ISACA CRISC QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Governance (Questions 1–25)
1. Which of the following BEST describes the primary purpose of IT governance?
A. To ensure IT projects are delivered on time and within budget
B. To provide structure that aligns IT objectives with business objectives
C. To eliminate all IT-related risks
D. To ensure compliance with all regulatory requirements
Answer: B
Rationale: IT governance provides a framework to ensure IT supports and enables the achievement of
enterprise objectives. While compliance and project delivery are components, the primary purpose is strategic
alignment.
2. Who is ultimately accountable for ensuring that risk is managed appropriately within an enterprise?
A. The Chief Information Officer (CIO)
,B. The Chief Risk Officer (CRO)
C. The Board of Directors
D. The IT Risk Manager
Answer: C
Rationale: The Board of Directors holds ultimate accountability for enterprise governance, including risk
management. They set the tone at the top and are responsible for overseeing that management has
implemented appropriate risk practices.
3. An organization's risk appetite is BEST defined as:
A. The maximum level of risk the organization can withstand
B. The amount and type of risk the organization is willing to pursue or retain
C. The total value of assets at risk
D. The probability of a risk event occurring
Answer: B
Rationale: Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its
objectives. Risk tolerance is the acceptable variation around that appetite, and risk capacity is the maximum risk
it can withstand.
, 4. Which of the following is the MOST important characteristic of a key risk indicator (KRI)?
A. It is easy to measure
B. It provides predictive value regarding risk exposure
C. It is reviewed annually
D. It is quantitative in nature
Answer: B
Rationale: A KRI's primary value is its ability to provide early warning or predictive insight into changes in risk
exposure. While measurability is important, predictive value is the most critical characteristic.
5. A risk register should PRIMARILY be used to:
A. Document all IT assets and their configurations
B. Track identified risks, their attributes, and mitigation status
C. Record all security incidents and their resolutions
D. List all regulatory requirements applicable to the organization
Answer: B
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Governance (Questions 1–25)
1. Which of the following BEST describes the primary purpose of IT governance?
A. To ensure IT projects are delivered on time and within budget
B. To provide structure that aligns IT objectives with business objectives
C. To eliminate all IT-related risks
D. To ensure compliance with all regulatory requirements
Answer: B
Rationale: IT governance provides a framework to ensure IT supports and enables the achievement of
enterprise objectives. While compliance and project delivery are components, the primary purpose is strategic
alignment.
2. Who is ultimately accountable for ensuring that risk is managed appropriately within an enterprise?
A. The Chief Information Officer (CIO)
,B. The Chief Risk Officer (CRO)
C. The Board of Directors
D. The IT Risk Manager
Answer: C
Rationale: The Board of Directors holds ultimate accountability for enterprise governance, including risk
management. They set the tone at the top and are responsible for overseeing that management has
implemented appropriate risk practices.
3. An organization's risk appetite is BEST defined as:
A. The maximum level of risk the organization can withstand
B. The amount and type of risk the organization is willing to pursue or retain
C. The total value of assets at risk
D. The probability of a risk event occurring
Answer: B
Rationale: Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its
objectives. Risk tolerance is the acceptable variation around that appetite, and risk capacity is the maximum risk
it can withstand.
, 4. Which of the following is the MOST important characteristic of a key risk indicator (KRI)?
A. It is easy to measure
B. It provides predictive value regarding risk exposure
C. It is reviewed annually
D. It is quantitative in nature
Answer: B
Rationale: A KRI's primary value is its ability to provide early warning or predictive insight into changes in risk
exposure. While measurability is important, predictive value is the most critical characteristic.
5. A risk register should PRIMARILY be used to:
A. Document all IT assets and their configurations
B. Track identified risks, their attributes, and mitigation status
C. Record all security incidents and their resolutions
D. List all regulatory requirements applicable to the organization
Answer: B
