ISACA CRISC Practice Exams
Last updated on Oct 23,2026- Exam Code: CRISC
- Exam Name: Certified in Risk and Information Systems Control
- Certification Provider: ISACA
- Latest update: Oct 23,2026
Which of the following is the MOST important objective from a cost perspective for considering aggregated risk responses in an organization?
- A . Prioritize risk response options
- B . Reduce likelihood.
- C . Address more than one risk response
- D . Reduce impact
Which of the following is MOST important to consider when assessing the likelihood that a recently discovered software vulnerability will be exploited?
- A . The skill level required of a threat actor
- B . The amount of personally identifiable information (PH) disclosed
- C . The ability to detect and trace the threat action
- D . The amount of data that might be exposed by a threat action
Which of the following will help ensure the effective decision-making of an IT risk management committee?
- A . The committee charter is approved by the board.
- B . Approved minutes are forwarded to senior management.
- C . Training is provided annually.
- D . The committee is comprised of key stakeholders.
To define the risk management strategy which of the following MUST be set by the board of directors?
- A . Operational strategies
- B . Risk governance
- C . Annualized loss expectancy (ALE)
- D . Risk appetite
Which of the following is MOST important to consider before determining a response to a vulnerability?
- A . The likelihood and impact of threat events
- B . The cost to implement the risk response
- C . Lack of data to measure threat events
- D . Monetary value of the asset
Which of the following is the BEST key performance indicator (KPI) for a server patch management process?
- A . The percentage of servers with allowed patching exceptions
- B . The number of servers with local credentials to install patches
- C . The percentage of servers patched within required service level agreements
- D . The number of servers running the software patching service
What is a risk practitioner’s BEST approach to monitor and measure how quickly an exposure to a specific risk can affect the organization?
- A . Create an asset valuation report.
- B . Create key performance indicators (KPls).
- C . Create key risk indicators (KRIs).
- D . Create a risk volatility report.
Which of the following is the BEST key performance indicator (KPI) to measure the ability to deliver
uninterrupted IT services?
- A . Mean time between failures (MTBF)
- B . Mean time to recover (MTTR)
- C . Planned downtime
- D . Unplanned downtime
Which of the following practices would be MOST effective in protecting personality identifiable information (Ptl) from unauthorized access m a cloud environment?
- A . Apply data classification policy
- B . Utilize encryption with logical access controls
- C . Require logical separation of company data
- D . Obtain the right to audit
During which phase of the system development life cycle (SDLC) should information security requirements for the implementation of a new IT system be defined?
- A . Monitoring
- B . Development
- C . Implementation
- D . Initiation