Free CRISC Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CRISC Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A risk team is aligning its cybersecurity objectives with why the organization exists. Which information should most directly guide this alignment?

   1. A. The organizational mission
   2. B. The organization's current risk appetite
   3. C. The cybersecurity policy's control priorities
   4. D. The technology program's near-term goals

   Answer: A

   Explanation: The framework states "The organizational mission is understood and informs cybersecurity risk management". The mission therefore guides alignment; the other records serve different operational purposes.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Govern, Organizational Context, GV.OC-01

2. 2In a risk assessment, what is a threat in relation to an information system?

   1. A. A condition or event that can adversely affect operations or assets
   2. B. A weakness that a source can exploit
   3. C. The amount of harm after an event
   4. D. A documented response option

   Answer: A

   Explanation: The guide states "A threat is any circumstance or event with the potential to adversely impact organizational operations and assets, individuals, other organizations, or the Nation through an information system". This supports a condition or event that can adversely affect operations or assets in the question's conditions.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.1, Threats

3. 3A risk is within the organization's approved tolerance under the stated operating conditions. Which response option may be appropriate?

   1. A. Avoid the activity
   2. B. Accept the risk
   3. C. Transfer all operational responsibility
   4. D. Assume controls eliminate the risk

   Answer: B

   Explanation: "Risk acceptance is the appropriate risk response when the identified risk is within the organizational risk tolerance". Under the stated conditions, accept the risk is the supported choice.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View — Chapter 3, Step 3: Risk Response, Task 3-1, Risk Acceptance

4. 4A technology roadmap needs to compare today's cybersecurity posture with desired outcomes. Which two CSF views provide that comparison?

   1. A. Current profile and a supplier's profile
   2. B. Current and target organizational profiles
   3. C. Two target profiles prepared by different teams
   4. D. A community profile and a control baseline

   Answer: B

   Explanation: "A CSF Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of the Core’s outcomes". This supports current and target organizational profiles for the technology condition described.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, CSF Profiles

5. 5When setting cybersecurity risk priorities, what should a team determine about internal and external stakeholders?

   1. A. Their needs and expectations regarding cybersecurity risk management
   2. B. Their authority to approve individual control changes
   3. C. Their preferred cadence for receiving risk reports
   4. D. Their ownership of specific technology assets

   Answer: A

   Explanation: NIST states "Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered". Priorities should account for those needs and expectations.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Govern, Organizational Context, GV.OC-02

6. 6A power failure and a malicious administrator could each take the same server offline. What does this show about threat sources and events?

   1. A. A single event always has one source
   2. B. Different sources can cause the same event
   3. C. A source is the same as the resulting impact
   4. D. Only adversaries can cause threat events

   Answer: B

   Explanation: The guide states "Multiple threat sources can initiate or cause the same threat event". This supports different sources can cause the same event in the question's conditions.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.1, Threats

7. 7An organization stops an activity because its risk is unacceptable and safeguards are impractical. Which response is this?

   1. A. Risk sharing
   2. B. Risk transfer
   3. C. Risk avoidance
   4. D. Risk acceptance

   Answer: C

   Explanation: "risk avoidance involves taking specific actions to eliminate the activities or technologies that are the basis for the risk". Under the stated conditions, risk avoidance is the supported choice.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View — Chapter 3, Step 3: Risk Response, Task 3-1, Risk Avoidance

8. 8After documenting current and target cybersecurity outcomes, what should a technology team create to close the differences?

   1. A. A new current profile without comparing target outcomes
   2. B. A target profile without considering the current state
   3. C. A prioritized action plan from the gap analysis
   4. D. A control baseline chosen before analyzing the gaps

   Answer: C

   Explanation: "Conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles, and develop a prioritized action plan". This supports a prioritized action plan from the gap analysis for the technology condition described.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, step 4, CSF Organizational Profile

9. 9A service depends on an external capability to meet business objectives. Which organizational context information should the risk team communicate?

   1. A. The capabilities and services on which the organization depends
   2. B. The services external parties depend on the organization to provide
   3. C. The capabilities the organization can provide without outside support
   4. D. The control capabilities currently supplied by internal teams

   Answer: A

   Explanation: The framework says "Outcomes, capabilities, and services that the organization depends on are understood and communicated". The dependency is the relevant context for this question.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Govern, Organizational Context, GV.OC-05

10. 10When characterizing an adversarial threat source, which information is most relevant?

    1. A. The potential range of nonadversarial effects
    2. B. The weakness of the targeted system
    3. C. Capability, intent, and targeting
    4. D. The magnitude of resulting business impact

    Answer: C

    Explanation: The guide states "For adversarial threat sources, assess the capabilities, intentions, and targeting associated with the threat sources". This supports capability, intent, and targeting in the question's conditions.

    Reference: Guide for Conducting Risk Assessments — Section 3.2, Task 2-1, Identify Threat Sources