I85PREP
⌘ K
IT Risk Fundamentals study materials
IT Risk Fundamentals study resources

IT Risk Fundamentals practice questions

One question at a time. Build your IT Risk Fundamentals understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IT Risk Fundamentals

In IT risk management, what does the term 'risk appetite' describe?

  1. The list of vulnerabilities identified during a penetration test
  2. The amount and type of risk an organization is willing to accept in pursuit of its objectives Correct answer.
  3. The maximum downtime a system can tolerate before operations halt
  4. The annual budget allocated to security tooling

Explanation

Risk appetite is a governance-level statement of how much and what kind of risk the organization chooses to pursue or retain to meet its objectives. It is set by leadership and guides decisions about which risks to treat, transfer, or accept.

Question 2IT Risk Fundamentals

A team calculates risk by multiplying the likelihood of a threat event by the magnitude of its impact. Which concept does this product represent?

  1. Residual risk
  2. Control effectiveness
  3. Risk exposure Correct answer.
  4. Inherent risk

Explanation

Risk exposure (or risk score) is commonly expressed as likelihood times impact before or after controls are considered. It quantifies the potential loss associated with a given risk scenario.

Question 3IT Risk Fundamentals

After implementing a new firewall rule set, analysts reassess a threat scenario and find the likelihood dropped from high to low. What is the remaining risk called?

  1. Threat likelihood
  2. Inherent risk
  3. Risk appetite
  4. Residual risk Correct answer.

Explanation

Residual risk is the level of risk that remains after controls have been applied and their effect assessed. The drop from high to low likelihood reflects the control's mitigating effect.

Question 4IT Risk Fundamentals

Which risk response involves purchasing cyber insurance to shift financial consequences to a third party?

  1. Risk transfer Correct answer.
  2. Risk acceptance
  3. Risk mitigation
  4. Risk avoidance

Explanation

Risk transfer shifts the financial impact of a risk to another party, commonly through insurance or contractual arrangements. The organization still owns the operational risk but reduces its financial exposure.

Question 5IT Risk Fundamentals

What is the primary purpose of a risk register?

  1. To record user access requests and approvals
  2. To store system backups for disaster recovery
  3. To list all software licenses held by the organization
  4. To document identified risks along with owners, ratings, and treatment status Correct answer.

Explanation

A risk register is the central record of identified risks, capturing attributes such as owner, likelihood, impact, rating, and treatment plan. It supports tracking and reporting of risk over time.

Question 6IT Risk Fundamentals

Which term describes a weakness in a system or process that a threat could exploit?

  1. Control
  2. Threat
  3. Vulnerability Correct answer.
  4. Impact

Explanation

A vulnerability is a weakness or gap that a threat actor or event could exploit to cause harm. It is distinct from the threat itself, which is the potential source of harm.

Question 7IT Risk Fundamentals

An organization decides to stop offering a legacy service because the associated risk cannot be reduced to an acceptable level. Which risk response has been chosen?

  1. Transfer
  2. Mitigation
  3. Avoidance Correct answer.
  4. Acceptance

Explanation

Risk avoidance eliminates the activity or asset that generates the risk, removing the exposure entirely. Discontinuing the service is a classic avoidance decision.

Question 8IT Risk Fundamentals

Which statement best defines a threat in IT risk terms?

  1. Any potential cause of an unwanted incident that could harm assets Correct answer.
  2. A policy that prohibits sharing credentials
  3. The monetary loss from a data breach
  4. A missing patch on a production server

Explanation

A threat is any potential source of harm, such as an attacker, malware, or natural event, that could exploit a vulnerability. It is distinct from the weakness it exploits and from the resulting loss.

Question 9IT Risk Fundamentals

A risk assessment rates a risk as high because both likelihood and impact are high. Which action is most consistent with risk treatment principles?

  1. Reclassify it as low to align with budget constraints
  2. Remove it from the register to reduce reporting overhead
  3. Ignore the risk until an incident occurs
  4. Prioritize the risk for control implementation and assign an owner Correct answer.

Explanation

High-rated risks should be prioritized for treatment and assigned a clear owner accountable for reducing or managing them. This ensures resources target the most significant exposures.

Question 10IT Risk Fundamentals

In a qualitative risk assessment, which pair of factors is most commonly used to determine a risk rating?

  1. Likelihood and impact Correct answer.
  2. Patch count and uptime
  3. Headcount and revenue
  4. Asset cost and depreciation schedule

Explanation

Qualitative assessments typically combine likelihood (or probability) with impact (or consequence) using a defined scale to produce a risk rating. This allows comparison and prioritization without precise financial figures.

Question 11IT Risk Fundamentals

An analyst documents that a web server has an unpatched remote code execution flaw reachable from the internet. In the risk formula, what does this flaw represent?

  1. The threat
  2. The impact
  3. The likelihood
  4. The vulnerability Correct answer.

Explanation

The unpatched flaw is a vulnerability: a weakness that a threat could exploit. The internet-facing attacker would be the threat, and the resulting damage would be the impact.

Question 12IT Risk Fundamentals

Which activity best describes risk monitoring?

  1. Continuously tracking risk indicators and reassessing risks as conditions change Correct answer.
  2. Deleting risks that were previously accepted
  3. Purchasing insurance to cover potential losses
  4. Performing a one-time assessment at project initiation

Explanation

Risk monitoring is an ongoing process of tracking key risk indicators, reviewing treatment progress, and reassessing risks as the environment changes. It keeps the risk picture current rather than static.

Question 13IT Risk Fundamentals

A company sets a rule that any risk rated critical must be reported to the board within 48 hours. What does this rule represent?

  1. A change management procedure
  2. A business continuity objective
  3. A risk tolerance threshold triggering escalation Correct answer.
  4. A vulnerability disclosure policy

Explanation

A defined risk level that triggers mandatory escalation reflects a risk tolerance threshold: the boundary beyond which action and reporting are required. It operationalizes governance expectations for high-risk events.

Question 14IT Risk Fundamentals

Which of the following best distinguishes inherent risk from residual risk?

  1. Inherent risk includes controls; residual risk excludes them
  2. Inherent risk is qualitative; residual risk is always quantitative
  3. Inherent risk applies only to financial systems; residual risk applies to all systems
  4. Inherent risk is assessed before controls; residual risk is assessed after controls Correct answer.

Explanation

Inherent risk is the exposure that exists before considering existing controls, while residual risk reflects the exposure remaining once controls are applied and evaluated. The distinction helps determine whether further treatment is needed.

Question 15IT Risk Fundamentals

A team decides to accept a medium risk because the cost of the control exceeds the potential loss. Which condition makes this acceptance defensible?

  1. The risk is removed from the register to avoid audit questions
  2. The decision is documented and approved by an authorized risk owner Correct answer.
  3. The control is deferred indefinitely without review
  4. The team assumes the threat will never occur

Explanation

Risk acceptance is defensible when it is an informed, documented decision made by the accountable risk owner within their authority. This preserves accountability and supports later review.

Question 16IT Risk Fundamentals

Which metric is most useful as a key risk indicator for an unpatched software exposure?

  1. Average help desk ticket resolution time
  2. Percentage of critical systems missing required patches within SLA Correct answer.
  3. Number of employees trained on phishing
  4. Total number of servers in the data center

Explanation

A key risk indicator should measure exposure relevant to a specific risk and be trackable over time. The percentage of critical systems out of patch compliance directly reflects the unpatched software risk.

Question 17IT Risk Fundamentals

In a risk matrix, a risk with low likelihood but catastrophic impact typically requires which treatment consideration?

  1. Contingency planning and possibly transfer, since impact is severe Correct answer.
  2. Routine acceptance with no further action
  3. Dismissal because likelihood is low
  4. Immediate removal from the risk register

Explanation

Low-likelihood, high-impact risks warrant attention because a single event could be devastating. Organizations often prepare contingency plans and consider transfer options such as insurance to manage the severe consequence.

Question 18IT Risk Fundamentals

What role does a risk owner play in IT risk management?

  1. They are accountable for managing a specific risk and its treatment decisions Correct answer.
  2. They perform all technical vulnerability scans personally
  3. They approve the organization's annual financial statements
  4. They write operating system patches for affected systems

Explanation

A risk owner is the individual accountable for a specific risk, including approving treatment decisions and monitoring its status. Ownership ensures clear accountability rather than diffuse responsibility.

Question 19IT Risk Fundamentals

An organization completes a business impact analysis and identifies that a payment system can be down for at most four hours. What does this four-hour figure represent?

  1. The maximum tolerable downtime Correct answer.
  2. The recovery point objective
  3. The control maturity level
  4. The risk appetite statement

Explanation

Maximum tolerable downtime is the longest period a business process can be unavailable before unacceptable consequences occur. It drives recovery time objectives for supporting systems.

Question 20IT Risk Fundamentals

Which statement best explains why risk assessments should be repeated periodically rather than performed once?

  1. A single assessment always underestimates risk
  2. Repeating assessments eliminates the need for controls
  3. Threats, vulnerabilities, and business conditions change over time, altering exposure Correct answer.
  4. Regulations require daily reassessment of every asset

Explanation

Exposure evolves as new threats emerge, systems change, and business priorities shift, so periodic reassessment keeps ratings accurate. It also validates whether prior treatments remain effective.

Question 21IT Risk Fundamentals

A supplier agreement requires the vendor to maintain security controls and allows audits. Which risk response does this contractual arrangement primarily support?

  1. Risk elimination
  2. Risk transfer or sharing through third-party obligations Correct answer.
  3. Risk avoidance
  4. Risk acceptance

Explanation

Contractual clauses that impose security obligations and audit rights on a supplier share or transfer part of the risk to the third party. The organization retains oversight but reduces its standalone exposure.

Question 22IT Risk Fundamentals

An analyst finds two risks with identical risk scores, but one is supported by historical incident data and the other by expert judgment alone. How should this affect prioritization?

  1. Discard the expert-judgment risk as invalid
  2. Prioritize the risk with stronger evidence, since confidence in the estimate differs Correct answer.
  3. Reduce the score of the data-backed risk
  4. Treat both identically because the scores match

Explanation

Risk scores carry different levels of confidence depending on the evidence behind them. A data-backed estimate is more reliable, so prioritization should account for confidence as well as the raw score.

Question 23IT Risk Fundamentals

Which situation best illustrates control risk in an IT environment?

  1. A threat actor is identified in a threat intelligence feed
  2. A preventive control fails to operate, allowing an undetected breach Correct answer.
  3. A firewall blocks unauthorized traffic as designed
  4. A risk owner approves a treatment plan

Explanation

Control risk is the risk that a control does not operate effectively or as intended, leaving exposure unaddressed. A failed preventive control that permits an undetected breach is a direct example.

Question 24IT Risk Fundamentals

A quantitative risk analysis estimates annualized loss expectancy. Which combination of factors produces this value?

  1. Asset value divided by control cost
  2. Single loss expectancy multiplied by annualized rate of occurrence Correct answer.
  3. Likelihood squared plus impact
  4. Threat count minus vulnerability count

Explanation

Annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence. It expresses expected yearly financial loss and supports cost-benefit decisions on controls.

Question 25IT Risk Fundamentals

An organization adopts a risk treatment plan, but the residual risk still exceeds its tolerance threshold. What is the most appropriate next step?

  1. Close the risk as fully mitigated
  2. Lower the tolerance threshold to match the residual risk
  3. Ignore the gap because a plan exists
  4. Escalate for additional treatment or formal acceptance by senior authority Correct answer.

Explanation

When residual risk remains above tolerance, the gap must be escalated for further treatment or formally accepted by an authority empowered to do so. Closing it as mitigated would misrepresent the exposure.

Question 26IT Risk Fundamentals

Which term describes the possible occurrence of an event that could harm IT assets, expressed as a combination of likelihood and consequence?

  1. Risk Correct answer.
  2. Vulnerability
  3. Control
  4. Asset

Explanation

Risk expresses the chance and consequence of an event that could harm assets, so it combines likelihood with impact. Controls, assets, and vulnerabilities are different concepts used inside the risk equation rather than the equation itself.

Question 27IT Risk Fundamentals

Which element of the risk equation is represented by an organized criminal group that targets payment card data?

  1. Impact
  2. Vulnerability
  3. Control
  4. Threat Correct answer.

Explanation

A threat is any actor or circumstance with the potential to cause harm, and an organized criminal group seeking card data fits that definition. Vulnerability, impact, and control describe weaknesses, consequences, and safeguards rather than the actor.

Question 28IT Risk Fundamentals

What is the primary purpose of performing a risk assessment in an IT environment?

  1. To prove that no security incidents have occurred during the audit period
  2. To identify, analyze, and evaluate risks so treatment decisions can be prioritized Correct answer.
  3. To document every software license installed on the corporate network
  4. To replace the need for security controls with periodic reporting

Explanation

Risk assessment identifies risks, analyzes their likelihood and impact, and evaluates them against criteria so that treatment can be prioritized. It informs control decisions but does not replace controls, prove absence of incidents, or inventory licenses.

Question 29IT Risk Fundamentals

An organization chooses to purchase cyber insurance to cover losses from a data breach. Which risk response does this represent?

  1. Avoidance
  2. Acceptance
  3. Mitigation
  4. Transfer Correct answer.

Explanation

Transfer shifts the financial consequence of a risk to another party, and insurance is the classic example. Avoidance removes the activity, mitigation reduces likelihood or impact directly, and acceptance retains the risk without such a shift.

Question 30IT Risk Fundamentals

Which document typically records the agreed risk response, the responsible person, and the target completion date for a specific risk?

  1. Service level agreement
  2. Risk register entry Correct answer.
  3. Configuration baseline
  4. Business continuity plan

Explanation

A risk register tracks each risk together with its rating, owner, chosen response, and due dates so progress can be monitored. Continuity plans, baselines, and service level agreements serve other purposes and do not normally hold treatment decisions.

Question 31IT Risk Fundamentals

Which statement best describes risk appetite?

  1. The total number of risks recorded in the risk register
  2. The amount and type of risk an organization is willing to pursue or retain Correct answer.
  3. The maximum loss that a single control failure can cause
  4. The frequency with which risk assessments are repeated

Explanation

Risk appetite expresses how much risk the organization is willing to pursue or retain in pursuit of its objectives. It is a decision-making boundary, not a count of risks, a control failure limit, or an assessment schedule.

Question 32IT Risk Fundamentals

Which factor most directly increases the likelihood component of an IT risk?

  1. A recent upgrade of the payroll application
  2. A longer backup retention period
  3. A known exploitable weakness reachable from the internet Correct answer.
  4. A larger budget for the security team

Explanation

Likelihood rises when a weakness is exposed and exploitable, because the path from threat to asset becomes realistic. Backup retention, security budget, and application upgrades do not by themselves create an exposure path.

Question 33IT Risk Fundamentals

Which statement correctly describes a key control characteristic in IT risk management?

  1. A control is only relevant when a risk has already materialized
  2. A control should be designed to reduce likelihood, impact, or both Correct answer.
  3. A control must always be automated to be considered effective
  4. A control guarantees that the associated risk is eliminated

Explanation

Controls work by lowering the probability of an event, limiting its consequences, or both, and their effect is reflected in residual risk. Controls reduce rather than guarantee elimination, operate before incidents, and may be manual or automated.

Question 34IT Risk Fundamentals

A risk analyst is estimating how often a specific threat event is expected to occur over one year. Which measure is being calculated?

  1. Exposure factor
  2. Residual risk score
  3. Annualized rate of occurrence Correct answer.
  4. Single loss expectancy

Explanation

Annualized rate of occurrence estimates the expected frequency of an event within a year. Single loss expectancy is a per-event loss amount, exposure factor is the proportion of an asset lost, and residual risk is what remains after controls.

Question 35IT Risk Fundamentals

An analyst calculates that a server room flood would destroy 40 percent of the value of equipment worth 500,000. What is the single loss expectancy?

  1. 40,000
  2. 1,250,000
  3. 200,000 Correct answer.
  4. 500,000

Explanation

Single loss expectancy equals asset value multiplied by the exposure factor, so 500,000 times 0.40 gives 200,000. The other figures either misplace the decimal, repeat the asset value, or divide instead of multiply.

Question 36IT Risk Fundamentals

A risk has been assessed and the organization decides to continue the activity while monitoring the risk because it falls within tolerance. Which response has been chosen?

  1. Avoidance
  2. Acceptance Correct answer.
  3. Mitigation
  4. Transfer

Explanation

Acceptance means the organization retains the risk knowingly because it sits within appetite and is monitored. Avoidance would end the activity, transfer would shift the financial consequence, and mitigation would add controls to reduce it.

Question 37IT Risk Fundamentals

What is the main distinction between a qualitative and a quantitative risk assessment?

  1. Qualitative applies only to physical assets, while quantitative applies only to software
  2. Qualitative uses descriptive scales, while quantitative uses numeric monetary estimates Correct answer.
  3. Qualitative is performed once, while quantitative is performed continuously
  4. Qualitative requires insurance data, while quantitative requires audit logs

Explanation

Qualitative assessment rates risk using descriptive scales such as high, medium, and low, whereas quantitative assessment expresses risk in numeric terms such as expected monetary loss. The other options misstate the scope and data requirements of the two approaches.

Question 38IT Risk Fundamentals

Which practice best supports consistent comparison of risks across different business units?

  1. Scoring risks only when an incident has already occurred
  2. Ranking risks by the seniority of the person who reported them
  3. Allowing each unit to invent its own rating terminology
  4. Applying a common risk scoring scale and defined impact criteria Correct answer.

Explanation

A shared scoring scale with defined impact and likelihood criteria lets ratings from different units be compared and aggregated. Unit-specific terminology, incident-only scoring, and reporter seniority all undermine comparability.

Question 39IT Risk Fundamentals

A risk owner is accountable for a risk but lacks the authority to approve the required spending. What is the most appropriate action?

  1. Record the risk as accepted and close the register entry
  2. Delegate the risk to a third party without informing management
  3. Escalate the decision to the level that holds the needed authority Correct answer.
  4. Lower the risk rating so that approval is no longer required

Explanation

Accountability must be matched with authority, so a risk owner who cannot approve the needed resources escalates to the appropriate decision-making level. Closing the entry, unannounced delegation, or manipulating the rating would conceal rather than resolve the gap.

Question 40IT Risk Fundamentals

Which indicator would be most useful for monitoring whether vulnerability management risk is improving over time?

  1. Total count of servers in the data center
  2. Median time to remediate critical vulnerabilities Correct answer.
  3. Number of employees who completed phishing training
  4. Annual cost of the security awareness program

Explanation

Remediation time for critical vulnerabilities directly tracks how quickly exposure is reduced, making it a meaningful trend indicator. Training completion, server counts, and awareness spending do not measure vulnerability exposure or its reduction.

Question 41IT Risk Fundamentals

During a risk assessment, an analyst must decide whether a risk is above or below the organization's tolerance. Which criteria are being applied?

  1. Vendor payment terms
  2. Risk evaluation criteria Correct answer.
  3. Asset depreciation schedules
  4. Network throughput thresholds

Explanation

Risk evaluation compares analyzed risk against defined criteria such as tolerance thresholds to decide whether treatment is required. Depreciation, throughput, and payment terms are unrelated operational or financial parameters.

Question 42IT Risk Fundamentals

An organization maps how a phishing email could lead to credential theft and then to unauthorized fund transfers. Which technique is being used?

  1. Scenario analysis Correct answer.
  2. Asset inventory reconciliation
  3. Control self-assessment
  4. Capacity planning

Explanation

Scenario analysis traces a plausible chain of events from an initiating threat through intermediate steps to business consequences. Inventory reconciliation, control self-assessment, and capacity planning address different questions and do not model event chains.

Question 43IT Risk Fundamentals

Why should risk treatment decisions be documented together with their rationale?

  1. To eliminate the need for management approval
  2. To guarantee that the chosen controls will never fail
  3. To provide an auditable basis for decisions and support later review Correct answer.
  4. To satisfy licensing requirements for installed software

Explanation

Documenting the decision and its rationale creates an audit trail and lets future reviewers understand and revisit the choice as conditions change. It cannot guarantee control effectiveness, address software licensing, or remove approval requirements.

Question 44IT Risk Fundamentals

A business process depends on a single supplier with no tested alternative. Which risk characteristic does this represent?

  1. Inherent risk
  2. Detection risk
  3. Concentration risk Correct answer.
  4. Residual risk

Explanation

Concentration risk arises when dependence is focused on a single provider or system, so one failure affects the whole process. Residual risk is what remains after controls, detection risk concerns failure to detect, and inherent risk is the level before controls.

Question 45IT Risk Fundamentals

An organization sets a maximum tolerable downtime of four hours for a payment service. Which activity determined this limit?

  1. Configuration audit
  2. Penetration testing
  3. Business impact analysis Correct answer.
  4. Threat modeling

Explanation

A business impact analysis determines how long a process can be unavailable before consequences become unacceptable, producing recovery objectives. Penetration testing, configuration audits, and threat modeling examine weaknesses rather than business tolerance for downtime.

Question 46IT Risk Fundamentals

An attacker exploits a flaw that was known internally for months but never remediated. Which risk factor most directly explains the resulting loss?

  1. A change in the financial reporting calendar
  2. A reduction in the marketing budget
  3. An increase in the number of user accounts
  4. A weakness left unaddressed despite being known Correct answer.

Explanation

The loss stems from an unmitigated weakness that the threat could exploit, which is the vulnerability component of risk. Account counts, reporting calendars, and marketing budgets do not create the exploitable condition described.

Question 47IT Risk Fundamentals

Two vendors present similar breach scenarios, but one contract includes indemnification and breach notification obligations. How does this affect the organization's risk position?

  1. It removes the need for any internal security controls
  2. It converts the risk into an opportunity
  3. It eliminates the reputational impact of a breach
  4. It shifts some financial and notification responsibility to the vendor Correct answer.

Explanation

Contractual indemnification and notification duties transfer part of the financial and procedural burden to the vendor, which is a transfer response. They do not remove internal control duties, erase reputational harm, or turn the exposure into an opportunity.

Question 48IT Risk Fundamentals

A control is found to operate as designed, yet the residual risk remains above tolerance. What does this most likely indicate?

  1. The control is being applied inconsistently
  2. The control's design does not sufficiently address the risk Correct answer.
  3. The risk assessment criteria are too strict
  4. The risk owner has not approved the control

Explanation

If a control works as intended but risk still exceeds tolerance, the design itself is inadequate for the risk magnitude and needs strengthening or a different response. Inconsistent operation would be an operating effectiveness problem, and the other options do not follow from the stated facts.

Question 49IT Risk Fundamentals

An organization must choose between two treatments with similar cost. One reduces likelihood, the other reduces impact. Which consideration is most relevant to the choice?

  1. Which option has the shorter contract term
  2. Which option was recommended by the vendor
  3. Which option requires fewer staff to implement
  4. Whether the priority is preventing the event or containing its consequences Correct answer.

Explanation

The choice between likelihood and impact reduction depends on whether the organization most needs to prevent occurrence or to limit damage when it occurs. Staffing, vendor recommendation, and contract length are secondary factors that do not address the risk objective.

Question 50IT Risk Fundamentals

A risk register shows that a previously high risk has fallen to low after remediation, but the underlying threat has not changed. Which explanation is most plausible?

  1. The register was consolidated with another system's risks
  2. The vulnerability was reduced, lowering the likelihood of exploitation Correct answer.
  3. The risk owner was reassigned to another department
  4. The impact estimate was deliberately inflated earlier

Explanation

With the threat unchanged, a lower rating after remediation points to reduced vulnerability, which lowers likelihood. Inflated estimates, owner reassignment, and register consolidation do not describe an actual change in the risk condition.