CGRC Risk Assessment and Management — Questions and Answers

Question 1: Which risk assessment methodology uses probability and impact ratings to calculate a risk score?

Delphi technique
Qualitative risk assessment
Quantitative risk assessment
Semi-quantitative risk assessment (Correct answer)

Correct answer: Semi-quantitative risk assessment

Semi-quantitative risk assessment combines numerical scales for probability and impact to produce a risk score without requiring precise monetary values.

Question 2: A company identifies that a vendor handling PII could be breached. This scenario best represents which risk concept?

Residual risk
Inherent risk
Third-party risk (Correct answer)
Aggregate risk

Correct answer: Third-party risk

Third-party risk refers to the potential for harm arising from a vendor, supplier, or partner relationship where sensitive data or processes are involved.

Question 3: In NIST SP 800-30, which step immediately follows risk identification?

Risk monitoring
Risk framing
Risk analysis (Correct answer)
Risk response

Correct answer: Risk analysis

NIST SP 800-30 defines the risk management process as: framing, assessing (identify then analyze), responding, and monitoring — so analysis follows identification.

Question 4: An organization determines that the cost of a control exceeds the potential loss it would prevent. The BEST action is to:

Transfer the risk to a third party
Accept the residual risk (Correct answer)
Implement the control anyway for compliance
Eliminate the underlying threat

Correct answer: Accept the residual risk

When control costs exceed potential losses, accepting the residual risk is the rational response based on cost-benefit analysis.

Question 5: Which of the following BEST describes the concept of risk appetite?

The maximum risk an organization can withstand before insolvency
The total risk exposure before controls are applied
The amount of risk an organization is willing to accept in pursuit of objectives (Correct answer)
The residual risk after all controls have been implemented

Correct answer: The amount of risk an organization is willing to accept in pursuit of objectives

Risk appetite is the broad-based amount of risk an organization is willing to accept in pursuit of its mission and strategic goals.

Question 6: When conducting a Business Impact Analysis (BIA), which metric defines the maximum tolerable downtime before significant harm occurs?

Recovery Point Objective (RPO)
Mean Time to Repair (MTTR)
Maximum Tolerable Downtime (MTD) (Correct answer)
Recovery Time Objective (RTO)

Correct answer: Maximum Tolerable Downtime (MTD)

MTD (also called Maximum Tolerable Period of Disruption) is the longest time a business function can be unavailable before causing unacceptable consequences.

Question 7: A risk register entry shows a threat with HIGH likelihood but LOW impact. How should this risk typically be prioritized?

Highest priority — high likelihood demands immediate mitigation
Medium priority — monitor and apply cost-effective controls (Correct answer)
Lowest priority — low impact means the risk can be ignored
Transfer immediately to an insurer

Correct answer: Medium priority — monitor and apply cost-effective controls

High likelihood / low impact risks warrant medium priority: they occur often but don't cause severe harm, so cost-effective monitoring and controls are appropriate.

Question 8: Which quantitative risk metric represents the expected monetary loss from a specific threat occurring once?

Annualized Loss Expectancy (ALE)
Single Loss Expectancy (SLE) (Correct answer)
Exposure Factor (EF)
Annualized Rate of Occurrence (ARO)

Correct answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor, representing the dollar loss expected from a single threat event.

Question 9: An organization uses insurance to shift financial exposure from a cyberattack to a third party. This is an example of:

Risk avoidance
Risk mitigation
Risk transfer (Correct answer)
Risk acceptance

Correct answer: Risk transfer

Risk transfer shifts the financial consequence of a risk to another party, most commonly through insurance or contractual indemnification.

Question 10: In ISO 31000, which component provides the mandate and commitment for risk management?

Risk communication and consultation
Risk treatment
Establishing the context
Principles and framework (Correct answer)

Correct answer: Principles and framework

ISO 31000 structures risk management into Principles, Framework, and Process — the framework provides the mandate and commitment from leadership.

Question 11: A CGRC professional performing a risk assessment notices that two separate low-level risks, when combined, create a high-impact exposure. This is best described as:

Compound risk
Aggregate risk (Correct answer)
Cascading risk
Residual risk

Correct answer: Aggregate risk

Aggregate risk refers to the combined effect of multiple individual risks that together create a larger overall exposure than each risk alone would suggest.

Question 12: Which control type is BEST suited to reduce the likelihood of a threat exploiting a vulnerability?

Detective control
Corrective control
Compensating control
Preventive control (Correct answer)

Correct answer: Preventive control

Preventive controls reduce the likelihood that a threat will successfully exploit a vulnerability by blocking or discouraging the threat.

Question 13: During risk treatment, an organization decides to stop offering a high-risk product line to eliminate exposure. This strategy is:

Risk transfer
Risk mitigation
Risk avoidance (Correct answer)
Risk acceptance

Correct answer: Risk avoidance

Risk avoidance means eliminating the activity or condition that gives rise to the risk entirely, removing exposure rather than managing it.

Question 14: Which of the following BEST describes a vulnerability in the context of risk assessment?

A potential event that could cause harm to an asset
A weakness that could be exploited by a threat (Correct answer)
The likelihood that a threat will occur in a given period
The financial impact resulting from a successful attack

Correct answer: A weakness that could be exploited by a threat

A vulnerability is a weakness or gap in protection that a threat could exploit to cause harm to an asset.

Question 15: An Annualized Loss Expectancy (ALE) is calculated as:

Asset Value × Annualized Rate of Occurrence
Single Loss Expectancy ÷ Annualized Rate of Occurrence
Single Loss Expectancy × Annualized Rate of Occurrence (Correct answer)
Exposure Factor × Annualized Rate of Occurrence

Correct answer: Single Loss Expectancy × Annualized Rate of Occurrence

ALE = SLE × ARO; it represents the expected annual monetary loss from a specific threat given how often that threat is expected to occur.

Question 16: Which risk assessment approach is MOST appropriate when precise data is unavailable but expert judgment can be gathered?

Quantitative Monte Carlo simulation
Qualitative risk assessment (Correct answer)
Fault tree analysis
Failure Mode and Effects Analysis (FMEA)

Correct answer: Qualitative risk assessment

Qualitative risk assessment uses expert judgment and descriptive scales (High/Medium/Low) when hard data is unavailable or cost-prohibitive to gather.

Question 17: A risk owner is PRIMARILY responsible for:

Documenting every risk in the enterprise risk register
Accepting, mitigating, or transferring risks within their area (Correct answer)
Auditing the effectiveness of controls across the organization
Setting the organization's overall risk appetite

Correct answer: Accepting, mitigating, or transferring risks within their area

A risk owner is accountable for managing a specific risk, including deciding on treatment options within their domain and monitoring outcomes.

Question 18: Which of the following BEST distinguishes risk tolerance from risk appetite?

Risk tolerance is set by regulators; risk appetite is set internally
Risk appetite is the strategic willingness to accept risk; risk tolerance is the acceptable variance around that level (Correct answer)
Risk tolerance is broader and applies enterprise-wide; risk appetite applies to individual projects
They are interchangeable terms in modern GRC frameworks

Correct answer: Risk appetite is the strategic willingness to accept risk; risk tolerance is the acceptable variance around that level

Risk appetite is the overall desired level of risk, while risk tolerance defines the acceptable deviation above or below that appetite in practice.

Question 19: An organization performs a threat analysis and finds that employees are the most frequent source of incidents. This category of threat source is called:

Environmental threat
Structural threat
Accidental threat
Insider threat (Correct answer)

Correct answer: Insider threat

Insider threats originate from current or former employees, contractors, or business partners who misuse authorized access, whether maliciously or accidentally.

Question 20: In the context of CGRC, a risk heat map is PRIMARILY used to:

Calculate precise financial losses from each identified risk
Visually communicate risk likelihood and impact to stakeholders (Correct answer)
Document the technical details of every vulnerability
Assign legal liability for risk events to specific departments

Correct answer: Visually communicate risk likelihood and impact to stakeholders

A risk heat map provides a visual matrix of risks plotted by likelihood and impact, making it easy for stakeholders to prioritize and communicate risk posture.

Question 21: Which statement BEST describes residual risk?

The risk that exists before any controls are implemented
The risk that remains after all planned risk treatment measures have been applied (Correct answer)
The risk transferred to an insurance provider
The risk identified during an audit but not yet assigned to an owner

Correct answer: The risk that remains after all planned risk treatment measures have been applied

Residual risk is what remains after controls and other risk treatments have been applied; it is the risk an organization accepts going forward.

CGRC Risk Assessment and Management

Which risk assessment methodology uses probability and impact ratings to calculate a risk score?

🃏 CGRC Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CGRC Study Guide →

What Practice Test Geeks adds beyond an AI chat for CGRC

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length CGRC mock exam — 125 questions in 180 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed CGRC question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable CGRC cheat sheet you can print or save as a PDF.
CGRC flashcards built from the same question bank.

Start the Timed CGRC Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Test delivery, eligibility, passing score, time limit, renewal, score validity, score release, fees, exam information · verified Nov 2026