Risk Assessment Concepts and Standards CRISC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization wants to adopt a risk management framework that provides principles and guidelines but does not prescribe a specific process. They want flexibility to tailor the approach to their context. Which framework is most suitable?

   • AISO 31000
   • BCMMI
   • CCOSO ERM
   • DNIST SP 800-30
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following standards is specifically designed to provide a framework for conducting risk assessments in federal information systems in the United States?

   • ANIST SP 800-30
   • BCOSO ERM
   • CITIL
   • DISO 31000
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization wants to adopt a risk management framework that integrates risk considerations into its overall corporate governance and strategy, covering all types of risk across the enterprise. Which framework is most appropriate for this purpose?

   • AISO 31000
   • BOWASP
   • CNIST SP 800-30
   • DCOSO ERM
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After implementing a new firewall, a company re-evaluates the risk of an external intrusion. The risk score has decreased from 25 to 10. What is the remaining risk of 10 called?

   • AResidual risk
   • BControl risk
   • CInherent risk
   • DAcceptable risk
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A risk manager is evaluating the risk of a new cloud service. The inherent risk is high, but after implementing encryption and access controls, the residual risk is medium. The manager must decide whether to accept the residual risk. What is the most important factor in this decision?

   • AThe organization's risk appetite
   • BThe impact of the risk
   • CThe likelihood of the threat
   • DThe cost of additional controls
   Reveal Solution Discussion Select an answer first