ISACA CRISC Practice Exams
Last updated on Oct 24,2026- Exam Code: CRISC
- Exam Name: Certified in Risk and Information Systems Control
- Certification Provider: ISACA
- Latest update: Oct 24,2026
Which of the following tasks should be completed prior to creating a disaster recovery plan (DRP)?
- A . Conducting a business impact analysis (BIA)
- B . Identifying the recovery response team
- C . Procuring a recovery site
- D . Assigning sensitivity levels to data
Which of the following is MOST important to understand when determining an appropriate risk assessment approach?
- A . Complexity of the IT infrastructure
- B . Value of information assets
- C . Management culture
- D . Threats and vulnerabilities
A risk practitioner is involved in a comprehensive overhaul of the organizational risk management program.
Which of the following should be reviewed FIRST to help identify relevant IT risk scenarios?
- A . Technology threats
- B . IT assets
- C . Security vulnerabilities
- D . IT risk register
One of an organization’s key IT systems cannot be patched because the patches interfere with critical business application functionalities.
Which of the following would be the risk practitioner’s BEST recommendation?
- A . Additional mitigating controls should be identified.
- B . The system should not be used until the application is changed
- C . The organization’s IT risk appetite should be adjusted.
- D . The associated IT risk should be accepted by management.
An organization has outsourced its backup and recovery procedures to a third-party cloud provider.
Which of the following is the risk practitioner s BEST course of action?
- A . Accept the risk and document contingency plans for data disruption.
- B . Remove the associated risk scenario from the risk register due to avoidance.
- C . Mitigate the risk with compensating controls enforced by the third-party cloud provider.
- D . Validate the transfer of risk and update the register to reflect the change.
An organization has recently hired a large number of part-time employees. During the annual audit, it was discovered that many user IDs and passwords were documented in procedure manuals for use by the part-time employees.
Which of the following BEST describes this situation?
- A . Threat
- B . Risk
- C . Vulnerability
- D . Policy violation
A business unit is implementing a data analytics platform to enhance its customer relationship management (CRM) system primarily to process data that has been provided by its customers.
Which of the following presents the GREATEST risk to the organization’s reputation?
- A . Third-party software is used for data analytics.
- B . Data usage exceeds individual consent.
- C . Revenue generated is not disclosed to customers.
- D . Use of a data analytics system is not disclosed to customers.
Which of the following should be the PRIMARY driver for an organization on a multi-year cloud implementation to publish a cloud security policy?
- A . Evaluating gaps in the on-premise and cloud security profiles
- B . Establishing minimum cloud security requirements
- C . Enforcing compliance with cloud security parameters
- D . Educating IT staff on variances between on premise and cloud security
Which of the following provides the MOST up-to-date information about the effectiveness of an organization’s overall IT control environment?
- A . Key performance indicators (KPIs)
- B . Risk heat maps
- C . Internal audit findings
- D . Periodic penetration testing
The MOST important measure of the effectiveness of risk management in project implementation is the percentage of projects:
- A . introduced into production without high-risk issues.
- B . having the risk register updated regularly.
- C . having key risk indicators (KRIs) established to measure risk.
- D . having an action plan to remediate overdue issues.