a point-in-time assessment does, not continuous monitoring. Early warning and proactive action are the defined purposes of KRI monitoring per ISACA.
Q11
Which of the following aspects of risk can be transferred to a third party?
✓ Correct Answer: D
The aspect of risk that can be transferred to a third party is financial impact (D). Risk transfer (e.g., through insurance, outsourcing) shifts the financial burden of loss to another party. Option A (reputation impact) cannot be fully transferred - the organization's reputation remains affected. Option B (ownership) cannot be transferred - the organization remains accountable. Option C (accountability) cannot be transferred - ultimate accountability remains with the organization. Only financial impact can be transferred through contracts and insurance.
Q12
An organization has engaged an external consultant to assess its cybersecurity program. Which of the following findings would be MOST important to address?
✓ Correct Answer: D
Among the findings from a cybersecurity program assessment, the MOST important to address is lack of accountability (D). Without accountability, no one owns the risk or is responsible for fixing issues - making all other findings unaddressable. Option A (lack of risk profile) is important but secondary to accountability. Option B (lack of awareness training) is a control gap. Option C (lack of dedicated team) is a resourcing issue. Accountability is the foundational governance element per ISACA's three lines of defense model.
Q13
A risk practitioner has observed an increasing trend of phishing attempts directed at employees. Which of the following is the MOST important action to help mitigate the situation?
✓ Correct Answer: C
The MOST important action to mitigate increasing phishing attempts is to implement a targeted security awareness campaign (C). Phishing targets human behavior - the most effective mitigation is training employees to recognize and report phishing. Option A (reporting to regulators) is unnecessary for internal phishing. Option B (cyber intelligence services) provides information but doesn't mitigate the human vulnerability. Option D (updating anti-malware) is technical but phishing doesn't always involve malware. Awareness training directly addresses the human vulnerability.
Q14
Which of the following is the MOST important benefit of implementing a data classification program?
✓ Correct Answer: B
The MOST important benefit of implementing a data classification program is identification of appropriate controls (B). Once data is classified (e.g., public, internal, confidential, restricted), you can apply the appropriate level of control for each classification. Option A (reduced processing times) is not a primary benefit. Option C (reduced data complexity) is not directly achieved. Option D (identifying ownership) is a separate process. Data classification's primary purpose in risk management is to drive control selection and implementation.
Q15
Which of the following BEST indicates that risk management is embedded into the responsibilities of all employees?
✓ Correct Answer: B
The BEST indication that risk management is embedded into all employees' responsibilities is that risk management practices are incorporated into business processes (B). When risk consideration is part of everyday business processes (e.g., procurement, project initiation, change management), it shows true embedding. Option A (decreased incidents) could result from many factors. Option C (benchmarking) is a periodic activity. Option D (audits) is a review function. Integration into business processes demonstrates cultural and operational embedding of risk management.
Q16
An organization moved one of its applications to a public cloud, but after migration decided to move it back on-premise after an issue caused the application to be down for one day. What does this scenario indicate?
✓ Correct Answer: B
An organization that moves an application to public cloud but moves it back on-premise after a one-day outage indicates the organization has low risk tolerance (B). Risk tolerance is the acceptable variation in outcome - a one-day outage was intolerable, indicating low tolerance for availability risk. Option A (high risk tolerance) would mean they'd accept the outage. Option C (high risk appetite) means they'd be willing to take on cloud risk. Option D (low risk appetite) is about willingness to take risk, not reaction to loss. The quick reversal after brief downtime indicates low tolerance.
Q17
Which of the following should be the PRIMARY role of the data owner in a risk management program?
✓ Correct Answer: C
The PRIMARY role of the data owner in a risk management program is applying data classification policy (C). The data owner is responsible for classifying data based on its sensitivity and criticality, which drives protection requirements. Option A (maintaining data syntax rules) is a data quality/technical function. Option B (establishing system security levels) is infrastructure. Option D (specifying retention requirements) is a records management function. Data classification is the data owner's core responsibility in the risk management framework per ISACA.
Q18
Which of the following should be a risk practitioner's PRIMARY consideration when evaluating the possible impact of an adverse event affecting corporate information assets?
✓ Correct Answer: D
The PRIMARY consideration when evaluating the possible impact of an adverse event affecting corporate information assets is the criticality classification of the assets needed for normal business operations (D). Impact is determined by how critical the asset is to the business - high-criticality assets have higher impact if compromised. Option A (authentication/authorization) is an access control consideration. Option B (regulatory fines) is a component of impact but not the primary consideration. Option C (amount of data processed) doesn't necessarily correlate with impact. Asset criticality classification is the standard method for impact assessment.
Q19
Which of the following is MOST important to include in an IT risk management policy?
✓ Correct Answer: C
The MOST important element to include in an IT risk management policy is risk assessment requirements (C). The policy must mandate that risks are identified and assessed - this is the foundation of all risk management activities. Option A (risk treatment types) belongs in standards/procedures. Option B (risk ownership requirements) is important but secondary to assessment. Option D (risk scoring methodology) is a procedural detail. ISACA's risk management framework emphasizes that the policy must require risk assessment as the foundational activity.
Q20
Which of the following is the PRIMARY focus of enterprise architecture (EA)?
✓ Correct Answer: A
The PRIMARY focus of enterprise architecture (EA) is to facilitate the alignment of IT with business strategy (A). EA provides a holistic view of the organization's IT environment and ensures IT investments support business goals. Option B (organization-wide risk assessments) is a risk management function. Option C (reducing platform components) is a consolidation benefit. Option D (integrating secure coding) is a development practice. EA's defined purpose per TOGAF and ISACA is strategic IT-business alignment.
Q21
Which of the following would be MOST helpful when selecting appropriate protection for data?
✓ Correct Answer: A
The MOST helpful factor when selecting appropriate protection for data is data classification (A). Classification tells you how sensitive the data is, which determines what level of protection is needed. Option B (data access requirements) is derived from classification. Option C (risk tolerance) influences protection decisions but classification is the direct driver. Option D (business objectives) are broader. Data classification is the standard and most direct method for determining data protection requirements per ISACA and ISO 27001.
Q22
Which of the following should be the PRIMARY driver for an organization on a multi-year cloud implementation to publish a cloud security policy?
✓ Correct Answer: B
The PRIMARY driver for an organization to publish a cloud security policy during a multi-year cloud implementation is to establish minimum cloud security requirements (B). The policy sets the baseline that all cloud implementations must meet. Option A (evaluating gaps) is an assessment activity that may inform the policy. Option C (enforcing compliance) comes after the policy is published. Option D (educating IT staff) is training, not the primary driver. Establishing minimum requirements is the policy's core purpose.
Q23
Which of the following provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment?
✓ Correct Answer: C
Enterprise architecture (EA) documentation (C) provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment. EA documents the relationships between systems, data flows, and dependencies - making it possible to understand how risks aggregate across the technical landscape. Option A (business case documentation) is project-specific. Option B (risk appetite statement) is a governance document. Option D (organizational hierarchy) shows reporting lines, not technical dependencies. EA documentation is the standard tool for understanding technical risk aggregation.
Q24
Which of the following is the MOST important responsibility of a business process owner to enable effective IT risk management?
✓ Correct Answer: A
The MOST important responsibility of a business process owner to enable effective IT risk management is prioritizing risk for appropriate response (A). The business process owner understands business priorities and can determine which risks need which response (mitigate, accept, transfer, avoid). Option B (escalating to senior management) is a communication step. Option C (collecting and analyzing risk data) is the risk practitioner's role. Option D (delivering reports) is a communication function. Prioritization based on business understanding is the owner's unique and critical contribution.
Q25
Which of the following is the MOST important course of action to foster an ethical, risk-aware culture?
✓ Correct Answer: A
The MOST important course of action to foster an ethical, risk-aware culture is to establish an enterprise-wide ethics training and awareness program (A). Training and awareness change behavior and build culture. Option B (aligning policies to risk appetite) is structural but doesn't build culture alone. Option C (fraud detection framework) is detective, not preventive. Option D (legislative review) is compliance. ISACA emphasizes that ethics and risk-aware culture are built through comprehensive, ongoing training and awareness programs that reach all employees.
Q26
The software version of an enterprise's critical business application has reached end-of-life and is no longer supported by the vendor. IT has decided to develop an in-house replacement application. Which of the following should be the PRIMARY concern?
✓ Correct Answer: A
When an enterprise decides to develop an in-house replacement for an end-of-life critical business application, the PRIMARY concern should be that the business process owner is not an active participant (A). Business process owner involvement is critical for requirements, testing, and adoption. Without their participation, the replacement may not meet business needs. Option B (board approval) may be needed for funding but isn't the primary concern. Option C (system documentation) is important but secondary. Option D (ERM approval) is a governance step. Lack of business owner participation is the most critical success factor gap.
Q27
Which of the following is the PRIMARY benefit of consistently recording risk assessment results in the risk register?
✓ Correct Answer: A
The PRIMARY benefit of consistently recording risk assessment results in the risk register is accuracy of risk profiles (A). The risk register is the central repository for risk information - consistent recording ensures the risk profile (aggregate view of all risks) is accurate and reliable. Option B (compliance with best practice) is a secondary benefit. Option C (assessment of risk appetite) uses the register but isn't the primary benefit of recording. Option D (accountability for loss events) is a separate process. Accurate risk profiles enable effective risk management decision-making.
Q28
Which of the following deficiencies identified during a review of an organization’s cybersecurity policy should be of MOST concern?
✓ Correct Answer: D
The MOST concerning deficiency in an organization's cybersecurity policy is that the policy has not been approved by the organization's board (D). Board approval demonstrates executive commitment and gives the policy authority. Without board approval, the policy lacks legitimacy and enforceability. Option A (gaps against standards) can be remediated. Option B (lacks specifics) is appropriate - policies are high-level, specifics belong in standards. Option C (not reviewed in over a year) is a maintenance issue. Board approval is the critical governance element for enterprise security policy.
Q29
Of the following, who should be responsible for determining the inherent risk rating of an application?
✓ Correct Answer: D
The inherent risk rating of an application should be determined by the risk practitioner (D). The risk practitioner is trained in risk assessment methodologies and can provide an objective, consistent assessment. Option A (application owner) may have bias toward lower risk ratings. Option B (senior management) doesn't have the technical detail. Option C (business process owner) understands business impact but may not have risk assessment expertise. The risk practitioner's role is to provide independent, objective risk assessment per ISACA's framework.
Q30
Which of the following should be of GREATEST concern to a risk practitioner reviewing the implementation of an emerging technology?
✓ Correct Answer: C
The GREATEST concern when reviewing implementation of an emerging technology is lack of risk assessment (C). Without risk assessment, you don't know what risks the technology introduces. Option A (lack of management approval) is a governance gap but secondary to understanding the risks. Option B (lack of risk and control procedures) can be developed after assessment. Option D (lack of alignment to best practices) is a design concern. Risk assessment must precede all other risk management activities per ISACA's risk management process.
Q31
Which of the following should be the PRIMARY consideration when identifying and assigning ownership of IT-related risk?
✓ Correct Answer: B
The PRIMARY consideration when identifying and assigning ownership of IT-related risk is accountability for losses due to impact (B). The risk owner must be accountable for the business impact of the risk - this ensures they have incentive to manage it properly. Option A (accountability for control operation) is the control owner's role, not risk owner. Option C (ability to design controls) is a capability, not the basis for assignment. Option D (span of control) is organizational. Risk ownership is assigned based on who is accountable for the business impact per ISACA's three lines of defense model.
Q32
A multinational company needs to implement a new centralized security system. The risk practitioner has identified a conflict between the organization's data-handling policy and local privacy regulations. Which of the following would be the BEST recommendation?
✓ Correct Answer: A
When there is a conflict between the organization's data-handling policy and local privacy regulations in a multinational company implementing a centralized security system, the BEST recommendation is to request a policy exception from senior management (A). Local regulations take precedence over organizational policy (legal compliance), but the proper governance process is to document the conflict and request an exception with justification. Option B (request exception from regulator) is inappropriate - regulators don't grant exceptions for noncompliance. Option C (comply with organizational policy) risks legal violation. Option D (report noncompliance to regulator) is premature. Exception management through senior management is the proper governance process.
Q33
When reporting to senior management on changes in trends related to IT risk, which of the following is MOST important?
✓ Correct Answer: B
When reporting to senior management on changes in trends related to IT risk, materiality (B) is the MOST important consideration. Senior management needs to know what risks are material (significant enough to affect the organization's objectives or financial status). Option A (maturity) is a capability assessment, not a trend reporting priority. Option C (confidentiality) is a data protection principle. Option D (transparency) is a reporting quality but not the primary filter. Materiality ensures senior management focuses on risks that truly matter to the organization per ISACA's reporting guidance.
Q34
Which of the following is MOST important for management to consider when deciding whether to invest in an IT initiative that exceeds management's risk appetite?
✓ Correct Answer: B
When deciding whether to invest in an IT initiative that exceeds management's risk appetite, the MOST important factor for management to consider is risk tolerance (B). Risk tolerance is the acceptable level of variation in outcome - if the initiative exceeds risk appetite, management must determine if they can tolerate the potential deviation. Option A (risk management budget) is a constraint. Option C (risk capacity) is the total amount of risk the organization can bear, which is broader. Option D (industry trends) is external reference. Risk tolerance is the direct measure for such decisions per ISACA's risk management framework.
You've viewed 3 of 332 questions. Start the free practice exam to answer all questions with instant feedback.
What Our Customers Say 144 verified reviews
★★★★★★
The most realistic CRISC practice test I have ever used. The question style and difficulty match the real exam perfectly.
★★★★★★
Bought lifetime access for the CRISC bank and it’s been great. Still use it to brush up even after passing the cert.
★★★★★★
The CRISC exam was brutal, but these practice questions prepared me for the worst. Came out with a solid pass.
★★★★★★
I let my coworker borrow my CRISC account to study — he passed too. These questions are legit.
★★★★★
Couldn’t have passed the CRISC exam without this. The questions are challenging, the explanations are thorough, and the value is unbeatable.
★★★★★
Best investment for ISACA certification prep. The question bank for CRISC is comprehensive and mirrors the real exam perfectly.
Frequently Asked Questions
CRISC is risk-focused. CISM is security program management; CISSP is broad technical security. CRISC specifically validates risk identification, assessment, response, and control monitoring skills. If your role involves risk registers, risk appetite statements, and control frameworks, CRISC is the certification that matches your daily work.
Yes—CRISC tests your ability to apply risk management frameworks including ISO 31000, NIST Risk Management Framework (RMF), and FAIR (Factor Analysis of Information Risk). You should understand qualitative vs quantitative assessment methodologies and when to apply each. Our practice questions include framework-specific scenarios.
ISACA requires 3 years of professional experience in at least two CRISC domains (of which one must be Domain 1 or Domain 2). This experience must be within the 10-year period preceding certification. No waivers are available for CRISC—the experience requirement is strict.
KRIs are forward-looking metrics that signal increasing risk exposure before a loss event occurs. Domain 3 (32%) tests KRI design, threshold setting, and reporting. You must distinguish KRIs (predictive) from KPIs (performance measurement) and KCIs (control effectiveness). Our Domain 3 section dedicates extensive coverage to KRI scenarios.
Free Study Resources
Community-verified analysis of 186 topics from real test-taker discussions — 14 deep analyses and 20 FAQs.