ISACA CRISC Practice Exams
Last updated on Oct 24,2026- Exam Code: CRISC
- Exam Name: Certified in Risk and Information Systems Control
- Certification Provider: ISACA
- Latest update: Oct 24,2026
Which of the following is the PRIMARY objective of maintaining an information asset inventory?
- A . To provide input to business impact analyses (BIAs)
- B . To protect information assets
- C . To facilitate risk assessments
- D . To manage information asset licensing
Which of the following offers the SIMPLEST overview of changes in an organization’s risk profile?
- A . A risk roadmap
- B . A balanced scorecard
- C . A heat map
- D . The risk register
Which of the following would BEST facilitate the maintenance of data classification requirements?
- A . Scheduling periodic audits
- B . Assigning a data custodian
- C . Implementing technical controls over the assets
- D . Establishing a data loss prevention (DLP) solution
Of the following, whose input is ESSENTIAL when developing risk scenarios for the implementation of a third-party mobile application that stores customer data?
- A . Information security manager
- B . IT vendor manager
- C . Business process owner
- D . IT compliance manager
Which of the following BEST mitigates ethical risk?
- A . Ethics committees
- B . Contingency scenarios
- C . Awareness of consequences for violations
- D . Routine changes in senior management
Concerned about system load capabilities during the month-end close process, management requires monitoring of the average time to complete tasks and monthly reporting of the findings.
What type of measure has been established?
- A . Service level agreement (SLA)
- B . Critical success factor (CSF)
- C . Key risk indicator (KRI)
- D . Key performance indicator (KPI)
An organization wants to transfer risk by purchasing cyber insurance.
Which of the following would be MOST important for the risk practitioner to communicate to senior management for contract negotiation purposes?
- A . Most recent IT audit report results
- B . Replacement cost of IT assets
- C . Current annualized loss expectancy report
- D . Cyber insurance industry benchmarking report
When assessing the maturity level of an organization’s risk management framework, which of the following should be of GREATEST concern to a risk practitioner?
- A . Reliance on qualitative analysis methods
- B . Lack of a governance, risk, and compliance (GRC) tool
- C . Lack of senior management involvement
- D . Use of multiple risk registers
Which of the following should be a risk practitioner’s NEXT step upon learning the impact of an organization’s noncompliance with a specific legal regulation?
- A . Identify risk response options.
- B . Implement compensating controls.
- C . Invoke the incident response plan.
- D . Document the penalties for noncompliance.
A recent big data project has resulted in the creation of an application used to support important investment decisions.
Which of the following should be of GREATEST concern to the risk practitioner?
- A . Data quality
- B . Maintenance costs
- C . Data redundancy
- D . System integration