ISACA

Certified in Risk and Information Systems Control

CRISC

The Certified in Risk and Information Systems Control (CRISC) certification validates your expertise in identifying and managing enterprise IT risk and implementing and maintaining information systems controls. Designed for mid to advanced-career IT professionals focused on IT and cyber risk, CRISC equips you to enhance business resilience, deliver stakeholder value, and address emerging technologies like AI. Earning CRISC demonstrates your ability to optimize risk management across the enterprise and positions you among the top-paying certified professionals worldwide.

Practice Free Questions

4Domains

20Objectives

131Practice pages

608Free questions

CRISC free practice questions

Choose any objective and open any question page — no sign-in required.

Governance Framework

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

Risk Management

26 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–26

Resource Management

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

Risk Events

28 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–28

Threat Modeling and Threat Landscape

28 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–28

Vulnerability Management

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

Risk Scenario Development and Evaluation

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

Risk Assessment Concepts and Standards

12 questions · 3 pages

Questions 1–5 6–10 11–12

Business Impact Analysis (BIA)

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Risk Register

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

Risk Analysis Methodologies

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

Inherent and Residual Risk

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

Risk Response and Mitigation

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

Third-Party and Supply Chain Risk

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

Control Design and Implementation

42 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–42

Risk Monitoring and Reporting

44 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–44

Technology Strategy and Architecture

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

Operations and Lifecycle Management

41 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–41

Resilience and Continuity

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

Security and Privacy

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (20 objectives · 131 pages).

Certified in Risk and Information Systems Control

CRISC free practice questions

Domain 1 · Domain 1: Governance13% of practice bank · 3 objectives · 82 questions13%

Domain 2 · Domain 2: Risk Assessment41% of practice bank · 9 objectives · 249 questions41%

Domain 3 · Domain 3: Risk Response and Reporting24% of practice bank · 4 objectives · 143 questions24%

Domain 4 · Domain 4: Technology and Security22% of practice bank · 4 objectives · 134 questions22%