ISACA CRISC Practice Exams
Last updated on Oct 22,2026- Exam Code: CRISC
- Exam Name: Certified in Risk and Information Systems Control
- Certification Provider: ISACA
- Latest update: Oct 22,2026
An organization has built up its cash reserves and has now become financially able to support additional risk while meeting its objectives.
What is this change MOST likely to impact?
- A . Risk profile
- B . Risk capacity
- C . Risk indicators
- D . Risk tolerance
Which of the following management actions will MOST likely change the likelihood rating of a risk scenario related to remote network access?
- A . Creating metrics to track remote connections
- B . Updating the organizational policy for remote access
- C . Updating remote desktop software
- D . Implementing multi-factor authentication
Senior management has requested more information regarding the risk associated with introducing a new application into the environment.
Which of the following should be done FIRST?
- A . Perform an audit.
- B . Conduct a risk analysis.
- C . Develop risk scenarios.
- D . Perform a cost-benefit analysis.
A risk practitioner’s BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:
- A . Aligned with risk management capabilities.
- B . Based on industry trends.
- C . Related to probable events.
- D . Mapped to incident response plans.
When evaluating a number of potential controls for treating risk, it is MOST important to consider:
- A . risk appetite and control efficiency.
- B . inherent risk and control effectiveness.
- C . residual risk and cost of control.
- D . risk tolerance and control complexity.
Which of the following should be a risk practitioner’s NEXT action after identifying a high probability of data loss in a system?
- A . Enhance the security awareness program.
- B . Increase the frequency of incident reporting.
- C . Purchase cyber insurance from a third party.
- D . Conduct a control assessment.
Which of the following is the MOST effective control to ensure user access is maintained on a least-privilege basis?
- A . User authorization
- B . User recertification
- C . Change log review
- D . Access log monitoring
After the announcement of a new IT regulatory requirement, it is MOST important for a risk practitioner to;
- A . prepare an IT risk mitigation strategy.
- B . escalate to senior management.
- C . perform a cost-benefit analysis.
- D . review the impact to the IT environment.
The software version of an enterprise’s critical business application has reached end-of-life and is no longer supported by the vendor. IT has decided to develop an in-house replacement application.
Which of the following should be the PRIMARY concern?
- A . The system documentation is not available.
- B . Enterprise risk management (ERM) has not approved the decision.
- C . The board of directors has not approved the decision.
- D . The business process owner is not an active participant.
Which of the following BEST mitigates the risk of violating privacy laws when transferring personal information lo a supplier?
- A . Encrypt the data while in transit lo the supplier
- B . Contractually obligate the supplier to follow privacy laws.
- C . Require independent audits of the supplier’s control environment
- D . Utilize blockchain during the data transfer