I85PREP
⌘ K
CORCM study materials
CORCM study resources

CORCM practice questions

One question at a time. Build your CORCM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance Fundamentals

Which term describes the acceptable level of risk an organization is willing to retain after controls are applied?

  1. Risk register
  2. Inherent risk
  3. Residual risk Correct answer.
  4. Risk appetite

Explanation

Residual risk is what remains after existing controls are applied. Inherent risk is the level before controls, and risk appetite is the amount of risk leadership is willing to accept.

Question 2Governance, Risk, and Compliance Fundamentals

A control that reduces the likelihood or impact of a threat before an event occurs is best classified as which type?

  1. Corrective
  2. Detective
  3. Compensating
  4. Preventive Correct answer.

Explanation

Preventive controls act before an event to stop or reduce it. Detective controls identify events after they happen, and corrective controls restore operations afterward.

Question 3Governance, Risk, and Compliance Fundamentals

Which document typically states the highest-level direction for how an organization manages information security?

  1. Procedure
  2. Security policy Correct answer.
  3. Standard
  4. Baseline

Explanation

A policy conveys management intent and mandatory high-level direction. Standards, baselines, and procedures provide progressively more specific implementation detail beneath the policy.

Question 4Governance, Risk, and Compliance Fundamentals

In risk assessment terminology, what does the term 'likelihood' represent?

  1. The cost of implementing a safeguard
  2. The time needed to recover from an outage
  3. The probability that a threat event will occur Correct answer.
  4. The number of assets affected by an incident

Explanation

Likelihood expresses the chance or probability that a threat will exploit a vulnerability. It is combined with impact to derive an overall risk rating.

Question 5Governance, Risk, and Compliance Fundamentals

Which role is ultimately accountable for establishing and endorsing an organization's risk management program?

  1. The IT help desk
  2. External regulators
  3. The internal audit function
  4. Senior executive leadership Correct answer.

Explanation

Senior leadership owns and endorses the risk management program and sets risk appetite. Other functions support or provide assurance but do not hold ultimate accountability.

Question 6Governance, Risk, and Compliance Fundamentals

What is the primary purpose of a business impact analysis (BIA)?

  1. To enumerate every software vulnerability on a network
  2. To test employee awareness of phishing
  3. To calculate the annual cost of insurance premiums
  4. To identify critical business functions and the consequences of their disruption Correct answer.

Explanation

A BIA determines which functions are critical and quantifies the operational and financial impact of their loss over time. Its outputs inform recovery priorities and continuity strategies.

Question 7Governance, Risk, and Compliance Fundamentals

Which principle holds that a user should be granted only the access necessary to perform their job?

  1. Least privilege Correct answer.
  2. Separation of duties
  3. Defense in depth
  4. Mandatory access control

Explanation

Least privilege limits access rights to the minimum required for authorized tasks. Separation of duties instead divides conflicting tasks among different people.

Question 8Governance, Risk, and Compliance Fundamentals

What does a risk register primarily provide?

  1. A list of approved software vendors
  2. A log of all network packets blocked by the firewall
  3. A schedule of employee performance reviews
  4. A structured record of identified risks, their ratings, and owners Correct answer.

Explanation

A risk register documents identified risks along with attributes such as likelihood, impact, owner, and treatment status. It is a central tracking tool for risk management.

Question 9Governance, Risk, and Compliance Fundamentals

An organization determines that a legacy system cannot be patched and decides to purchase cyber insurance to offset potential losses. Which risk treatment option does this represent?

  1. Risk acceptance
  2. Risk avoidance
  3. Risk transfer Correct answer.
  4. Risk mitigation

Explanation

Purchasing insurance shifts financial consequences to a third party, which is risk transfer. Avoidance would eliminate the activity, and mitigation would reduce exposure through controls.

Question 10Governance, Risk, and Compliance Fundamentals

A company requires two employees to jointly authorize wire transfers above a threshold. Which control concept does this illustrate?

  1. Least privilege
  2. Separation of duties Correct answer.
  3. Job rotation
  4. Privilege creep

Explanation

Separation of duties ensures no single individual can complete a sensitive transaction alone. Requiring two authorizers divides the transaction among distinct parties.

Question 11Governance, Risk, and Compliance Fundamentals

A risk is assessed with a likelihood of 4 on a 5-point scale and an impact of 5 on a 5-point scale. Using a simple multiplication risk matrix, what is the risk score?

  1. 20 Correct answer.
  2. 45
  3. 9
  4. 1

Explanation

A multiplicative risk matrix multiplies likelihood by impact, so 4 × 5 equals 20. The resulting score is then mapped to a qualitative rating band.

Question 12Governance, Risk, and Compliance Fundamentals

An organization classifies data and applies encryption to all data labeled 'confidential' both at rest and in transit. Which control category best describes this encryption requirement?

  1. Physical
  2. Technical Correct answer.
  3. Administrative
  4. Directive

Explanation

Encryption is a technical (logical) control implemented through technology. Administrative controls are policy and process based, and physical controls protect facilities.

Question 13Governance, Risk, and Compliance Fundamentals

A third-party vendor will process customer records. Which action best reflects due diligence before signing the contract?

  1. Skipping review because the data is stored in the cloud
  2. Delegating all security responsibility to the vendor
  3. Assuming the vendor is secure because it was the lowest bidder
  4. Assessing the vendor's security controls and requiring contractual security obligations Correct answer.

Explanation

Due diligence requires evaluating the vendor's safeguards and formalizing requirements in the contract. Accountability for data protection generally remains with the originating organization.

Question 14Governance, Risk, and Compliance Fundamentals

Which metric defines the maximum acceptable time a system may be unavailable before the impact becomes unacceptable?

  1. Recovery time objective (RTO) Correct answer.
  2. Recovery point objective (RPO)
  3. Service level agreement (SLA)
  4. Mean time between failures (MTBF)

Explanation

RTO sets the target duration for restoring a function after disruption. RPO instead defines the acceptable amount of data loss measured in time.

Question 15Governance, Risk, and Compliance Fundamentals

During an audit, a reviewer finds that terminated employees still have active directory accounts. Which control objective is most directly failing?

  1. Access deprovisioning Correct answer.
  2. Capacity management
  3. Change management
  4. Data classification

Explanation

Timely removal of access upon termination is a core deprovisioning control. Dormant accounts for former staff create unauthorized access risk.

Question 16Governance, Risk, and Compliance Fundamentals

An organization adopts a framework to structure its security program and then measures performance against defined targets. Which pair of activities does this describe?

  1. Encryption and hashing
  2. Governance and metrics Correct answer.
  3. Procurement and disposal
  4. Framing and budgeting

Explanation

Using a framework to direct and oversee the program is governance, while measuring against targets is performance metrics. Together they support continuous improvement.

Question 17Governance, Risk, and Compliance Fundamentals

Which statement best describes the relationship between a standard and a procedure?

  1. A standard defines mandatory requirements, while a procedure gives step-by-step instructions Correct answer.
  2. A procedure sets the risk appetite, while a standard records incidents
  3. A standard is optional guidance, while a procedure is mandatory
  4. A standard and a procedure are interchangeable terms

Explanation

Standards establish mandatory requirements that support policy, and procedures describe the specific steps to meet them. Procedures are more operational and detailed than standards.

Question 18Governance, Risk, and Compliance Fundamentals

A risk owner decides to accept a high residual risk without additional controls. What should governance require in this situation?

  1. Automatic escalation to law enforcement
  2. Formal documented approval by an authorized party Correct answer.
  3. Silent acceptance with no documentation
  4. Immediate deletion of the risk from the register

Explanation

Acceptance of significant risk should be an explicit, documented decision by someone with authority to accept it. This creates accountability and an auditable record.

Question 19Governance, Risk, and Compliance Fundamentals

Which activity is a detective control in an environment where users access a database?

  1. Applying role-based access restrictions
  2. Requiring multi-factor authentication
  3. Reviewing database audit logs for anomalous queries Correct answer.
  4. Encrypting the database at rest

Explanation

Reviewing audit logs discovers potentially malicious or anomalous activity after it occurs. The other options prevent or restrict access before an event.

Question 20Governance, Risk, and Compliance Fundamentals

An organization must comply with a regulation requiring breach notification within a set period. Which governance element most directly ensures this obligation is met?

  1. A list of approved hardware vendors
  2. A documented incident response plan with defined notification responsibilities and timelines Correct answer.
  3. A policy stating that breaches should be avoided
  4. An annual penetration test

Explanation

Compliance obligations are operationalized through documented plans that assign responsibilities and timelines. This makes the regulatory deadline actionable during an incident.

Question 21Governance, Risk, and Compliance Fundamentals

A company uses a heat map to plot risks by likelihood and impact. What is the primary limitation of this approach?

  1. It automatically eliminates the need for a risk register
  2. It requires real-time network telemetry
  3. It cannot display more than two risks at once
  4. It relies on subjective qualitative judgments that may vary between assessors Correct answer.

Explanation

Qualitative heat maps depend on subjective ratings, so different assessors may score the same risk differently. They are useful for communication but are not precise quantitative measures.

Question 22Governance, Risk, and Compliance Fundamentals

An organization has strong preventive controls but no logging or monitoring. Which governance weakness does this most clearly represent?

  1. Overinvestment in incident response
  2. Excessive reliance on detective capability
  3. Redundant separation of duties
  4. Insufficient assurance that preventive controls are working Correct answer.

Explanation

Without logging and monitoring, the organization lacks evidence that preventive controls function as intended. Detection and monitoring provide assurance and support accountability.

Question 23Governance, Risk, and Compliance Fundamentals

A regulator issues a new requirement that conflicts with an existing internal policy. What is the most appropriate governance response?

  1. Update the policy to align with the regulation and document the change Correct answer.
  2. Wait until the next scheduled audit to address it
  3. Ignore the regulation because internal policy takes precedence
  4. Apply the regulation only to new employees

Explanation

Legal and regulatory obligations generally take precedence, so policies should be revised to reflect them through a controlled change process. Documentation preserves an audit trail.

Question 24Governance, Risk, and Compliance Fundamentals

A risk assessment team rates a risk as low because existing controls are assumed effective, but those controls have never been tested. What is the most significant flaw in this conclusion?

  1. The residual rating relies on unverified control effectiveness Correct answer.
  2. The risk was documented in a register
  3. The assessment used a five-point scale
  4. The team included too many stakeholders

Explanation

Residual risk ratings are only as reliable as the evidence that controls operate effectively. Without testing, the assumed reduction may be overstated, leading to understated risk.

Question 25Governance, Risk, and Compliance Fundamentals

An organization wants to demonstrate that its security program is independently and objectively evaluated. Which function is best suited to provide this assurance?

  1. The IT operations team
  2. Internal audit Correct answer.
  3. The marketing department
  4. The software development team

Explanation

Internal audit provides independent, objective assurance and typically reports outside the functions it reviews. Operational teams assess their own work and lack the required independence.

Question 26Governance, Risk, and Compliance Fundamentals

Which term describes the potential for loss or harm resulting from a threat exploiting a vulnerability?

  1. Audit
  2. Compliance
  3. Risk Correct answer.
  4. Control

Explanation

Risk is defined as the potential for loss or harm that arises when a threat exploits a vulnerability. It combines the likelihood of an event and its impact. Controls are measures to mitigate risk, compliance is adherence to requirements, and audit is an independent examination.

Question 27Governance, Risk, and Compliance Fundamentals

Which document typically defines the high-level goals and intentions of an organization regarding information security?

  1. Guideline
  2. Procedure
  3. Policy Correct answer.
  4. Baseline

Explanation

A policy is a high-level statement of management intent that sets direction and principles. Procedures provide step-by-step instructions, guidelines are recommendations, and baselines define minimum security configurations.

Question 28Governance, Risk, and Compliance Fundamentals

An organization wants to reduce the likelihood of a risk event by implementing additional controls. Which risk treatment strategy does this describe?

  1. Risk mitigation Correct answer.
  2. Risk avoidance
  3. Risk transfer
  4. Risk acceptance

Explanation

Risk mitigation involves taking actions to reduce the likelihood or impact of a risk. Avoidance eliminates the activity, transfer shifts financial risk (e.g., insurance), and acceptance acknowledges the risk without action.

Question 29Governance, Risk, and Compliance Fundamentals

In a risk assessment, which factor is used to determine the potential severity of a risk event?

  1. Likelihood
  2. Impact Correct answer.
  3. Velocity
  4. Vulnerability

Explanation

Impact (or consequence) measures the severity of harm if the risk event occurs. Likelihood estimates probability, velocity describes speed of onset, and vulnerability is a weakness that can be exploited.

Question 30Governance, Risk, and Compliance Fundamentals

When selecting risk treatment options, what is the primary purpose of performing a cost-benefit analysis?

  1. To compare the organization's risk appetite with industry benchmarks
  2. To ensure the cost of a control does not exceed the expected loss it prevents Correct answer.
  3. To comply with regulatory requirements for financial reporting
  4. To determine the residual risk after controls are implemented

Explanation

A cost-benefit analysis compares the cost of implementing a control with the expected reduction in loss. It helps ensure that risk treatment is economically justified and aligns with the organization's objectives.

Question 31Risk Identification and Assessment

Which risk response strategy involves accepting the possibility of a risk event and budgeting for its potential cost rather than acting to prevent it?

  1. Risk transfer
  2. Risk mitigation
  3. Risk acceptance Correct answer.
  4. Risk avoidance

Explanation

Risk acceptance means acknowledging a risk and choosing to bear its consequences, often by setting aside contingency funds. Avoidance eliminates the activity, transfer shifts financial impact to a third party, and mitigation reduces likelihood or impact.

Question 32Risk Identification and Assessment

In a risk assessment, what does the term 'inherent risk' refer to?

  1. The risk of a control failing to operate
  2. The risk level before any controls or mitigations are considered Correct answer.
  3. The risk that management has formally accepted
  4. The risk remaining after controls are applied

Explanation

Inherent risk is the exposure that exists in the absence of any controls or mitigating actions. Residual risk is what remains once controls are in place, which is a distinct concept.

Question 33Risk Identification and Assessment

A firm's risk register typically records which of the following for each identified risk?

  1. The audit opinion from the prior year
  2. The likelihood, impact, owner, and response Correct answer.
  3. Only the financial statement line affected
  4. The names of all employees in the department

Explanation

A risk register captures core attributes such as likelihood, impact, an assigned risk owner, and the chosen response. These elements enable tracking and prioritization of risks over time.

Question 34Risk Identification and Assessment

Which of the following best describes a key risk indicator (KRI)?

  1. A list of all controls in a process
  2. A metric that signals rising exposure to a specific risk Correct answer.
  3. A financial ratio used only for budgeting
  4. A guarantee that a risk will not occur

Explanation

A KRI is a forward-looking metric designed to provide early warning that a risk exposure is increasing. It does not prevent the risk and is distinct from control inventories or budgeting ratios.

Question 35Risk Identification and Assessment

What is the primary purpose of performing a risk assessment?

  1. To replace the external audit function
  2. To assign blame for past losses
  3. To identify, analyze, and evaluate risks to inform decisions Correct answer.
  4. To eliminate the need for internal controls

Explanation

Risk assessment is the process of identifying risks, analyzing their likelihood and impact, and evaluating them against criteria to prioritize responses. It informs decision-making rather than removing the need for controls or audits.

Question 36Risk Identification and Assessment

Which risk category is most directly associated with a company's reliance on a single supplier for a critical component?

  1. Strategic risk
  2. Reputational risk
  3. Concentration risk Correct answer.
  4. Compliance risk

Explanation

Concentration risk arises when exposure is heavily dependent on a single counterparty, supplier, or source. Reliance on one supplier for a critical input is a classic concentration exposure.

Question 37Risk Identification and Assessment

In a risk matrix, a risk plotted in the high-likelihood and high-impact quadrant should generally be:

  1. Transferred only through insurance
  2. Prioritized for immediate treatment Correct answer.
  3. Ignored until it occurs
  4. Documented but left unaddressed

Explanation

Risks with both high likelihood and high impact represent the greatest exposure and should be prioritized for treatment. Deferring or ignoring them increases the chance of significant loss.

Question 38Risk Identification and Assessment

Which of the following is an example of an external risk source?

  1. Changes in government regulation Correct answer.
  2. Aging internal IT systems
  3. Inadequate employee training
  4. Poor internal communication

Explanation

External risk sources originate outside the organization, such as regulatory, market, or environmental changes. The other options describe internal weaknesses or process failures.

Question 39Risk Identification and Assessment

A risk owner's primary responsibility is to:

  1. Audit the risk management program annually
  2. Conduct external benchmarking
  3. Manage a specific risk and its response on an ongoing basis Correct answer.
  4. Approve the enterprise risk appetite statement

Explanation

A risk owner is accountable for monitoring and managing an assigned risk and ensuring its response is executed. Program-level oversight and appetite approval sit with governance bodies, not individual risk owners.

Question 40Risk Identification and Assessment

An organization estimates a risk has a 20% chance of occurring in a year and would cost $500,000 if it did. What is the expected loss for the year?

  1. $500,000
  2. $50,000
  3. $100,000 Correct answer.
  4. $250,000

Explanation

Expected loss equals probability multiplied by impact: 0.20 × $500,000 = $100,000. This quantifies the average annual exposure for comparison and prioritization.

Question 41Risk Identification and Assessment

Which technique is specifically designed to surface risks by gathering a panel of experts who independently provide estimates and then converge on a consensus?

  1. Delphi technique Correct answer.
  2. SWOT analysis
  3. Process mapping
  4. Root cause analysis

Explanation

The Delphi technique uses iterative, anonymous expert input to converge toward consensus on risk estimates. SWOT and process mapping are broader analytical tools, and root cause analysis investigates causes of incidents already observed.

Question 42Risk Identification and Assessment

A company decides to stop offering a product line because the legal liability exposure is unacceptable. Which risk response has it chosen?

  1. Transfer
  2. Mitigation
  3. Acceptance
  4. Avoidance Correct answer.

Explanation

Avoidance eliminates the risk by discontinuing the activity that generates it. Because the product line is removed entirely, the associated liability exposure is eliminated rather than reduced or shifted.

Question 43Risk Identification and Assessment

Which of the following best distinguishes qualitative from quantitative risk assessment?

  1. Both rely exclusively on historical loss data
  2. Qualitative uses numerical probabilities; quantitative uses descriptive scales
  3. Quantitative assessment cannot be used for prioritization
  4. Qualitative uses descriptive scales; quantitative uses numerical estimates Correct answer.

Explanation

Qualitative assessment ranks risks using descriptive categories such as high, medium, or low, while quantitative assessment assigns numerical values like probabilities and monetary impacts. Both approaches can support prioritization.

Question 44Risk Identification and Assessment

A heat map that plots risks by likelihood and impact is most useful for:

  1. Eliminating the need for a risk register
  2. Visually prioritizing risks for management attention Correct answer.
  3. Calculating the exact expected loss of each risk
  4. Replacing quantitative modeling entirely

Explanation

A heat map provides a visual ranking of risks so management can focus on the most significant exposures. It supports prioritization but does not yield precise loss figures or replace other tools.

Question 45Risk Identification and Assessment

Which of the following is the best example of a control that reduces the likelihood of a risk occurring?

  1. Purchasing insurance for property damage
  2. Holding contingency reserves
  3. Maintaining a disaster recovery site
  4. Requiring dual approval for large payments Correct answer.

Explanation

Dual approval is a preventive control that lowers the chance of unauthorized or erroneous payments. Insurance, recovery sites, and reserves are corrective or absorptive measures that address impact rather than likelihood.

Question 46Risk Identification and Assessment

Risk appetite is best defined as:

  1. The set of controls applied to a process
  2. The amount and type of risk an organization is willing to pursue or retain Correct answer.
  3. The sum of all identified risks in the register
  4. The maximum loss the organization has ever suffered

Explanation

Risk appetite expresses the level and nature of risk the organization is willing to accept in pursuit of its objectives. It is a forward-looking tolerance statement, not a historical loss figure or a control inventory.

Question 47Risk Identification and Assessment

An analyst rates a risk's impact as 'critical' and its likelihood as 'rare.' Using a typical five-by-five matrix, how should this risk generally be prioritized?

  1. Among the highest priorities because impact is critical Correct answer.
  2. Among the lowest priorities because likelihood is rare
  3. Ignored entirely because it is unlikely
  4. Automatically transferred to a third party

Explanation

Even with low likelihood, a critical impact can place a risk in an elevated or high-priority zone on a typical matrix, warranting attention. Prioritization weighs both dimensions rather than dismissing low-likelihood risks outright.

Question 48Risk Identification and Assessment

Which of the following scenarios best illustrates residual risk?

  1. A risk identified before any controls are designed
  2. A risk that has been fully eliminated
  3. The exposure that remains after existing controls are applied Correct answer.
  4. A risk that management has not yet documented

Explanation

Residual risk is the exposure left after controls are in place and operating. It is measured after considering the effect of existing safeguards.

Question 49Risk Identification and Assessment

A team wants to identify risks in a new loan-approval process by mapping each step and asking what could go wrong at each stage. Which technique are they using?

  1. Process-based risk identification Correct answer.
  2. Benchmarking
  3. Scenario analysis
  4. Capital modeling

Explanation

Process-based risk identification walks through each step of a workflow to surface where failures could occur. It is distinct from scenario analysis, benchmarking, and capital modeling.

Question 50Risk Identification and Assessment

Which of the following best describes a 'risk trigger'?

  1. A financial reserve set aside for losses
  2. A document listing all controls
  3. A condition or event that indicates a risk is occurring or about to occur Correct answer.
  4. A person accountable for a risk

Explanation

A risk trigger is an indicator or event that signals a risk is materializing or imminent, prompting a response. It is distinct from reserves, owners, and control inventories.