Questions & answers (free, no sign-in needed)
- View
10 beginner questions on the CRISC domains: risk appetite and the three lines model (governance), risk registers, vulnerabilities and inherent risk (risk assessment), key risk indicators and risk responses (risk response and reporting), and availability and data minimization (technology and security).
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
What does an organization's risk appetite describe?
- A. The list of all controls the organization has implemented
- B. The types and amount of risk it is willing to accept to pursue value ✔ correct
- C. The maximum budget approved for security tools each year
- D. The number of incidents it reported to regulators last year
Answer: B. Risk appetite is the types and amount of risk, on a broad level, an organization is willing to accept in pursuit of value. It guides decisions such as whether a residual risk is acceptable or needs more treatment.
Source: csrc.nist.gov/glossary/term/risk_appetite · Domain: Governance
In the IIA's Three Lines Model, which function provides independent and objective assurance to the governing body on governance and risk management?
- A. Operational managers who own the processes
- B. The risk management and compliance function
- C. The external vendor that hosts the systems
- D. The internal audit function ✔ correct
Answer: D. Internal audit is the third line: it provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. First-line managers own risks and the second line supports and monitors.
Source: www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-up · Domain: Governance
A risk manager needs one central record of current risks with their ratings, owners and planned responses, kept up to date over time. What is this record called?
- A. A risk register ✔ correct
- B. A service catalog
- C. A configuration baseline
- D. A change calendar
Answer: A. A risk register is a central repository of risk information, such as ratings, owners and responses, maintained over time. It supports risk reporting and monitoring. A service catalog lists services, not risks.
Source: csrc.nist.gov/glossary/term/risk_register · Domain: Risk Assessment
A risk analyst finds that an internet-facing web server is missing a critical security patch. In risk assessment terms, what is the missing patch?
- A. A threat source
- B. An impact
- C. A vulnerability ✔ correct
- D. A risk appetite
Answer: C. A vulnerability is a weakness that a threat source could exploit. Risk combines the likelihood that a threat exploits the vulnerability with the resulting impact, as described in NIST SP 800-30.
Source: csrc.nist.gov/pubs/sp/800/30/r1/final · Domain: Risk Assessment
Inherent risk is the level of risk before management takes any action, such as applying controls, to change it.
- A. True ✔ correct
- B. False
Answer: A. True. Inherent risk is the risk to an entity in the absence of any direct or focused actions by management to alter its severity. Residual risk is what remains after responses are applied.
Source: csrc.nist.gov/glossary/term/inherent_risk · Domain: Risk Assessment
A risk manager wants a metric that warns when exposure is rising, such as the number of critical servers that are still unpatched after 30 days. What is this type of metric called?
- A. A service level agreement (SLA)
- B. A key risk indicator (KRI) ✔ correct
- C. A recovery point objective (RPO)
- D. A return on investment (ROI)
Answer: B. A key risk indicator is a metric used to measure risk; trending KRIs give early warning when exposure moves toward the risk appetite. An SLA is an agreement on service levels, not a risk measure.
Source: csrc.nist.gov/glossary/term/key_risk_indicator · Domain: Risk Response and Reporting
Which two are valid risk response options? (Select TWO)
- A. Avoiding the risk by not starting the risky activity ✔ correct
- B. Sharing the risk, for example through insurance ✔ correct
- C. Hiding the risk from senior management until fixed
- D. Deleting the risk once a control has been planned
- E. Postponing any decision until an incident happens
Answer: A, B. Risk responses are accepting, avoiding, mitigating, sharing or transferring risk. Hiding a risk, closing it before the control exists or waiting for an incident are not responses and leave the risk unmanaged.
Source: csrc.nist.gov/glossary/term/risk_response · Domain: Risk Response and Reporting
A company deploys multi-factor authentication to reduce the likelihood of account takeover. Which risk response is this?
- A. Risk acceptance
- B. Risk avoidance
- C. Risk transfer
- D. Risk mitigation ✔ correct
Answer: D. Risk mitigation means implementing risk-reducing controls or countermeasures, such as MFA. Acceptance takes the risk as it is, avoidance stops the activity, and transfer shifts the financial impact to a third party.
Source: csrc.nist.gov/glossary/term/risk_mitigation · Domain: Risk Response and Reporting
A distributed denial-of-service (DDoS) attack floods a company's website so that customers cannot reach it. Which security objective is mainly affected?
- A. Availability ✔ correct
- B. Confidentiality
- C. Integrity
- D. Non-repudiation
Answer: A. Availability means ensuring timely and reliable access to and use of information. A DDoS attack denies legitimate users access, so it targets availability rather than the secrecy or correctness of data.
Source: csrc.nist.gov/glossary/term/availability · Domain: Technology and Security
A company's new app asks customers for their full date of birth, but the business only needs to confirm that they are over 18. Which data protection principle does this break?
- A. Storage limitation
- B. Accuracy
- C. Data minimization ✔ correct
- D. Accountability
Answer: C. Data minimization (GDPR Article 5(1)(c)) requires personal data to be adequate, relevant and limited to what is necessary for the purpose. Collecting a full birth date when an age check is enough collects more than needed.
Source: ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-prin · Domain: Technology and Security
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public ISACA exam objectives (CRISC Exam Content Outline effective 2025-11-03), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by ISACA; exam names are trademarks of their owners. Official exam page: www.isaca.org/credentialing/crisc/crisc-exam-content-outline.