CRISC Readiness Test

10 questions, balanced across the exam's topics. Answer each one, then submit for your practice readiness estimate and per-topic breakdown. This is a practice estimate — not a prediction or guarantee of your official exam result.

Question 1

Pipeline risks are absent from identification. Pipeline risks are identified but treated as low priority. What should the risk practitioner do in this situation?

Recommend manual builds as safer Prioritize by blast radius: pipelines affect everything they build. Deprioritize as theoretical Recommend ignoring build integrity

Question 2

Effectiveness is inferred from design documentation. Testing finds consistent operation but only in low-risk periods. Given these circumstances, what is the BEST course of action?

Require representative coverage: testing must cover risky periods too. Accept low-risk-only testing Recommend testing only year-end Recommend reducing samples to save effort

Question 3

Only siloed reports exist. What is the BEST course of action for the risk practitioner?

Recommend aggregation without correlation Recommend the portfolio report as unreadable Require portfolio views: aggregate with correlation. Keep siloed reports

Question 4

Which statement BEST defines Risk transfer?

Cost-benefit compares control cost against risk reduction value. Contingency plans prepare for risk realization -- what to do when the risk happens. Control changes -- new, modified, retired -- need governance to avoid gaps. Transfer shifts financial impact -- via insurance or contract -- without reducing likelihood.

Question 5

Which of the following BEST describes Technology obsolescence risk?

Obsolescence risk is the potential for unsupported technology to become unsecurable and unmaintainable. Asset identification inventories what matters -- systems, data, people, facilities -- as the foundation of risk identification. Audit findings -- control gaps and weaknesses -- are direct inputs to risk identification. Threat landscape monitoring tracks adversary trends relevant to the organization.

Question 6

The tool's output is treated as the assessment. Which of the following concepts is BEST illustrated by this scenario?

Risk assessment for critical third parties OT risk assessment specifics Risk assessment tools and technology Integrating risk assessment with audit

Question 7

Reports are built on known-bad data. Which concept does this scenario BEST illustrate?

Compliance monitoring External risk reporting Regulatory change monitoring Data quality for risk reporting

Question 8

In the context of Risk Response & Mitigation, which of the following BEST describes Endpoint risk response?

Contingency plans prepare for risk realization -- what to do when the risk happens. Endpoint response -- management, encryption, EDR -- secures the largest attack surface. Testing -- exercises, simulations -- proves responses work. The four responses are avoid, mitigate, transfer, and accept -- chosen to bring residual risk within tolerance.

Question 9

Open-source components are invisible in risk identification. What is the BEST course of action for the risk practitioner?

Require open-source identification: inventory, vulnerability, and license risks. Recommend banning open source Trust popularity as safety Recommend developers self-police

Question 10

Continuity risk is assumed managed by having a plan. This situation is an example of which of the following?

Business continuity risk assessment Privileged access risk assessment Digital identity risk assessment Risk heat maps

Unanswered questions count as incorrect. Your answers are graded on the server; no answer key is sent to your browser.

← Back to the CRISC page

About Contact Privacy Policy Terms of Service Refund Policy

Home Exams Simulations WorkTrials GameScope Account