10 free, exam-style Certified in Risk and Information Systems Control (CRISC) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CRISC practice test to study every exam domain.
These 10 free CRISC questions are organized by exam domain, so you can see how each part of the Certified in Risk and Information Systems Control blueprint is tested. Reveal the answer and explanation under each question.
An organization's board sets risk appetite, management establishes risk tolerance for specific objectives, and financial analysis determines the organization cannot survive losses exceeding $50 million. Which statement CORRECTLY describes the relationship between these concepts?
Correct answer: C - Risk capacity > Risk appetite > Risk tolerance
To maintain independence and provide objective assurance to the organization, Internal Audit (the Third Line of Defense) should report functionally to:
Correct answer: C - The Board of Directors or Audit Committee
A data center power failure would result in losses of $80,000 per incident. Historical data indicates this type of failure occurs approximately once every four years. What is the Annualized Loss Expectancy (ALE)?
Correct answer: C - $20,000
After implementing security controls, the residual risk for a critical system remains. To determine whether the residual risk is acceptable or requires additional treatment, it should be compared against:
Correct answer: C - The organization's defined risk tolerance
An organization purchases comprehensive cyber insurance and outsources its IT operations to a managed service provider with contractual SLAs. The risk manager states that operational IT risk has been fully transferred. What is the PRIMARY limitation of this assessment?
Correct answer: B - Reputational risk and counterparty risk remain with the organization regardless of transfer mechanisms
The risk management team is establishing a monitoring program and must select appropriate indicators. Which statement BEST describes the fundamental difference between Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs)?
Correct answer: B - KRIs provide early warning of increasing risk exposure; KPIs measure achievement of objectives after the fact
An organization implements Security Information and Event Management (SIEM), intrusion detection systems (IDS), and comprehensive audit logging across its environment. These controls are PRIMARILY classified as:
Correct answer: B - Detective controls - identifying incidents during or after occurrence
A healthcare organization stores patient records with a cloud provider that holds SOC 2 Type II certification and has signed a Business Associate Agreement. A breach at the cloud provider exposes patient data. Who is ultimately ACCOUNTABLE for the protection of the patient data under regulatory requirements?
Correct answer: B - The healthcare organization, as the data controller and owner of the patient relationship
The NIST Cybersecurity Framework organizes security activities into five core functions. What is the CORRECT sequence of these functions?
Correct answer: B - Identify, Protect, Detect, Respond, Recover
An organization is deploying a Large Language Model (LLM) to assist with customer inquiries. During risk assessment, the team identifies a risk that is UNIQUE to this type of AI technology. Which risk is MOST specific to LLM implementations?
Correct answer: C - Hallucinations - generating plausible but incorrect or fabricated information
Practice hundreds more CRISC questions with instant scoring, weak-area drills, and full exam simulations.