A data center has an asset value (AV) of $2,000,000. A specific power surge event is estimated to occur once every 10 years. If it occurs, there is a 50% chance it will destroy the primary servers. What is the Annualized Loss Expectancy (ALE)? If your first instinct was to calculate $2,000,000 ÷ 10 years = $200,000, you've just made one of the most common calculation errors on the CRISC exam. The real answer is half that, and understanding why separates passing candidates from the rest.
To pass CRISC Domain 2, IT Risk Assessment, you must demonstrate judgment in applying the risk management lifecycle. This involves identifying risks relevant to business objectives, analyzing them with the right method (qualitative or quantitative), and evaluating them against the organization's risk appetite to create a prioritized action plan.
Key facts
- Official Body
- ISACA (Information Systems Audit and Control Association)
- Exam Domains
- 4 (Governance, IT Risk Assessment, Risk Response and Reporting, Information Technology and Security and Business Continuity)
- Passing Score
- 450 on a scale of 200 to 800
- Domain 2 Weighting
- 20% of the total exam score
- Key Frameworks
- COBIT 2019, NIST Special Publications (SP 800 series), ISO 27005
- Average Salary
- $110,000 - $165,000 for CRISC-certified professionals
The U.S. Bureau of Labor Statistics projects that employment for information security analysts will grow 32 percent from 2022 to 2032, a rate much faster than the average for all occupations (BLS).
What Makes These Free CRISC Domain 2 Practice Questions Different?
These questions are designed by certified CRISC instructors to replicate the logic of the real ISACA exam, focusing on the IT Risk Assessment domain. This domain accounts for 20% of your score, and true mastery is essential. You can find over 1,800 more questions like these in the VoraPrep CRISC adaptive question bank.
Studying for CRISC? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
These questions cover the full lifecycle of the domain:
- Risk Identification: Methods for discovering threats and vulnerabilities relevant to the business.
- Risk Analysis: Applying both quantitative (SLE, ALE) and qualitative (risk matrix) techniques.
- Risk Evaluation: Prioritizing risks based on business objectives and the organization's risk appetite.
The CRISC exam is about thinking like a risk practitioner. You will face scenarios where multiple answers seem plausible, but only one is the best choice from a business risk perspective. Let's see how you apply that judgment.
Risk Assessment (Risk Identification, Analysis, Evaluation) Practice Questions
For each question, select the best possible answer. The detailed explanations are the most valuable part of this exercise. Read them carefully, even for the questions you answer correctly.
Question 1
A financial services firm is conducting a risk assessment on its new mobile banking application. The risk management team has reliable historical data on similar application failures, including downtime costs and frequency. Which of the following risk analysis methods would be MOST appropriate in this scenario?
Why C is Correct
The correct answer is C) Quantitative risk analysis. The key phrase in the scenario is "reliable historical data." Quantitative risk analysis uses numerical values, like monetary figures, to assess risk. This approach requires credible data to calculate metrics like Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE). Since the firm possesses this data, a quantitative approach is the most precise and appropriate method.Why A, B, and D are Incorrect
- A) Qualitative risk analysis: This method uses descriptive terms (High, Medium, Low) and is best for situations where data is subjective or unavailable. Given the availability of reliable data, a qualitative analysis would be less precise and therefore not the most appropriate choice.
- B) The Delphi technique: This is a forecasting method that relies on a panel of experts to reach a consensus. It is useful for identifying risks or estimating probabilities without historical data, but it is not the primary analysis method when hard numbers are already available.
- D) Threat modeling: This is a process for identifying potential threats and vulnerabilities early in the development lifecycle. It is part of risk identification, which occurs before risk analysis.
Question 2
During a risk identification workshop, a team member identifies "insufficient firewall rules" for a critical database server. How should this finding be categorized?
Why D is Correct
The correct answer is D) Vulnerability. A vulnerability is a weakness or gap in a system's security that can be exploited by a threat to cause harm. "Insufficient firewall rules" is a textbook example of a weakness in a security control.- A Threat is the agent or action that could cause harm (e.g., an external hacker, a malware infection).
- A Vulnerability is the weakness the threat exploits (the insufficient firewall rules).
- A Risk is the effect of uncertainty on objectives, often expressed as the combination of a threat and a vulnerability, considering likelihood and impact (e.g., "The risk of an external hacker exploiting insufficient firewall rules to cause a data breach").
Why A, B, and C are Incorrect
- A) Threat: The threat would be the actor or event that takes advantage of the weak firewall, such as a "denial-of-service attack" or an "unauthorized external user."
- B) Risk: The risk is the potential for loss that arises from this situation, which includes the likelihood of the vulnerability being exploited and the resulting impact on business objectives.
- C) Impact: The impact is the outcome or consequence if the risk materializes (e.g., data loss, financial penalty, reputational damage).
Question 3
A retail company identifies a risk of its primary e-commerce database failing. The financial impact of each failure, which represents the Single Loss Expectancy (SLE), is estimated at $250,000. Based on historical data, this type of failure occurs, on average, once every four years. A proposed new high-availability solution would cost $70,000 per year to implement and maintain. From a purely financial perspective, what is the BEST risk response?
Why B is Correct
The correct answer is B) Accept the risk. This question requires a cost-benefit analysis using the Annualized Loss Expectancy (ALE) formula to determine if the proposed control is financially sound.Step 1: Identify the Single Loss Expectancy (SLE)
The SLE is the financial loss from a single event. The scenario gives this to us directly. SLE = $250,000Step 2: Calculate the Annualized Rate of Occurrence (ARO)
The ARO is the frequency of the event per year. An event that occurs once every four years has an ARO of 1 ÷ 4. ARO = 0.25Step 3: Calculate the Annualized Loss Expectancy (ALE)
The ALE is the total expected loss per year. ALE = SLE × ARO ALE = $250,000 × 0.25 ALE = $62,500Step 4: Compare ALE to the Cost of the Control
The expected annual loss (ALE) is $62,500. The cost of the proposed control is $70,000 per year.Since the cost of the control ($70,000) is greater than the expected annual loss ($62,500), implementing the solution is not financially justifiable. From a purely financial perspective, the best response is to accept the risk.
Why A, C, and D are Incorrect
- A) Mitigate the risk: This is the most tempting distractor. Mitigation is only justified if the cost of the control is less than the benefit it provides (the reduction in ALE). Here, it costs more to fix the problem than the problem is expected to cost annually.
- C) Transfer the risk: Transferring the risk (e.g., buying insurance) is a valid response, but the scenario does not provide enough information to assess its cost-effectiveness compared to acceptance. Based on the numbers provided, acceptance is the clear choice.
- D) Avoid the risk: Risk avoidance is an extreme measure reserved for risks that are catastrophic or cannot be managed effectively. Shutting down a primary business function is rarely the correct answer on the CRISC exam.
If you struggle with these calculations, VoraPrep's adaptive engine will serve you more questions on SLE/ARO/ALE math until you master it. You can even ask Vory, your 24/7 personal tutor, for a step-by-step breakdown of any calculation.
Question 4
Which of the following is the PRIMARY output of the risk evaluation process?
Why C is Correct
The correct answer is C) A prioritized list of risks for response. The CRISC exam demands you know the sequence and purpose of each stage. Risk evaluation follows risk analysis. In analysis, you determine the level of risk (e.g., calculate ALE or assign a qualitative score). In evaluation, you compare that level against the organization's risk appetite and criteria to decide which risks matter most to business objectives. The primary output is a ranked list that tells management which risks require immediate attention.Why A, B, and D are Incorrect
- A) A list of threats and vulnerabilities: This is an output of the risk identification process.
- B) The ALE: This is an output of the quantitative risk analysis process.
- D) A catalog of existing controls: This is an input to the risk assessment process, as it helps determine the current state of risk.
Question 5
A risk analyst is using a risk matrix to plot risks based on likelihood and impact. This is an example of what type of risk analysis?
Why C is Correct
The correct answer is C) Qualitative. Qualitative risk analysis uses descriptive scales and categories to evaluate risk. A risk matrix, which typically uses terms like "High," "Medium," and "Low" or numerical scales (e.g., 1-5) for likelihood and impact, is the quintessential tool for qualitative analysis. It is used when precise financial data is unavailable or when a quick screening of risks is needed.This table summarizes the key differences, a frequent source of exam questions.
| Feature | Qualitative Risk Analysis | Quantitative Risk Analysis |
|---|---|---|
| Data Type | Subjective, descriptive (High, Med, Low) | Objective, numerical ($, %) |
| Primary Tool | Risk Matrix, Heat Map | SLE/ALE Calculation, Monte Carlo Simulation |
| When to Use | When data is unreliable or unavailable; for initial screening | When reliable historical data exists; for cost-benefit analysis |
| Output | Prioritized list of risks | Monetary value of risk (ALE) |
Why A, B, and D are Incorrect
- A) Quantitative analysis: This requires objective, numerical data to calculate a specific financial impact, like ALE.
- B) and D) Deterministic and Heuristic: While these are analysis-related terms, they are not the standard ISACA classifications for this type of risk analysis. The core distinction tested on the CRISC exam is between qualitative and quantitative.
You can find a more detailed breakdown in our complete guide to CRISC Domain 2 concepts.
Calculate Your CRISC Score & Study Hours by Domain
Adjust your practice scores across official CRISC blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Should You Interpret Your Score?
Evaluate your performance by looking for a pattern in your mistakes, not just the raw score.
- 4-5 Correct: You have a strong grasp of Domain 2 concepts. Your next step is to refine your understanding of the nuances, like the cost-benefit analysis of controls and the specific inputs and outputs of each process step. Are you ready for a full-length challenge? Try our 2026 Free CRISC Practice Exam.
- 2-3 Correct: You know the key terms but may struggle to apply them correctly in a scenario. Did you mix up threat and vulnerability? Did you choose a control that was not cost-effective? This is a common stage where targeted practice is most effective. Drill down into the specific areas where you were uncertain.
- 0-1 Correct: This indicates a need to review the fundamentals of Domain 2. The most effective path forward is to solidify your understanding of core concepts before attempting more questions. Start by reviewing ISACA's definitions for risk, threat, and vulnerability, then focus on the difference between qualitative and quantitative analysis.
Regardless of your score, the goal is to actively address your weak areas.
How to Master CRISC Domain 2 with VoraPrep
If you found yourself guessing on these questions, that is a signal. The real CRISC exam has 150 questions designed to find those same areas of uncertainty. Reading a textbook or watching lectures is not enough; you need to train your brain to think like the exam writers.
VoraPrep is a complete, 6-pillar interactive course built for this purpose.
- Adaptive Practice Bank: With over 1,800+ exam-calibrated questions, our adaptive engine learns your weak spots. If you struggle with SLE/ALE calculations, it intelligently serves you more of those questions until the concept is mastered.
- Detailed Rationales: Every question comes with a clear explanation of why the right answer is right and, just as importantly, why the tempting distractors are wrong. This is where real learning occurs.
- Vory, Your 24/7 Personal Tutor: Confused by a concept? Just ask Vory. Our integrated tutor provides Socratic, step-by-step coaching inside any lesson or question, 24/7.
- Complete Textbook-Grade Lessons: VoraPrep's interactive lessons are designed to be more engaging and effective than passive video-lecture bundles that cost thousands of dollars.
- 1:1 Exam Simulators: Our timed mock exams replicate the real Prometric testing environment, helping you build the stamina and time management skills needed for exam day.
- Personalized Study Plan: Provide your exam date, and we will build a dynamic study plan that tells you exactly what to do each day to be ready in time.
Build the judgment required to pass, don't just memorize facts. See our full CRISC exam details and format breakdown to learn more.