ISACA CRISC Practice Exams
Last updated on Oct 22,2026- Exam Code: CRISC
- Exam Name: Certified in Risk and Information Systems Control
- Certification Provider: ISACA
- Latest update: Oct 22,2026
Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to:
- A . communicate risk trends to stakeholders.
- B . assign ownership of emerging risk scenarios.
- C . highlight noncompliance with the risk policy
- D . identify threats to emerging technologies.
Which of the following would BEST enable mitigation of newly identified risk factors related to internet of Things (loT)?
- A . Introducing control procedures early in the life cycle
- B . Implementing loT device software monitoring
- C . Performing periodic risk assessments of loT
- D . Performing secure code reviews
Which of the following is MOST likely to cause a key risk indicator (KRI) to exceed thresholds?
- A . The risk tolerance level
- B . Occurrences of specific events
- C . Risk scenarios
- D . A performance measurement
The MAIN purpose of selecting a risk response is to.
- A . ensure compliance with local regulatory requirements
- B . demonstrate the effectiveness of risk management practices.
- C . ensure organizational awareness of the risk level
- D . mitigate the residual risk to be within tolerance
Which of the following would BEST enable a risk-based decision when considering the use of an emerging technology for data processing?
- A . Gap analysis
- B . Threat assessment
- C . Resource skills matrix
- D . Data quality assurance plan
An IT risk threat analysis is BEST used to establish
- A . risk scenarios
- B . risk maps
- C . risk appetite
- D . risk ownership.
The risk to an organization’s reputation due to a recent cybersecurity breach is PRIMARILY considered to be:
- A . financial risk.
- B . data risk.
- C . operational risk.
- D . strategic risk.
Which of the following is the MOST important input when developing risk scenarios?
- A . Key performance indicators
- B . Business objectives
- C . The organization’s risk framework
- D . Risk appetite
What is the BEST information to present to business control owners when justifying costs related to controls?
- A . Loss event frequency and magnitude
- B . The previous year’s budget and actuals
- C . Industry benchmarks and standards
- D . Return on IT security-related investments
Which of the following is the BEST course of action to reduce risk impact?
- A . Create an IT security policy.
- B . Implement corrective measures.
- C . Implement detective controls.
- D . Leverage existing technology