10 CRISC Questions Most Candidates Get Wrong
Welcome to this CRISC (Certified in Risk and Information Systems Control) practice set. These questions are designed to mirror the ISACA exam’s focus on applying risk management concepts to real-world IT scenarios, testing your ability to analyze, respond, and align with business objectives. Each question targets a specific domain—governance, risk response, monitoring, or IS control—and includes plausible distractors to challenge your critical thinking. Attempt each question before reviewing the answer and explanation.
Question 1
During a risk assessment, a business unit identifies a critical legacy application that cannot be patched due to vendor end-of-life. The application processes non-sensitive internal data but is essential for daily operations. The risk owner has a low risk appetite. What is the MOST appropriate risk response? Related reading: 10 SC-900 Questions Most Candidates Get Wrong.
A. Accept the risk, as the data is non-sensitive.
B. Mitigate the risk by implementing a compensating control, such as network segmentation.
C. Transfer the risk by purchasing cyber insurance.
D. Avoid the risk by decommissioning the application immediately.
Answer: B
Explanation: Since the risk owner has a low appetite and the application is critical, risk cannot be accepted (A) or transferred (C) effectively for an unpatched vulnerability. Avoiding (D) is disruptive and ignores business dependency. Mitigation via compensating controls (B) reduces the likelihood or impact while keeping the business function operational, aligning with ISACA’s preference for cost-effective risk reduction.
Question 2
An organization’s risk register shows that a key supplier has experienced two major cyber incidents in the past year. The enterprise risk committee decides to re-evaluate the supplier’s risk score. Which risk management principle is being applied?
A. Risk aggregation
B. Risk ownership
C. Risk appetite
D. Risk capacity
Answer: A
Explanation: Aggregation involves combining related risks (e.g., supplier incidents) to understand cumulative exposure, which is what the committee is doing. Risk ownership (B) refers to accountability, not re-scoring. Risk appetite (C) and capacity (D) are thresholds, not processes for combining risk data.
Question 3
Which of the following is the PRIMARY purpose of Key Risk Indicators (KRIs) in an ongoing risk monitoring program?
A. To provide early warning signs of increasing risk exposure.
B. To replace the need for annual risk assessments.
C. To calculate the exact financial loss from a risk event.
D. To document compliance with regulatory requirements.
Answer: A
Explanation: KRIs are forward-looking metrics that signal changes in risk levels, enabling proactive management (A). They do not replace assessments (B) or calculate losses (C), though they may inform loss estimates. Compliance documentation (D) is a byproduct, not the primary purpose.
Question 4
A project manager is implementing a new CRM system and identifies that the vendor’s data retention policy conflicts with local privacy regulations. The project sponsor wants to proceed with the vendor as-is. What should the risk practitioner do FIRST?
A. Document the risk in the project risk register and escalate to the risk committee.
B. Accept the risk on behalf of the sponsor to avoid project delay. Want to go further? 8 CISM Questions Most Candidates Get Wrong is a good next step.
C. Request the vendor to modify the policy immediately.
D. Advise the sponsor to terminate the vendor contract.
Answer: A
Explanation: The risk practitioner must formally record the risk and escalate it to the appropriate governance body (A), as the sponsor’s acceptance is not sufficient for a legal/compliance risk. Accepting unilaterally (B) violates risk ownership. Modifying the vendor (C) is premature without assessment, and termination (D) is a drastic response not yet justified.
Question 5
An organization has implemented a new firewall rule to block all inbound traffic from a specific geographic region. This is an example of which risk response category?
A. Mitigation
B. Avoidance
C. Transfer
D. Acceptance
Answer: A
Explanation: Mitigation reduces the likelihood or impact of a threat—here, blocking traffic reduces the probability of an attack from that region (A). Avoidance (B) would mean eliminating the activity entirely. Transfer (C) involves sharing risk (e.g., insurance), and acceptance (D) is a conscious decision to tolerate, neither of which applies to a technical control.
Question 6
Which of the following BEST describes the difference between inherent risk and residual risk?
A. Inherent risk is the risk after controls; residual risk is the risk before controls.
B. Inherent risk is the risk without controls; residual risk is the risk after controls are applied.
C. Inherent risk is always lower than residual risk.
D. Inherent risk is static, while residual risk changes over time.
Answer: B
Explanation: By definition, inherent risk exists in the absence of any controls, while residual risk remains after management implements controls (B). Option A reverses the definitions, C is incorrect because residual is typically lower, and D is false—both can change.
Question 7
A risk practitioner discovers that a third-party cloud provider’s audit report is outdated by 18 months. The provider is used for hosting customer data. What is the MOST appropriate immediate action?
A. Accept the risk because the provider is well-known.
B. Request the provider’s latest System and Organization Controls (SOC) report.
C. Terminate the contract with the provider.
D. Perform a full on-site audit of the provider immediately.
Answer: B You might also find 8 CompTIA Linux+ Questions Most Candidates Get Wrong helpful.
Explanation: The logical first step is to request the most recent SOC 2 or similar report to reassess the provider’s controls (B). Acceptance (A) is premature without updated evidence. Termination (C) is reactive and not based on a confirmed issue. On-site audit (D) is expensive and not standard practice for third-party reviews.
Question 8
During a risk assessment, the risk practitioner calculates that the annualized loss expectancy (ALE) for a data breach is $500,000. A proposed control costs $100,000 per year. Which decision rule should be applied?
A. Implement the control because it reduces risk.
B. Implement the control only if it reduces the ALE by at least $100,000.
C. Reject the control because it costs too much.
D. Implement the control regardless of cost to ensure security.
Answer: B
Explanation: In cost-benefit analysis, a control is justified if the reduction in ALE (i.e., risk reduction benefit) exceeds its annual cost (B). Option A ignores cost-effectiveness, C is premature without comparing reduction, and D violates the principle of aligning risk treatment with business value.
Question 9
Which of the following is a PRIMARY responsibility of the risk owner in an effective risk management program?
A. To implement all recommended controls personally.
B. To ensure that risk responses are aligned with the organization’s risk appetite.
C. To report all risks to the board on a monthly basis.
D. To eliminate all risks to zero.
Answer: B
Explanation: The risk owner is accountable for managing the risk in line with the enterprise’s risk appetite and tolerance (B). They may delegate control implementation (A) but remain accountable. Reporting frequency (C) is defined by policy, not a blanket rule, and eliminating all risk (D) is unrealistic and contrary to business enablement.
Question 10
An organization’s IT team receives a critical vulnerability alert for a public-facing web server. The exploit code is publicly available. The patch requires a system reboot, which will cause 30 minutes of downtime during business hours. What should the risk practitioner recommend FIRST?
A. Apply the patch immediately, accepting the downtime.
B. Defer the patch to the next maintenance window.
C. Implement a temporary virtual patch or web application firewall rule.
D. Disconnect the server from the internet permanently.
Answer: C
Explanation: Given the active exploit, immediate risk reduction is needed, but a permanent patch causes business disruption. A temporary compensating control (C) reduces exposure while planning a controlled outage. Applying immediately (A) is disruptive without planning, deferring (B) increases risk, and disconnecting (D) is excessive.
Closing: These questions highlight the CRISC’s core expectation: balancing risk reduction with business enablement, using structured processes, and escalating appropriately. Mastery requires not just knowing definitions but applying judgment under uncertainty. For more practice, including full-length simulations with performance analytics, visit the recommended resource below.
As you map out your remaining prep time, a free CRISC study plan creates a week-by-week schedule that fits your availability and covers the exam topics in the right proportions.
If your study notes feel solid, prove it — sit ISACA Certified in Risk and Information Systems Control (CRISC) exam questions and see your score.
Before you sit those exam questions, a free CRISC readiness check helps you spot your weakest topic and understand the reasoning behind each answer.