Risk Assessment — CRISC Practice Questions

GlobalTech has identified a high‑impact vulnerability in its ERP system. After applying a patch and compensating controls, the risk analyst estimates the residual risk as moderate. What is the most appropriate next step for the risk practitioner?

• A.Recommend immediate acceptance of the residual risk because the inherent risk has been reduced.
• B.Reassess the inherent risk to verify the original estimate before deciding on residual‑risk treatment.
• C.Escalate the residual risk to senior management for a decision on additional controls, referencing the organization’s risk tolerance.
• D.Document the residual risk in the risk register and monitor it for changes, but defer further action until the next assessment cycle.

Why: Determine the correct action when residual risk remains after controls are applied NIST SP 800-39 states that residual risk may remain after security measures are applied and that this risk should be communicated to the decision makers responsible for risk response; if the residual risk is above the organization’s tolerance, senior management must decide whether additional controls are needed.

When a BIA is used to calculate risk exposure, which element derived from the BIA feeds into the impact component of the formula?

• A.Control effectiveness rating
• B.Impact magnitude (loss)
• C.Risk owner designation
• D.Probability of occurrence

Why: Link BIA output to the impact factor in risk exposure calculations NIST IR 8286 explains that loss is calculated through a traditional BIA, providing the impact magnitude used in risk exposure formulas.

Which analytic approach focuses primarily on evaluating threats before considering assets or vulnerabilities?

• A.Asset/impact‑oriented analysis
• B.Quantitative analysis
• C.Vulnerability‑oriented analysis
• D.Threat‑oriented analysis

Why: Identify the threat‑oriented analytic approach in risk assessment NIST SP 800-30r1 lists threat‑oriented analysis as one of the primary analysis approaches

Who should ultimately approve and oversee the remediation plan for a vulnerability that affects a specific business process?

• A.The risk owner for the affected business process must approve and oversee remediation plans.
• B.The Chief Information Security Officer must personally remediate each critical flaw.
• C.External auditors are tasked with implementing patches.
• D.The IT operations team is solely responsible for fixing all vulnerabilities.

Why: Assign remediation accountability to the business risk owner responsible for the impacted process. NIST SP 800-30r1 assigns accountability for risk response decisions, including remediation approval, to the designated risk owner of the affected business process.

When integrating vulnerability management into a new application’s development, when is the most appropriate time to conduct vulnerability assessments?

• A.Conduct vulnerability scanning only after the system goes live.
• B.Perform a single vulnerability assessment at project kickoff and never again.
• C.Include vulnerability assessments during the design and testing phases of the SDLC.
• D.Rely on end‑user reporting of security issues post‑deployment.

Why: Embed vulnerability assessments throughout the SDLC, especially during design and testing. NIST SP 800-100 notes that risk assessments are performed throughout the system development life cycle, including design and testing, to identify and address vulnerabilities early.

Which approach aligns with NIST guidance for scoring vulnerabilities in a risk assessment?

• A.Assign a fixed high score to all vulnerabilities found in public‑facing systems.
• B.Rate vulnerabilities solely on the number of affected assets.
• C.Adopt the CVSS base score and map it to likelihood and impact per NIST guidance.
• D.Use a proprietary scoring system developed internally without mapping to impact.

Why: Apply a standardized scoring system (e.g., CVSS) and map it to likelihood and impact for consistent risk assessment. NIST SP 800-30r1 recommends using standardized metrics such as CVSS and aligning scores with likelihood and impact to ensure consistent risk evaluation.

When estimating the likelihood of a risk scenario, which approach aligns best with NIST guidance for organizations with limited quantitative data?

• A.Apply detailed statistical probability models to historical incident logs
• B.Perform a cost‑benefit analysis of potential control implementations
• C.Run automated vulnerability scans to generate a numerical likelihood score
• D.Use expert judgment to assign a high, medium, or low likelihood rating

Why: Use qualitative judgment for likelihood when quantitative data are scarce NIST SP 800-30r1 recommends a qualitative assessment approach that relies on expert judgment to assign likelihood levels when precise numerical data are unavailable.

Which elements must be documented to fully describe a risk scenario according to NIST’s risk model?

• A.Only the projected impact and its likelihood
• B.Only the controls that will mitigate the scenario
• C.Only the identified threat and associated vulnerability
• D.The asset, threat, vulnerability, projected impact, and likelihood

Why: Document all five core components of a risk scenario NIST SP 800-30r1 defines the risk model as requiring clear identification of the asset, threat, vulnerability, impact, and likelihood for each scenario.

How should a risk practitioner rank multiple risk scenarios to decide which to address first?

• A.Prioritize based on the combined risk score calculated as likelihood multiplied by impact
• B.Prioritize the scenario that shows the highest impact value, ignoring its likelihood assessment
• C.Prioritize the scenario that exhibits the highest likelihood rating, overlooking its potential impact
• D.Prioritize the scenario that can be mitigated using the least amount of resources and effort

Why: Use combined likelihood‑impact score to prioritize scenarios NIST SP 800-39 explains that risk is assessed in terms of both likelihood of occurrence and magnitude of impact, and prioritization is based on their combined effect.

An enterprise IT department is beginning a new risk assessment for its cloud‑based email service. According to NIST SP 800‑30r1, what should the risk practitioner do FIRST?

• A.Collect a detailed list of hardware components that support the cloud‑email service
• B.Define the assessment scope, including the service, data, and organizational boundaries
• C.Choose a quantitative risk‑scoring methodology to be used after the initial assessment
• D.List potential threat actors that might target the organization’s cloud‑based email system

Why: Establish scope and boundaries before any other risk‑assessment activity NIST SP 800‑30r1 emphasizes that defining the assessment scope and boundaries is the initial step in a risk assessment, ensuring that the effort focuses on the correct systems and assets.

When calculating risk levels, which set of elements must a risk practitioner evaluate according to NIST SP 800‑30r1?

• A.Impact, recovery time, budget, and stakeholder interest
• B.Threat, asset value, control effectiveness, and cost
• C.Threat, vulnerability, impact, and likelihood
• D.Vulnerability, control gaps, regulatory compliance, and exposure

Why: Identify all four core components required for risk quantification NIST SP 800‑30r1 defines risk as a function of threat, vulnerability, impact, and likelihood; all four must be assessed to calculate risk.

A risk assessment report is being prepared for senior management. Which element, as required in Appendix K of NIST SP 800‑30r1, is essential to support decision‑making?

• A.A summary of risk levels and recommended response actions
• B.Technical specifications of each security control
• C.Historical incident logs for the past five years
• D.A detailed list of all identified assets

Why: Include a concise risk summary and recommendations in assessment reports Appendix K specifies that risk assessment reports must contain a summary of risk levels and recommended response actions to inform decision makers.