Skip to content
Oluma Cyber Security Awareness
Join Us
⚖️
OLUMA CERTIFICATION ZONE

CRISCPractice Range

100 original scenarios across governance, IT risk assessment, risk response and reporting, and IT security. Choose your range and keep the enterprise within appetite.

GovernanceIT Risk AssessmentRisk Response & ReportingIT & Security
SELECT YOUR RANGE
01/100 Governance

The board asks how much risk the organization is willing to pursue in support of its digital strategy. Which concept are they defining?

✔ RISK MITIGATED

That's enterprise risk thinking — ISACA would approve.

Risk appetite is the amount of risk the organization is willing to accept in pursuit of its objectives.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Risk appetite is the amount of risk the organization is willing to accept in pursuit of its objectives.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Risk appetite is the amount of risk the organization is willing to accept in pursuit of its objectives.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Risk appetite is the amount of risk the organization is willing to accept in pursuit of its objectives.

02/100 Governance

A business unit wants to exceed the approved appetite for a specific project with board awareness. What defines the acceptable variation around appetite?

✖ KRI BREACH

The register grows by one lesson:

Risk tolerance is the acceptable deviation from risk appetite for specific objectives or initiatives.

✖ KRI BREACH

The register grows by one lesson:

Risk tolerance is the acceptable deviation from risk appetite for specific objectives or initiatives.

✔ WITHIN APPETITE

You connected IT risk to business impact. That's the whole exam.

Risk tolerance is the acceptable deviation from risk appetite for specific objectives or initiatives.

✖ KRI BREACH

The register grows by one lesson:

Risk tolerance is the acceptable deviation from risk appetite for specific objectives or initiatives.

03/100 Governance

The absolute maximum loss the organization could absorb without threatening its survival is its:

✖ EXPOSURE RISING

Recalibrate your risk lens:

Risk capacity is the objective ceiling — appetite should always be set below capacity.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Risk capacity is the objective ceiling — appetite should always be set below capacity.

✔ KRI GREEN

Clean call. The risk committee would adopt it.

Risk capacity is the objective ceiling — appetite should always be set below capacity.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Risk capacity is the objective ceiling — appetite should always be set below capacity.

04/100 Governance

Who is ultimately accountable for the organization's risk governance?

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

The board owns risk governance; management operates the risk program within board-set direction.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

The board owns risk governance; management operates the risk program within board-set direction.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

The board owns risk governance; management operates the risk program within board-set direction.

✔ REGISTER UPDATED

You're reasoning like a risk owner, not a checkbox auditor.

The board owns risk governance; management operates the risk program within board-set direction.

05/100 Governance

A CRISC professional finds risk decisions being made in silos with no enterprise view. Which governance element is missing?

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Effective governance integrates IT risk into ERM so decisions reflect the enterprise portfolio.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Effective governance integrates IT risk into ERM so decisions reflect the enterprise portfolio.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Effective governance integrates IT risk into ERM so decisions reflect the enterprise portfolio.

✔ CONTROL EFFECTIVE

Appetite, tolerance, capacity — you clearly know the difference.

Effective governance integrates IT risk into ERM so decisions reflect the enterprise portfolio.

06/100 Governance

Which document formally assigns risk management authority, escalation paths, and committee structures?

✖ APPETITE EXCEEDED

The register grows by one lesson:

Governance charters and policies establish structure, authority, and accountability for risk management.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Governance charters and policies establish structure, authority, and accountability for risk management.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Governance charters and policies establish structure, authority, and accountability for risk management.

✔ RESIDUAL ACCEPTED

That answer belongs in a board deck. Sharp.

Governance charters and policies establish structure, authority, and accountability for risk management.

07/100 Governance

The 'three lines' model places risk ownership with:

✖ KRI BREACH

Recalibrate your risk lens:

The first line owns and manages risk; the second line oversees; the third line provides independent assurance.

✔ EXPOSURE REDUCED

That's enterprise risk thinking — ISACA would approve.

The first line owns and manages risk; the second line oversees; the third line provides independent assurance.

✖ KRI BREACH

Recalibrate your risk lens:

The first line owns and manages risk; the second line oversees; the third line provides independent assurance.

✖ KRI BREACH

Recalibrate your risk lens:

The first line owns and manages risk; the second line oversees; the third line provides independent assurance.

08/100 Governance

Internal audit independently evaluates the risk program's effectiveness. Which line of the model is this?

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Internal audit is the third line — independent assurance to the board.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Internal audit is the third line — independent assurance to the board.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Internal audit is the third line — independent assurance to the board.

✔ OWNER ASSIGNED

You connected IT risk to business impact. That's the whole exam.

Internal audit is the third line — independent assurance to the board.

09/100 Governance

Risk culture is best described as:

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Culture determines whether policies are lived or ignored — a core governance concern.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Culture determines whether policies are lived or ignored — a core governance concern.

✔ TREND IMPROVING

Clean call. The risk committee would adopt it.

Culture determines whether policies are lived or ignored — a core governance concern.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Culture determines whether policies are lived or ignored — a core governance concern.

10/100 Governance

Employees routinely bypass change control to 'move fast,' and leadership celebrates it. What is the governance concern?

✖ REASSESS THE RISK

The register grows by one lesson:

Tone at the top drives culture; celebrated violations normalize risk-taking beyond appetite.

✔ BOARD BRIEFED

You're reasoning like a risk owner, not a checkbox auditor.

Tone at the top drives culture; celebrated violations normalize risk-taking beyond appetite.

✖ REASSESS THE RISK

The register grows by one lesson:

Tone at the top drives culture; celebrated violations normalize risk-taking beyond appetite.

✖ REASSESS THE RISK

The register grows by one lesson:

Tone at the top drives culture; celebrated violations normalize risk-taking beyond appetite.

CHECKPOINT — 10 DOWN, KEEP CLIMBING
11/100 Governance

Which artifact gives leadership a consolidated view of the organization's current key risks, owners, and treatment status?

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

The risk register aggregates identified risks and treatments; the profile summarizes the current risk landscape.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

The risk register aggregates identified risks and treatments; the profile summarizes the current risk landscape.

✔ RISK MITIGATED

Appetite, tolerance, capacity — you clearly know the difference.

The risk register aggregates identified risks and treatments; the profile summarizes the current risk landscape.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

The risk register aggregates identified risks and treatments; the profile summarizes the current risk landscape.

12/100 Governance

Every significant risk in the register should have exactly one of these to ensure accountability:

✔ WITHIN APPETITE

That answer belongs in a board deck. Sharp.

Risk ownership assigns a single accountable person empowered to make treatment decisions.

✖ KRI BREACH

Escalate this takeaway to memory:

Risk ownership assigns a single accountable person empowered to make treatment decisions.

✖ KRI BREACH

Escalate this takeaway to memory:

Risk ownership assigns a single accountable person empowered to make treatment decisions.

✖ KRI BREACH

Escalate this takeaway to memory:

Risk ownership assigns a single accountable person empowered to make treatment decisions.

13/100 Governance

Legal and regulatory obligations (e.g., privacy laws) primarily enter risk governance as:

✔ KRI GREEN

That's enterprise risk thinking — ISACA would approve.

Legal obligations are non-negotiable inputs to governance and often set minimum control expectations.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Legal obligations are non-negotiable inputs to governance and often set minimum control expectations.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Legal obligations are non-negotiable inputs to governance and often set minimum control expectations.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Legal obligations are non-negotiable inputs to governance and often set minimum control expectations.

14/100 Governance

A new strategic initiative will process customer health data in a new region. When should risk be considered?

✔ REGISTER UPDATED

You connected IT risk to business impact. That's the whole exam.

Risk-aware strategy means risk input at decision time, not retrofitted after commitments are made.

✖ ESCALATION NEEDED

The register grows by one lesson:

Risk-aware strategy means risk input at decision time, not retrofitted after commitments are made.

✖ ESCALATION NEEDED

The register grows by one lesson:

Risk-aware strategy means risk input at decision time, not retrofitted after commitments are made.

✖ ESCALATION NEEDED

The register grows by one lesson:

Risk-aware strategy means risk input at decision time, not retrofitted after commitments are made.

15/100 Governance

Which statement best captures the relationship between risk and opportunity in governance?

✖ REASSESS THE RISK

Recalibrate your risk lens:

Governance balances value creation with value protection — informed risk-taking, not risk elimination.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Governance balances value creation with value protection — informed risk-taking, not risk elimination.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Governance balances value creation with value protection — informed risk-taking, not risk elimination.

✔ CONTROL EFFECTIVE

Clean call. The risk committee would adopt it.

Governance balances value creation with value protection — informed risk-taking, not risk elimination.

16/100 Governance

An organization adopts COBIT to structure its governance of enterprise IT. What does this framework primarily provide?

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

COBIT organizes governance/management objectives, helping align IT risk with business value.

✔ RESIDUAL ACCEPTED

You're reasoning like a risk owner, not a checkbox auditor.

COBIT organizes governance/management objectives, helping align IT risk with business value.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

COBIT organizes governance/management objectives, helping align IT risk with business value.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

COBIT organizes governance/management objectives, helping align IT risk with business value.

17/100 Governance

Policies exist but are outdated, unenforced, and unknown to staff. What is the practical governance effect?

✖ KRI BREACH

Exposure identified — treat it with this:

Unmaintained policy creates a false sense of assurance — the documented and actual environments diverge.

✖ KRI BREACH

Exposure identified — treat it with this:

Unmaintained policy creates a false sense of assurance — the documented and actual environments diverge.

✔ EXPOSURE REDUCED

Appetite, tolerance, capacity — you clearly know the difference.

Unmaintained policy creates a false sense of assurance — the documented and actual environments diverge.

✖ KRI BREACH

Exposure identified — treat it with this:

Unmaintained policy creates a false sense of assurance — the documented and actual environments diverge.

18/100 Governance

Who should approve enterprise risk appetite statements?

✖ EXPOSURE RISING

The register grows by one lesson:

Appetite is a strategic boundary — set and approved at the top.

✔ OWNER ASSIGNED

That answer belongs in a board deck. Sharp.

Appetite is a strategic boundary — set and approved at the top.

✖ EXPOSURE RISING

The register grows by one lesson:

Appetite is a strategic boundary — set and approved at the top.

✖ EXPOSURE RISING

The register grows by one lesson:

Appetite is a strategic boundary — set and approved at the top.

19/100 Governance

Which is a leading practice for keeping governance informed about emerging risk?

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Threshold-based escalation and periodic reporting keep governance current between formal reviews.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Threshold-based escalation and periodic reporting keep governance current between formal reviews.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Threshold-based escalation and periodic reporting keep governance current between formal reviews.

✔ TREND IMPROVING

That's enterprise risk thinking — ISACA would approve.

Threshold-based escalation and periodic reporting keep governance current between formal reviews.

20/100 Governance

Risk management responsibilities should appear in job descriptions and performance goals because:

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Embedding risk accountability in performance structures operationalizes governance.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Embedding risk accountability in performance structures operationalizes governance.

✔ BOARD BRIEFED

You connected IT risk to business impact. That's the whole exam.

Embedding risk accountability in performance structures operationalizes governance.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Embedding risk accountability in performance structures operationalizes governance.

CHECKPOINT — 20 DOWN, KEEP CLIMBING
21/100 Governance

The organization's risk profile has changed after a major acquisition. What should governance direct?

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Material structural change alters the risk landscape; the profile and appetite alignment must be revisited.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Material structural change alters the risk landscape; the profile and appetite alignment must be revisited.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Material structural change alters the risk landscape; the profile and appetite alignment must be revisited.

✔ RISK MITIGATED

Clean call. The risk committee would adopt it.

Material structural change alters the risk landscape; the profile and appetite alignment must be revisited.

22/100 Governance

Which behavior indicates a mature risk culture?

✖ KRI BREACH

The register grows by one lesson:

Psychological safety and risk-informed decision-making are hallmarks of maturity.

✖ KRI BREACH

The register grows by one lesson:

Psychological safety and risk-informed decision-making are hallmarks of maturity.

✔ WITHIN APPETITE

You're reasoning like a risk owner, not a checkbox auditor.

Psychological safety and risk-informed decision-making are hallmarks of maturity.

✖ KRI BREACH

The register grows by one lesson:

Psychological safety and risk-informed decision-making are hallmarks of maturity.

23/100 Governance

An IT risk policy conflicts with a newer enterprise ERM policy. What is the appropriate action?

✔ KRI GREEN

Appetite, tolerance, capacity — you clearly know the difference.

Policy conflicts create inconsistent decisions; governance must reconcile the hierarchy.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Policy conflicts create inconsistent decisions; governance must reconcile the hierarchy.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Policy conflicts create inconsistent decisions; governance must reconcile the hierarchy.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Policy conflicts create inconsistent decisions; governance must reconcile the hierarchy.

24/100 Governance

What is the primary purpose of a risk management framework (e.g., ISO 31000-style)?

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

Frameworks standardize how risk is identified, assessed, treated, and monitored organization-wide.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

Frameworks standardize how risk is identified, assessed, treated, and monitored organization-wide.

✔ REGISTER UPDATED

That answer belongs in a board deck. Sharp.

Frameworks standardize how risk is identified, assessed, treated, and monitored organization-wide.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

Frameworks standardize how risk is identified, assessed, treated, and monitored organization-wide.

25/100 Governance

Senior management wants risk reporting expressed in business terms. Why is this good governance?

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Business-language risk reporting connects IT risk to what leadership actually manages: objectives and value.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Business-language risk reporting connects IT risk to what leadership actually manages: objectives and value.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Business-language risk reporting connects IT risk to what leadership actually manages: objectives and value.

✔ CONTROL EFFECTIVE

That's enterprise risk thinking — ISACA would approve.

Business-language risk reporting connects IT risk to what leadership actually manages: objectives and value.

26/100 IT Risk Assessment

The level of risk that exists before any controls are applied is called:

✖ APPETITE EXCEEDED

The register grows by one lesson:

Inherent risk is the raw exposure before mitigation; residual risk is what remains after controls.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Inherent risk is the raw exposure before mitigation; residual risk is what remains after controls.

✔ RESIDUAL ACCEPTED

You connected IT risk to business impact. That's the whole exam.

Inherent risk is the raw exposure before mitigation; residual risk is what remains after controls.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Inherent risk is the raw exposure before mitigation; residual risk is what remains after controls.

27/100 IT Risk Assessment

After implementing controls, some risk remains. This remaining exposure is:

✖ KRI BREACH

Recalibrate your risk lens:

Residual risk is what the organization actually carries and what the owner must accept or further treat.

✖ KRI BREACH

Recalibrate your risk lens:

Residual risk is what the organization actually carries and what the owner must accept or further treat.

✔ EXPOSURE REDUCED

Clean call. The risk committee would adopt it.

Residual risk is what the organization actually carries and what the owner must accept or further treat.

✖ KRI BREACH

Recalibrate your risk lens:

Residual risk is what the organization actually carries and what the owner must accept or further treat.

28/100 IT Risk Assessment

Risk is classically expressed as a function of:

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Risk magnitude combines the probability of an event and the consequence if it occurs.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Risk magnitude combines the probability of an event and the consequence if it occurs.

✔ OWNER ASSIGNED

You're reasoning like a risk owner, not a checkbox auditor.

Risk magnitude combines the probability of an event and the consequence if it occurs.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Risk magnitude combines the probability of an event and the consequence if it occurs.

29/100 IT Risk Assessment

A risk analyst catalogs servers, applications, data stores, and their business criticality before assessing threats. What is this activity?

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

You cannot assess risk to assets you have not identified and valued.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

You cannot assess risk to assets you have not identified and valued.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

You cannot assess risk to assets you have not identified and valued.

✔ TREND IMPROVING

Appetite, tolerance, capacity — you clearly know the difference.

You cannot assess risk to assets you have not identified and valued.

30/100 IT Risk Assessment

A weakness in a system that a threat could exploit is a:

✖ REASSESS THE RISK

The register grows by one lesson:

Vulnerabilities are exploitable weaknesses; threats are the actors/events that might exploit them.

✖ REASSESS THE RISK

The register grows by one lesson:

Vulnerabilities are exploitable weaknesses; threats are the actors/events that might exploit them.

✖ REASSESS THE RISK

The register grows by one lesson:

Vulnerabilities are exploitable weaknesses; threats are the actors/events that might exploit them.

✔ BOARD BRIEFED

That answer belongs in a board deck. Sharp.

Vulnerabilities are exploitable weaknesses; threats are the actors/events that might exploit them.

CHECKPOINT — 30 DOWN, KEEP CLIMBING
31/100 IT Risk Assessment

An analyst rates risks as High/Medium/Low on a heat map using expert judgment. Which assessment type is this?

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Qualitative assessment uses descriptive scales and judgment rather than numeric loss values.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Qualitative assessment uses descriptive scales and judgment rather than numeric loss values.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Qualitative assessment uses descriptive scales and judgment rather than numeric loss values.

✔ RISK MITIGATED

That's enterprise risk thinking — ISACA would approve.

Qualitative assessment uses descriptive scales and judgment rather than numeric loss values.

32/100 IT Risk Assessment

The team calculates Annualized Loss Expectancy (ALE) for a data-center outage. Which assessment type is this?

✔ WITHIN APPETITE

You connected IT risk to business impact. That's the whole exam.

Quantitative assessment expresses risk in numeric (usually monetary) terms like SLE, ARO, and ALE.

✖ KRI BREACH

Escalate this takeaway to memory:

Quantitative assessment expresses risk in numeric (usually monetary) terms like SLE, ARO, and ALE.

✖ KRI BREACH

Escalate this takeaway to memory:

Quantitative assessment expresses risk in numeric (usually monetary) terms like SLE, ARO, and ALE.

✖ KRI BREACH

Escalate this takeaway to memory:

Quantitative assessment expresses risk in numeric (usually monetary) terms like SLE, ARO, and ALE.

33/100 IT Risk Assessment

A single outage would cost $200,000 and is expected once every four years. What is the ALE?

✖ EXPOSURE RISING

Exposure identified — treat it with this:

ALE = SLE × ARO = $200,000 × 0.25 = $50,000 per year.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

ALE = SLE × ARO = $200,000 × 0.25 = $50,000 per year.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

ALE = SLE × ARO = $200,000 × 0.25 = $50,000 per year.

✔ KRI GREEN

Clean call. The risk committee would adopt it.

ALE = SLE × ARO = $200,000 × 0.25 = $50,000 per year.

34/100 IT Risk Assessment

What does SLE represent?

✔ REGISTER UPDATED

You're reasoning like a risk owner, not a checkbox auditor.

Single Loss Expectancy is asset value × exposure factor for one event.

✖ ESCALATION NEEDED

The register grows by one lesson:

Single Loss Expectancy is asset value × exposure factor for one event.

✖ ESCALATION NEEDED

The register grows by one lesson:

Single Loss Expectancy is asset value × exposure factor for one event.

✖ ESCALATION NEEDED

The register grows by one lesson:

Single Loss Expectancy is asset value × exposure factor for one event.

35/100 IT Risk Assessment

Why might an organization choose qualitative over quantitative assessment?

✖ REASSESS THE RISK

Recalibrate your risk lens:

Qualitative methods trade precision for speed and feasibility when hard data is scarce.

✔ CONTROL EFFECTIVE

Appetite, tolerance, capacity — you clearly know the difference.

Qualitative methods trade precision for speed and feasibility when hard data is scarce.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Qualitative methods trade precision for speed and feasibility when hard data is scarce.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Qualitative methods trade precision for speed and feasibility when hard data is scarce.

36/100 IT Risk Assessment

Which source provides structured knowledge of adversary tactics and techniques useful in threat analysis?

✔ RESIDUAL ACCEPTED

That answer belongs in a board deck. Sharp.

ATT&CK catalogs real-world adversary behavior, supporting realistic threat scenario development.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

ATT&CK catalogs real-world adversary behavior, supporting realistic threat scenario development.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

ATT&CK catalogs real-world adversary behavior, supporting realistic threat scenario development.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

ATT&CK catalogs real-world adversary behavior, supporting realistic threat scenario development.

37/100 IT Risk Assessment

A risk scenario should link a threat actor, a threat event, a vulnerability, an asset, and:

✔ EXPOSURE REDUCED

That's enterprise risk thinking — ISACA would approve.

Well-formed scenarios connect cause to business consequence so assessment is decision-useful.

✖ KRI BREACH

Exposure identified — treat it with this:

Well-formed scenarios connect cause to business consequence so assessment is decision-useful.

✖ KRI BREACH

Exposure identified — treat it with this:

Well-formed scenarios connect cause to business consequence so assessment is decision-useful.

✖ KRI BREACH

Exposure identified — treat it with this:

Well-formed scenarios connect cause to business consequence so assessment is decision-useful.

38/100 IT Risk Assessment

The register lists 'cyber risk' as a single entry for the whole company. What is the assessment problem?

✖ EXPOSURE RISING

The register grows by one lesson:

Overly broad risk statements can't be measured or assigned; decomposition enables real analysis.

✖ EXPOSURE RISING

The register grows by one lesson:

Overly broad risk statements can't be measured or assigned; decomposition enables real analysis.

✖ EXPOSURE RISING

The register grows by one lesson:

Overly broad risk statements can't be measured or assigned; decomposition enables real analysis.

✔ OWNER ASSIGNED

You connected IT risk to business impact. That's the whole exam.

Overly broad risk statements can't be measured or assigned; decomposition enables real analysis.

39/100 IT Risk Assessment

When assessing likelihood, which factor is most relevant?

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Likelihood flows from threat activity, exposure, and vulnerability — not superstition.

✔ TREND IMPROVING

Clean call. The risk committee would adopt it.

Likelihood flows from threat activity, exposure, and vulnerability — not superstition.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Likelihood flows from threat activity, exposure, and vulnerability — not superstition.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Likelihood flows from threat activity, exposure, and vulnerability — not superstition.

40/100 IT Risk Assessment

Control effectiveness assessments feed risk analysis by:

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Weak or failing controls raise residual risk; testing tells you how much mitigation is real.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Weak or failing controls raise residual risk; testing tells you how much mitigation is real.

✔ BOARD BRIEFED

You're reasoning like a risk owner, not a checkbox auditor.

Weak or failing controls raise residual risk; testing tells you how much mitigation is real.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Weak or failing controls raise residual risk; testing tells you how much mitigation is real.

CHECKPOINT — 40 DOWN, KEEP CLIMBING
41/100 IT Risk Assessment

A vulnerability scanner reports 4,000 findings. What should the risk analyst do first?

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Risk-based prioritization turns raw findings into an actionable remediation order.

✔ RISK MITIGATED

Appetite, tolerance, capacity — you clearly know the difference.

Risk-based prioritization turns raw findings into an actionable remediation order.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Risk-based prioritization turns raw findings into an actionable remediation order.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Risk-based prioritization turns raw findings into an actionable remediation order.

42/100 IT Risk Assessment

Which is an example of an emerging risk assessment input?

✖ KRI BREACH

The register grows by one lesson:

Emerging-risk analysis uses current intelligence and trend data to spot developing exposure.

✖ KRI BREACH

The register grows by one lesson:

Emerging-risk analysis uses current intelligence and trend data to spot developing exposure.

✖ KRI BREACH

The register grows by one lesson:

Emerging-risk analysis uses current intelligence and trend data to spot developing exposure.

✔ WITHIN APPETITE

That answer belongs in a board deck. Sharp.

Emerging-risk analysis uses current intelligence and trend data to spot developing exposure.

43/100 IT Risk Assessment

Two assessors rate the same risk very differently. What practice reduces this inconsistency?

✔ KRI GREEN

That's enterprise risk thinking — ISACA would approve.

Documented criteria and calibration make qualitative ratings repeatable and comparable.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Documented criteria and calibration make qualitative ratings repeatable and comparable.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Documented criteria and calibration make qualitative ratings repeatable and comparable.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Documented criteria and calibration make qualitative ratings repeatable and comparable.

44/100 IT Risk Assessment

What is the purpose of a business impact analysis (BIA) in risk assessment?

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

BIA quantifies how disruption harms the business, grounding availability-risk decisions.

✔ REGISTER UPDATED

You connected IT risk to business impact. That's the whole exam.

BIA quantifies how disruption harms the business, grounding availability-risk decisions.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

BIA quantifies how disruption harms the business, grounding availability-risk decisions.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

BIA quantifies how disruption harms the business, grounding availability-risk decisions.

45/100 IT Risk Assessment

The likelihood of an insider threat scenario is judged low, but its impact would be catastrophic. How should it be handled?

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Impact-heavy tail risks can be unacceptable regardless of likelihood; appetite comparison decides.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Impact-heavy tail risks can be unacceptable regardless of likelihood; appetite comparison decides.

✔ CONTROL EFFECTIVE

Clean call. The risk committee would adopt it.

Impact-heavy tail risks can be unacceptable regardless of likelihood; appetite comparison decides.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Impact-heavy tail risks can be unacceptable regardless of likelihood; appetite comparison decides.

46/100 IT Risk Assessment

Risk assessments should be performed:

✔ RESIDUAL ACCEPTED

You're reasoning like a risk owner, not a checkbox auditor.

Risk is dynamic; assessments must refresh with change and time.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Risk is dynamic; assessments must refresh with change and time.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Risk is dynamic; assessments must refresh with change and time.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Risk is dynamic; assessments must refresh with change and time.

47/100 IT Risk Assessment

What does a risk heat map primarily communicate?

✖ KRI BREACH

Recalibrate your risk lens:

Heat maps visualize comparative severity — a communication tool, not a precision instrument.

✖ KRI BREACH

Recalibrate your risk lens:

Heat maps visualize comparative severity — a communication tool, not a precision instrument.

✖ KRI BREACH

Recalibrate your risk lens:

Heat maps visualize comparative severity — a communication tool, not a precision instrument.

✔ EXPOSURE REDUCED

Appetite, tolerance, capacity — you clearly know the difference.

Heat maps visualize comparative severity — a communication tool, not a precision instrument.

48/100 IT Risk Assessment

An analyst uses ranges and probability distributions (e.g., Monte Carlo) instead of single-point estimates. What is the benefit?

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Distribution-based analysis models uncertainty, improving decision quality over single guesses.

✔ OWNER ASSIGNED

That answer belongs in a board deck. Sharp.

Distribution-based analysis models uncertainty, improving decision quality over single guesses.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Distribution-based analysis models uncertainty, improving decision quality over single guesses.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Distribution-based analysis models uncertainty, improving decision quality over single guesses.

49/100 IT Risk Assessment

Which pairing is correct?

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Threat = actor/event with potential to harm; vulnerability = the weakness it could exploit.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Threat = actor/event with potential to harm; vulnerability = the weakness it could exploit.

✔ TREND IMPROVING

That's enterprise risk thinking — ISACA would approve.

Threat = actor/event with potential to harm; vulnerability = the weakness it could exploit.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Threat = actor/event with potential to harm; vulnerability = the weakness it could exploit.

50/100 IT Risk Assessment

The value of assessing risk against business objectives (not just IT assets) is:

✖ REASSESS THE RISK

The register grows by one lesson:

Objective-centric assessment connects IT risk to mission impact, which drives correct prioritization.

✔ BOARD BRIEFED

You connected IT risk to business impact. That's the whole exam.

Objective-centric assessment connects IT risk to mission impact, which drives correct prioritization.

✖ REASSESS THE RISK

The register grows by one lesson:

Objective-centric assessment connects IT risk to mission impact, which drives correct prioritization.

✖ REASSESS THE RISK

The register grows by one lesson:

Objective-centric assessment connects IT risk to mission impact, which drives correct prioritization.

CHECKPOINT — 50 DOWN, KEEP CLIMBING
51/100 Risk Response & Reporting

An organization implements MFA and monitoring to reduce account-takeover risk. Which response is this?

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Mitigation applies controls to reduce likelihood or impact.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Mitigation applies controls to reduce likelihood or impact.

✔ RISK MITIGATED

Clean call. The risk committee would adopt it.

Mitigation applies controls to reduce likelihood or impact.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Mitigation applies controls to reduce likelihood or impact.

52/100 Risk Response & Reporting

Management decides a proposed feature's risk outweighs its value and cancels it. Which response is this?

✖ KRI BREACH

Escalate this takeaway to memory:

Avoidance eliminates the risk by not performing the risky activity.

✖ KRI BREACH

Escalate this takeaway to memory:

Avoidance eliminates the risk by not performing the risky activity.

✖ KRI BREACH

Escalate this takeaway to memory:

Avoidance eliminates the risk by not performing the risky activity.

✔ WITHIN APPETITE

You're reasoning like a risk owner, not a checkbox auditor.

Avoidance eliminates the risk by not performing the risky activity.

53/100 Risk Response & Reporting

Cyber insurance is purchased to cover breach response costs. Which response is this?

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Insurance shifts part of the financial consequence to a third party — risk transfer/sharing.

✔ KRI GREEN

Appetite, tolerance, capacity — you clearly know the difference.

Insurance shifts part of the financial consequence to a third party — risk transfer/sharing.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Insurance shifts part of the financial consequence to a third party — risk transfer/sharing.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Insurance shifts part of the financial consequence to a third party — risk transfer/sharing.

54/100 Risk Response & Reporting

A minor risk would cost far more to fix than it could cause in loss. Management documents the decision to live with it. Which response is this?

✖ ESCALATION NEEDED

The register grows by one lesson:

Acceptance is a conscious, documented decision to retain risk within appetite.

✖ ESCALATION NEEDED

The register grows by one lesson:

Acceptance is a conscious, documented decision to retain risk within appetite.

✖ ESCALATION NEEDED

The register grows by one lesson:

Acceptance is a conscious, documented decision to retain risk within appetite.

✔ REGISTER UPDATED

That answer belongs in a board deck. Sharp.

Acceptance is a conscious, documented decision to retain risk within appetite.

55/100 Risk Response & Reporting

Who has the authority to formally accept a risk?

✖ REASSESS THE RISK

Recalibrate your risk lens:

Acceptance must come from an owner empowered to commit the organization at that impact level.

✔ CONTROL EFFECTIVE

That's enterprise risk thinking — ISACA would approve.

Acceptance must come from an owner empowered to commit the organization at that impact level.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Acceptance must come from an owner empowered to commit the organization at that impact level.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Acceptance must come from an owner empowered to commit the organization at that impact level.

56/100 Risk Response & Reporting

Outsourcing payment processing to a PCI-compliant provider reduces the org's handling of card data. What must management remember?

✔ RESIDUAL ACCEPTED

You connected IT risk to business impact. That's the whole exam.

You can transfer activities and some financial impact, but accountability to customers/regulators stays.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

You can transfer activities and some financial impact, but accountability to customers/regulators stays.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

You can transfer activities and some financial impact, but accountability to customers/regulators stays.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

You can transfer activities and some financial impact, but accountability to customers/regulators stays.

57/100 Risk Response & Reporting

A control costs $150k/year to run and reduces expected losses by $60k/year. What should the risk practitioner flag?

✖ KRI BREACH

Exposure identified — treat it with this:

Cost-benefit analysis is central to response selection — controls should be proportionate to risk reduced.

✖ KRI BREACH

Exposure identified — treat it with this:

Cost-benefit analysis is central to response selection — controls should be proportionate to risk reduced.

✖ KRI BREACH

Exposure identified — treat it with this:

Cost-benefit analysis is central to response selection — controls should be proportionate to risk reduced.

✔ EXPOSURE REDUCED

Clean call. The risk committee would adopt it.

Cost-benefit analysis is central to response selection — controls should be proportionate to risk reduced.

58/100 Risk Response & Reporting

After treatment, residual risk still exceeds appetite. What should happen next?

✔ OWNER ASSIGNED

You're reasoning like a risk owner, not a checkbox auditor.

Residual risk above appetite requires further action or explicit senior acceptance — never silence.

✖ EXPOSURE RISING

The register grows by one lesson:

Residual risk above appetite requires further action or explicit senior acceptance — never silence.

✖ EXPOSURE RISING

The register grows by one lesson:

Residual risk above appetite requires further action or explicit senior acceptance — never silence.

✖ EXPOSURE RISING

The register grows by one lesson:

Residual risk above appetite requires further action or explicit senior acceptance — never silence.

59/100 Risk Response & Reporting

What is a Key Risk Indicator (KRI)?

✖ ESCALATION NEEDED

Recalibrate your risk lens:

KRIs signal rising exposure before losses occur, enabling proactive response.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

KRIs signal rising exposure before losses occur, enabling proactive response.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

KRIs signal rising exposure before losses occur, enabling proactive response.

✔ TREND IMPROVING

Appetite, tolerance, capacity — you clearly know the difference.

KRIs signal rising exposure before losses occur, enabling proactive response.

60/100 Risk Response & Reporting

Which is the best example of a KRI for unauthorized access risk?

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Good KRIs are measurable, leading, and tied to the specific risk's drivers.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Good KRIs are measurable, leading, and tied to the specific risk's drivers.

✔ BOARD BRIEFED

That answer belongs in a board deck. Sharp.

Good KRIs are measurable, leading, and tied to the specific risk's drivers.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Good KRIs are measurable, leading, and tied to the specific risk's drivers.

CHECKPOINT — 60 DOWN, KEEP CLIMBING
61/100 Risk Response & Reporting

A KRI has been red for three months with no action. What does this reveal?

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

KRIs need thresholds, owners, and escalation paths; unactioned alerts are governance failures.

✔ RISK MITIGATED

That's enterprise risk thinking — ISACA would approve.

KRIs need thresholds, owners, and escalation paths; unactioned alerts are governance failures.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

KRIs need thresholds, owners, and escalation paths; unactioned alerts are governance failures.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

KRIs need thresholds, owners, and escalation paths; unactioned alerts are governance failures.

62/100 Risk Response & Reporting

Risk reporting to executives should emphasize:

✖ KRI BREACH

The register grows by one lesson:

Executive reporting is decision-support: prioritized, trended, and framed around objectives.

✔ WITHIN APPETITE

You connected IT risk to business impact. That's the whole exam.

Executive reporting is decision-support: prioritized, trended, and framed around objectives.

✖ KRI BREACH

The register grows by one lesson:

Executive reporting is decision-support: prioritized, trended, and framed around objectives.

✖ KRI BREACH

The register grows by one lesson:

Executive reporting is decision-support: prioritized, trended, and framed around objectives.

63/100 Risk Response & Reporting

The risk register shows a treatment 'in progress' for 18 months with no milestones met. What should reporting highlight?

✖ EXPOSURE RISING

Recalibrate your risk lens:

Aging, stalled treatments mean the risk position isn't what leadership believes — exceptions must surface.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Aging, stalled treatments mean the risk position isn't what leadership believes — exceptions must surface.

✔ KRI GREEN

Clean call. The risk committee would adopt it.

Aging, stalled treatments mean the risk position isn't what leadership believes — exceptions must surface.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Aging, stalled treatments mean the risk position isn't what leadership believes — exceptions must surface.

64/100 Risk Response & Reporting

An identified risk exceeds the risk owner's authority to accept. What is the correct action?

✔ REGISTER UPDATED

You're reasoning like a risk owner, not a checkbox auditor.

Acceptance authority scales with impact; oversized risks escalate upward for decision.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

Acceptance authority scales with impact; oversized risks escalate upward for decision.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

Acceptance authority scales with impact; oversized risks escalate upward for decision.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

Acceptance authority scales with impact; oversized risks escalate upward for decision.

65/100 Risk Response & Reporting

Which statement about risk acceptance documentation is correct?

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Documented acceptance creates accountability and enables periodic revalidation.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Documented acceptance creates accountability and enables periodic revalidation.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Documented acceptance creates accountability and enables periodic revalidation.

✔ CONTROL EFFECTIVE

Appetite, tolerance, capacity — you clearly know the difference.

Documented acceptance creates accountability and enables periodic revalidation.

66/100 Risk Response & Reporting

A business unit proposes accepting a risk that would violate a regulation. What should the risk practitioner advise?

✖ APPETITE EXCEEDED

The register grows by one lesson:

Legal/regulatory requirements constrain response options; noncompliance is not an acceptable treatment.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Legal/regulatory requirements constrain response options; noncompliance is not an acceptable treatment.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Legal/regulatory requirements constrain response options; noncompliance is not an acceptable treatment.

✔ RESIDUAL ACCEPTED

That answer belongs in a board deck. Sharp.

Legal/regulatory requirements constrain response options; noncompliance is not an acceptable treatment.

67/100 Risk Response & Reporting

What is the relationship between risk response and control ownership?

✔ EXPOSURE REDUCED

That's enterprise risk thinking — ISACA would approve.

Treatment isn't done at selection — controls need accountable owners to keep working.

✖ KRI BREACH

Recalibrate your risk lens:

Treatment isn't done at selection — controls need accountable owners to keep working.

✖ KRI BREACH

Recalibrate your risk lens:

Treatment isn't done at selection — controls need accountable owners to keep working.

✖ KRI BREACH

Recalibrate your risk lens:

Treatment isn't done at selection — controls need accountable owners to keep working.

68/100 Risk Response & Reporting

After a response is implemented, what must be verified?

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Validation closes the loop: did the treatment achieve the intended risk reduction?

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Validation closes the loop: did the treatment achieve the intended risk reduction?

✔ OWNER ASSIGNED

You connected IT risk to business impact. That's the whole exam.

Validation closes the loop: did the treatment achieve the intended risk reduction?

✖ EXPOSURE RISING

Escalate this takeaway to memory:

Validation closes the loop: did the treatment achieve the intended risk reduction?

69/100 Risk Response & Reporting

How should emerging risks that are not yet fully understood be reported?

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Transparency about uncertainty lets leadership decide on watchful waiting versus early action.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Transparency about uncertainty lets leadership decide on watchful waiting versus early action.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Transparency about uncertainty lets leadership decide on watchful waiting versus early action.

✔ TREND IMPROVING

Clean call. The risk committee would adopt it.

Transparency about uncertainty lets leadership decide on watchful waiting versus early action.

70/100 Risk Response & Reporting

A risk report shows only current status with no trend data. What is the limitation?

✖ REASSESS THE RISK

The register grows by one lesson:

Direction matters: trends reveal whether treatments work and where exposure is growing.

✖ REASSESS THE RISK

The register grows by one lesson:

Direction matters: trends reveal whether treatments work and where exposure is growing.

✖ REASSESS THE RISK

The register grows by one lesson:

Direction matters: trends reveal whether treatments work and where exposure is growing.

✔ BOARD BRIEFED

You're reasoning like a risk owner, not a checkbox auditor.

Direction matters: trends reveal whether treatments work and where exposure is growing.

CHECKPOINT — 70 DOWN, KEEP CLIMBING
71/100 Risk Response & Reporting

Which response combination is common for a single major risk?

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Layered responses are normal: controls + insurance + documented acceptance of residual.

✔ RISK MITIGATED

Appetite, tolerance, capacity — you clearly know the difference.

Layered responses are normal: controls + insurance + documented acceptance of residual.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Layered responses are normal: controls + insurance + documented acceptance of residual.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Layered responses are normal: controls + insurance + documented acceptance of residual.

72/100 Risk Response & Reporting

The purpose of a risk and control self-assessment (RCSA) is to:

✖ KRI BREACH

Escalate this takeaway to memory:

RCSA engages the first line in ongoing identification and control evaluation.

✔ WITHIN APPETITE

That answer belongs in a board deck. Sharp.

RCSA engages the first line in ongoing identification and control evaluation.

✖ KRI BREACH

Escalate this takeaway to memory:

RCSA engages the first line in ongoing identification and control evaluation.

✖ KRI BREACH

Escalate this takeaway to memory:

RCSA engages the first line in ongoing identification and control evaluation.

73/100 Risk Response & Reporting

What should trigger an out-of-cycle risk report to leadership?

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Threshold breaches and material events warrant immediate escalation, not waiting for the quarterly deck.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Threshold breaches and material events warrant immediate escalation, not waiting for the quarterly deck.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

Threshold breaches and material events warrant immediate escalation, not waiting for the quarterly deck.

✔ KRI GREEN

That's enterprise risk thinking — ISACA would approve.

Threshold breaches and material events warrant immediate escalation, not waiting for the quarterly deck.

74/100 Risk Response & Reporting

An action plan assigns 'IT' as the owner of a treatment. Why is this inadequate?

✖ ESCALATION NEEDED

The register grows by one lesson:

Diffuse ownership stalls execution; a named accountable owner is a treatment-plan essential.

✖ ESCALATION NEEDED

The register grows by one lesson:

Diffuse ownership stalls execution; a named accountable owner is a treatment-plan essential.

✖ ESCALATION NEEDED

The register grows by one lesson:

Diffuse ownership stalls execution; a named accountable owner is a treatment-plan essential.

✔ REGISTER UPDATED

You connected IT risk to business impact. That's the whole exam.

Diffuse ownership stalls execution; a named accountable owner is a treatment-plan essential.

75/100 Risk Response & Reporting

Which metric best demonstrates risk program value to the board?

✔ CONTROL EFFECTIVE

Clean call. The risk committee would adopt it.

Outcome metrics — exposure versus appetite and loss experience — show whether the program works.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Outcome metrics — exposure versus appetite and loss experience — show whether the program works.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Outcome metrics — exposure versus appetite and loss experience — show whether the program works.

✖ REASSESS THE RISK

Recalibrate your risk lens:

Outcome metrics — exposure versus appetite and loss experience — show whether the program works.

76/100 IT & Security

Which access control principle grants users only the permissions their job requires?

✔ RESIDUAL ACCEPTED

You're reasoning like a risk owner, not a checkbox auditor.

Least privilege limits both accident and abuse by minimizing granted rights.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

Least privilege limits both accident and abuse by minimizing granted rights.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

Least privilege limits both accident and abuse by minimizing granted rights.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

Least privilege limits both accident and abuse by minimizing granted rights.

77/100 IT & Security

One person can both create vendors and approve payments to them. Which control principle is violated?

✖ KRI BREACH

Exposure identified — treat it with this:

SoD splits conflicting duties so fraud requires collusion rather than one actor.

✔ EXPOSURE REDUCED

Appetite, tolerance, capacity — you clearly know the difference.

SoD splits conflicting duties so fraud requires collusion rather than one actor.

✖ KRI BREACH

Exposure identified — treat it with this:

SoD splits conflicting duties so fraud requires collusion rather than one actor.

✖ KRI BREACH

Exposure identified — treat it with this:

SoD splits conflicting duties so fraud requires collusion rather than one actor.

78/100 IT & Security

Changes are pushed straight to production without approval or testing. Which control process is missing?

✖ EXPOSURE RISING

The register grows by one lesson:

Change management (request, assess, approve, test, implement, review) protects stability and security.

✖ EXPOSURE RISING

The register grows by one lesson:

Change management (request, assess, approve, test, implement, review) protects stability and security.

✖ EXPOSURE RISING

The register grows by one lesson:

Change management (request, assess, approve, test, implement, review) protects stability and security.

✔ OWNER ASSIGNED

That answer belongs in a board deck. Sharp.

Change management (request, assess, approve, test, implement, review) protects stability and security.

79/100 IT & Security

What is the risk of unmanaged 'shadow IT' SaaS use?

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Unknown services mean unassessed risk, uncontrolled data flows, and orphaned access.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Unknown services mean unassessed risk, uncontrolled data flows, and orphaned access.

✔ TREND IMPROVING

That's enterprise risk thinking — ISACA would approve.

Unknown services mean unassessed risk, uncontrolled data flows, and orphaned access.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Unknown services mean unassessed risk, uncontrolled data flows, and orphaned access.

80/100 IT & Security

Backups exist but restores have never been tested. What is the risk truth?

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Recovery objectives are only met if restoration is validated periodically.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Recovery objectives are only met if restoration is validated periodically.

✔ BOARD BRIEFED

You connected IT risk to business impact. That's the whole exam.

Recovery objectives are only met if restoration is validated periodically.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Recovery objectives are only met if restoration is validated periodically.

CHECKPOINT — 80 DOWN, KEEP CLIMBING
81/100 IT & Security

RTO defines:

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Recovery Time Objective is the target restoration time; RPO covers tolerable data loss.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Recovery Time Objective is the target restoration time; RPO covers tolerable data loss.

✖ APPETITE EXCEEDED

Exposure identified — treat it with this:

Recovery Time Objective is the target restoration time; RPO covers tolerable data loss.

✔ RISK MITIGATED

Clean call. The risk committee would adopt it.

Recovery Time Objective is the target restoration time; RPO covers tolerable data loss.

82/100 IT & Security

RPO defines:

✖ KRI BREACH

The register grows by one lesson:

Recovery Point Objective bounds how much recent data the organization can afford to lose.

✖ KRI BREACH

The register grows by one lesson:

Recovery Point Objective bounds how much recent data the organization can afford to lose.

✔ WITHIN APPETITE

You're reasoning like a risk owner, not a checkbox auditor.

Recovery Point Objective bounds how much recent data the organization can afford to lose.

✖ KRI BREACH

The register grows by one lesson:

Recovery Point Objective bounds how much recent data the organization can afford to lose.

83/100 IT & Security

Encrypting data in transit primarily protects against:

✖ EXPOSURE RISING

Recalibrate your risk lens:

Transport encryption (e.g., TLS) protects confidentiality and integrity between endpoints.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Transport encryption (e.g., TLS) protects confidentiality and integrity between endpoints.

✖ EXPOSURE RISING

Recalibrate your risk lens:

Transport encryption (e.g., TLS) protects confidentiality and integrity between endpoints.

✔ KRI GREEN

Appetite, tolerance, capacity — you clearly know the difference.

Transport encryption (e.g., TLS) protects confidentiality and integrity between endpoints.

84/100 IT & Security

Which technology enforces policies on what data can leave the organization via email or uploads?

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

DLP inspects and controls outbound data flows against policy.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

DLP inspects and controls outbound data flows against policy.

✔ REGISTER UPDATED

That answer belongs in a board deck. Sharp.

DLP inspects and controls outbound data flows against policy.

✖ ESCALATION NEEDED

Escalate this takeaway to memory:

DLP inspects and controls outbound data flows against policy.

85/100 IT & Security

A patch for an actively exploited critical vulnerability is available. From a risk view, delay primarily increases:

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Time-to-patch on exploited vulnerabilities is a direct driver of compromise likelihood.

✔ CONTROL EFFECTIVE

That's enterprise risk thinking — ISACA would approve.

Time-to-patch on exploited vulnerabilities is a direct driver of compromise likelihood.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Time-to-patch on exploited vulnerabilities is a direct driver of compromise likelihood.

✖ REASSESS THE RISK

Exposure identified — treat it with this:

Time-to-patch on exploited vulnerabilities is a direct driver of compromise likelihood.

86/100 IT & Security

What is the purpose of security logging and monitoring as a control?

✖ APPETITE EXCEEDED

The register grows by one lesson:

Detective controls shrink attacker dwell time and enable investigation and recovery.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Detective controls shrink attacker dwell time and enable investigation and recovery.

✖ APPETITE EXCEEDED

The register grows by one lesson:

Detective controls shrink attacker dwell time and enable investigation and recovery.

✔ RESIDUAL ACCEPTED

You connected IT risk to business impact. That's the whole exam.

Detective controls shrink attacker dwell time and enable investigation and recovery.

87/100 IT & Security

An IDS that alerts but is never watched provides:

✖ KRI BREACH

Recalibrate your risk lens:

Controls are people + process + technology; unmonitored alerts don't reduce risk.

✔ EXPOSURE REDUCED

Clean call. The risk committee would adopt it.

Controls are people + process + technology; unmonitored alerts don't reduce risk.

✖ KRI BREACH

Recalibrate your risk lens:

Controls are people + process + technology; unmonitored alerts don't reduce risk.

✖ KRI BREACH

Recalibrate your risk lens:

Controls are people + process + technology; unmonitored alerts don't reduce risk.

88/100 IT & Security

Which cloud model leaves the customer responsible for securing the OS, middleware, and applications?

✖ EXPOSURE RISING

Escalate this takeaway to memory:

In IaaS, the provider secures the infrastructure; the customer owns the stack above the hypervisor.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

In IaaS, the provider secures the infrastructure; the customer owns the stack above the hypervisor.

✔ OWNER ASSIGNED

You're reasoning like a risk owner, not a checkbox auditor.

In IaaS, the provider secures the infrastructure; the customer owns the stack above the hypervisor.

✖ EXPOSURE RISING

Escalate this takeaway to memory:

In IaaS, the provider secures the infrastructure; the customer owns the stack above the hypervisor.

89/100 IT & Security

Why does vendor risk management matter for IT risk?

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Supply-chain and outsourcing dependencies extend the risk boundary beyond your own controls.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Supply-chain and outsourcing dependencies extend the risk boundary beyond your own controls.

✔ TREND IMPROVING

Appetite, tolerance, capacity — you clearly know the difference.

Supply-chain and outsourcing dependencies extend the risk boundary beyond your own controls.

✖ ESCALATION NEEDED

Exposure identified — treat it with this:

Supply-chain and outsourcing dependencies extend the risk boundary beyond your own controls.

90/100 IT & Security

Which practice reduces the impact of a compromised user account?

✖ REASSESS THE RISK

The register grows by one lesson:

Containment by design limits blast radius when (not if) credentials are compromised.

✔ BOARD BRIEFED

That answer belongs in a board deck. Sharp.

Containment by design limits blast radius when (not if) credentials are compromised.

✖ REASSESS THE RISK

The register grows by one lesson:

Containment by design limits blast radius when (not if) credentials are compromised.

✖ REASSESS THE RISK

The register grows by one lesson:

Containment by design limits blast radius when (not if) credentials are compromised.

CHECKPOINT — 90 DOWN, KEEP CLIMBING
91/100 IT & Security

Data classification supports risk management by:

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Classification ties control strength to data value — the basis of proportionate protection.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Classification ties control strength to data value — the basis of proportionate protection.

✖ APPETITE EXCEEDED

Recalibrate your risk lens:

Classification ties control strength to data value — the basis of proportionate protection.

✔ RISK MITIGATED

That's enterprise risk thinking — ISACA would approve.

Classification ties control strength to data value — the basis of proportionate protection.

92/100 IT & Security

An organization retains all data forever 'just in case.' What is the risk perspective?

✖ KRI BREACH

Escalate this takeaway to memory:

Data you don't hold can't be breached; retention policy is a risk-reduction control.

✔ WITHIN APPETITE

You connected IT risk to business impact. That's the whole exam.

Data you don't hold can't be breached; retention policy is a risk-reduction control.

✖ KRI BREACH

Escalate this takeaway to memory:

Data you don't hold can't be breached; retention policy is a risk-reduction control.

✖ KRI BREACH

Escalate this takeaway to memory:

Data you don't hold can't be breached; retention policy is a risk-reduction control.

93/100 IT & Security

Which authentication improvement most reduces credential-theft risk?

✖ EXPOSURE RISING

Exposure identified — treat it with this:

MFA — especially phishing-resistant forms — breaks the value of stolen passwords.

✔ KRI GREEN

Clean call. The risk committee would adopt it.

MFA — especially phishing-resistant forms — breaks the value of stolen passwords.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

MFA — especially phishing-resistant forms — breaks the value of stolen passwords.

✖ EXPOSURE RISING

Exposure identified — treat it with this:

MFA — especially phishing-resistant forms — breaks the value of stolen passwords.

94/100 IT & Security

What is the primary security risk of end-of-life (EOL) software?

✖ ESCALATION NEEDED

The register grows by one lesson:

EOL software accumulates unfixable weaknesses, steadily raising compromise likelihood.

✖ ESCALATION NEEDED

The register grows by one lesson:

EOL software accumulates unfixable weaknesses, steadily raising compromise likelihood.

✔ REGISTER UPDATED

You're reasoning like a risk owner, not a checkbox auditor.

EOL software accumulates unfixable weaknesses, steadily raising compromise likelihood.

✖ ESCALATION NEEDED

The register grows by one lesson:

EOL software accumulates unfixable weaknesses, steadily raising compromise likelihood.

95/100 IT & Security

Privileged access management (PAM) reduces risk by:

✖ REASSESS THE RISK

Recalibrate your risk lens:

PAM controls the most dangerous credentials — admin access — with checkout, session recording, and least privilege.

✖ REASSESS THE RISK

Recalibrate your risk lens:

PAM controls the most dangerous credentials — admin access — with checkout, session recording, and least privilege.

✖ REASSESS THE RISK

Recalibrate your risk lens:

PAM controls the most dangerous credentials — admin access — with checkout, session recording, and least privilege.

✔ CONTROL EFFECTIVE

Appetite, tolerance, capacity — you clearly know the difference.

PAM controls the most dangerous credentials — admin access — with checkout, session recording, and least privilege.

96/100 IT & Security

Which incident response phase focuses on limiting damage while the incident is active?

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

Containment stops the spread; eradication and recovery follow.

✔ RESIDUAL ACCEPTED

That answer belongs in a board deck. Sharp.

Containment stops the spread; eradication and recovery follow.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

Containment stops the spread; eradication and recovery follow.

✖ APPETITE EXCEEDED

Escalate this takeaway to memory:

Containment stops the spread; eradication and recovery follow.

97/100 IT & Security

A post-incident review is skipped because 'we're too busy.' What risk value is lost?

✔ EXPOSURE REDUCED

That's enterprise risk thinking — ISACA would approve.

Lessons learned convert incidents into control improvements — skipping them wastes the loss.

✖ KRI BREACH

Exposure identified — treat it with this:

Lessons learned convert incidents into control improvements — skipping them wastes the loss.

✖ KRI BREACH

Exposure identified — treat it with this:

Lessons learned convert incidents into control improvements — skipping them wastes the loss.

✖ KRI BREACH

Exposure identified — treat it with this:

Lessons learned convert incidents into control improvements — skipping them wastes the loss.

98/100 IT & Security

Security baselines/hardening standards reduce risk by:

✔ OWNER ASSIGNED

You connected IT risk to business impact. That's the whole exam.

Hardening shrinks the attack surface consistently across the fleet.

✖ EXPOSURE RISING

The register grows by one lesson:

Hardening shrinks the attack surface consistently across the fleet.

✖ EXPOSURE RISING

The register grows by one lesson:

Hardening shrinks the attack surface consistently across the fleet.

✖ EXPOSURE RISING

The register grows by one lesson:

Hardening shrinks the attack surface consistently across the fleet.

99/100 IT & Security

What does 'defense in depth' mean?

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Layering assumes any control can fail; overlapping safeguards preserve protection.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Layering assumes any control can fail; overlapping safeguards preserve protection.

✔ TREND IMPROVING

Clean call. The risk committee would adopt it.

Layering assumes any control can fail; overlapping safeguards preserve protection.

✖ ESCALATION NEEDED

Recalibrate your risk lens:

Layering assumes any control can fail; overlapping safeguards preserve protection.

100/100 IT & Security

IT asset inventory is foundational to risk management because:

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Unknown assets are unmanaged risk; inventory anchors vulnerability, config, and access management.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Unknown assets are unmanaged risk; inventory anchors vulnerability, config, and access management.

✔ BOARD BRIEFED

You're reasoning like a risk owner, not a checkbox auditor.

Unknown assets are unmanaged risk; inventory anchors vulnerability, config, and access management.

✖ REASSESS THE RISK

Escalate this takeaway to memory:

Unknown assets are unmanaged risk; inventory anchors vulnerability, config, and access management.

PORTFOLIO REVIEWED — RISK POSTURE STRONG

You just worked a full risk register. Oluma appreciates the discipline — this is how trusted advisors are built.

RISKS TREATED ASSESSED

These are original practice scenarios written for the Oluma community. CRISC® is a registered trademark of ISACA. Oluma is not affiliated with or endorsed by ISACA. No official exam content is reproduced here — concepts over dumps, always.