CRISC – Certified in Risk and Information Systems Control (ISACA): free practice test

Start with 10 free questions to see what needs more practice. Finish to see your score, weakest units and every option explained.

450 on the 200–800 scale This is your practice accuracy. It cannot be converted to the exam’s scaled score or used to determine whether you pass.

Back to CRISC – Certified in Risk and Information Systems Control (ISACA)

A score you can trust before test day

Full mock exams like the real one and 750 explained questions that find your weak spots and train them

Lifetime
Best value
SAR 34 $9
Unlimited practice and mock exams. Access stays open for as long as the exam is on the site, with every question we add later.
7 days
SAR 26 $7
about SAR 3.7 a day
For your final push before exam day

See everything included

Unlimited full mock exams to practise your pace and check your performance across the whole exam
Practise 10 weak-area questions, starting where you lose the most marks
750 questions explaining why every option is right or wrong
Arabic and English with one pass

About the exam

Exam language: English
Number of questions: 150 questions
Exam time: 240 minutes
Pass mark: 450 on the 200–800 scale

Practice test questions with answers and explanations

Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.

01A business unit hides minor incidents to protect bonuses. Most likely root cause?

Practice question Unit: Governance

AWeak technical monitoring tools and insufficient event logging in the business unit
More logging may detect incidents but does not remove the incentive to hide them.
BIncentives that conflict with a risk-reporting culture ✓ Correct answer
Penalizing reported incidents through bonuses encourages under-reporting.
CLack of technical training
Technical training does not directly change the reward conflict described.
DNo risk register
A register records risks but does not fix misaligned incentives.

Reference: ISACA exam content outline (ISACA-CRISC-JobPractice-2025), domain "Governance", topic "1A Organizational governance: strategy, structure/roles, culture/ethics, policies, business processes and resilience, asset management"; https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

02A continuity test shows actual recovery time exceeds the RTO. BEST action?

Practice question Unit: Governance

AAnalyse the gap and remediate or revisit the RTO with the process owner ✓ Correct answer
Analyze the causes, improve recovery or agree an authorized target revision with the process owner.
BRaise the RTO automatically so it matches the actual recovery time achieved
RTO reflects business need; it must not be raised merely to fit poor performance.
CTreat it as acceptable
Acceptance requires an informed decision by an authorized owner.
DCancel future tests
Cancelling tests hides the recovery capability gap.

03Which BEST describes the risk practitioner's role in setting risk appetite?

Practice question Unit: Governance

AAudit the appetite
Independent audit evaluates appetite governance rather than setting it.
BSet appetite himself as he understands technical risk best
Technical expertise does not authorize the practitioner to set enterprise appetite alone.
CGive final approval
Final approval belongs to the authorized governing bodies.
DAssist stakeholders by providing the needed information and analysis ✓ Correct answer
The practitioner supports the decision with risk information, analysis and facilitation.

Reference: ISACA exam content outline (ISACA-CRISC-JobPractice-2025), domain "Governance", topic "1B Risk governance: ERM, lines of defense, risk profile, appetite/tolerance, frameworks and legal/regulatory/contractual requirements"; https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

04FIRST step in risk identification?

Practice question Unit: Risk Assessment

APrepare the board risk report for the next quarterly meeting
A board report follows assessment; it does not establish identification context.
BUnderstand business context, assets and objectives ✓ Correct answer
Business context identifies what matters, what is exposed and which objectives are threatened.
CCompute annual loss expectancy per IT asset from historic data
Loss calculations require assets, objectives and scenarios to be understood first.
DSelect controls
Controls are chosen after understanding relevant risks.

Reference: ISACA exam content outline (ISACA-CRISC-JobPractice-2025), domain "Risk Assessment", topic "2A Risk identification: risk events, threat modeling/landscape, vulnerability management, risk scenarios"; https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

05What is a risk scenario?

Practice question Unit: Risk Assessment

AA three-year internal audit schedule
An audit schedule plans assurance work, not a possible risk event.
BA detailed disaster recovery plan with alternate sites and teams
A recovery plan specifies actions after disruption, not the scenario itself.
CA described possible event: actor, threat, asset, effect and timing ✓ Correct answer
A scenario links a plausible event and actors to assets, consequences and timing.
DA list of applied controls
A control list describes safeguards without explaining the possible event and effects.

06The four basic risk response options?

Practice question Unit: Risk Response and Reporting

APrevent, detect, correct and deter at control level
Preventive, detective, corrective and deterrent describe control functions.
BPlan, do, check, act per the Deming cycle
Plan–Do–Check–Act is an improvement cycle, not response options.
CAvoid, mitigate, transfer, accept ✓ Correct answer
Avoidance, mitigation, transfer and acceptance are risk-response choices.
DIdentify, analyse, evaluate and continuously monitor all risks
Identification, analysis and monitoring are risk-management activities.

Reference: ISACA exam content outline (ISACA-CRISC-JobPractice-2025), domain "Risk Response and Reporting", topic "3A Risk response: options, risk/control ownership, vendor/supply-chain risk, issues/findings/exceptions"; https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

07When is risk avoidance MOST appropriate?

Practice question Unit: Risk Response and Reporting

AWhen risk exceeds appetite and no cost-effective response exists ✓ Correct answer
If unacceptable risk cannot be treated economically, discontinuing the activity avoids it.
BWhen available controls reduce it acceptably at reasonable cost
Cost-effective controls support mitigation, not necessarily avoidance.
CWhen affordable insurance covering the losses can be bought
Affordable insurance can support transfer without ending the activity.
DWhen the risk is very low and within the enterprise's tolerance
Low risk within tolerance may be accepted rather than avoided.

08The firm buys cyber insurance. What is NOT transferred to the insurer?

Practice question Unit: Risk Response and Reporting

APart of the direct financial loss per the policy terms
The policy can reimburse specified direct financial losses.
BAccountability for the risk and reputational impact ✓ Correct answer
The organization retains risk accountability; insurance cannot erase reputational damage.
CForensic investigation costs covered by the policy
Covered investigation expenses may be reimbursed.
DCustomer notification costs if covered
Covered notification costs may be paid by the insurer.

09How does EA help risk management?

Practice question Unit: Technology and Security

AIt removes the need for risk assessment since design prevents all failure
Architecture informs assessment; it does not eliminate failure or assessment needs.
BIt sets appetite
Risk appetite is a governance decision, not set by an architecture diagram.
CIt cuts budget
Cost reduction is possible but is not the direct risk-management contribution asked.
DIt shows dependencies, redundancy and failure points across components ✓ Correct answer
Mapping component relationships reveals dependencies, redundancy and potential failure points.

Reference: ISACA exam content outline (ISACA-CRISC-JobPractice-2025), domain "Technology and Security", topic "4A1–4 Technology principles, roadmaps/EA, operations management, SDLC"; https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

10Which approach BEST controls the risk introduced by emergency IT changes?

Practice question Unit: Technology and Security

AAllow them unrestricted
Unrestricted changes bypass accountability and increase uncontrolled exposure.
BBan all emergency changes completely, even if the service stays down as a result
A blanket ban can prevent urgent service restoration and risk reduction.
COnly at weekends
Weekend timing does not establish authorization or risk control.
DMandatory post-implementation review, approval and documentation ✓ Correct answer
An emergency process retains authorization, documentation and mandatory post-implementation review.

CRISC – Certified in Risk and Information Systems Control (ISACA): free practice test

Practice test questions with answers and explanations

Keep preparing for CRISC – Certified in Risk and Information Systems Control (ISACA)

See also: Engineering Exams