18 free ISACA IT Risk Fundamentals practice questions from the CertStash pack of 72, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 18 free here, all 72 in the pack, and each step includes the one before it.
Get all 72 questions (US$39) · Download the first 10 as a PDF
Question 1
Which of the following is the MAIN reason to conduct a penetration test?
Show answer and explanation
Correct answer: A. To validate the results of a vulnerability assessment
Penetration testing is a practical validation technique that confirms whether vulnerabilities identified in a vulnerability assessment can actually be exploited in a real-world scenario. While vulnerability assessments identify potential weaknesses, penetration testing proves their actual exploitability and validates the assessment results through simulated attacks.
Why the other options are wrong
- B. Control self-assessments are internal evaluations of control design and operating effectiveness; penetration tests don't directly validate these assessments.
- C. Threat assessments identify potential threat sources and scenarios; penetration tests validate vulnerabilities rather than threats themselves.
Question 2
Which of the following is the PRIMARY concern with vulnerability assessments?
Show answer and explanation
Correct answer: B. False positives
False positives are the primary concern in vulnerability assessments because they consume significant resources during remediation efforts, create unnecessary alert fatigue, and can lead to wasted security spending on non-existent or low-risk vulnerabilities. Automated scanning tools frequently generate false positives, requiring manual verification and analysis.
Why the other options are wrong
- A. Report size is a documentation issue, not a primary technical or operational concern.
- C. Threat mitigation is an objective following assessment, not a primary concern during the assessment itself.
Question 3
Which of the following is the BEST way to minimize potential attack vectors on the enterprise network?
Show answer and explanation
Correct answer: B. Disable any unneeded ports.
Disabling unneeded ports directly eliminates potential entry points for attackers by reducing the attack surface. This is a foundational hardening practice that removes unnecessary services and network interfaces, preventing exploitation of ports that serve no business purpose.
Why the other options are wrong
- A. Annual awareness training educates users but does not directly minimize technical attack vectors on the network infrastructure.
- C. Network log monitoring detects and responds to attacks after they occur but does not prevent or minimize attack vectors themselves.
Question 4
Which of the following is the PRIMARY objective of vulnerability assessments?
Show answer and explanation
Correct answer: B. To improve the knowledge of deficient control conditions within IT systems
The primary objective of vulnerability assessments is to identify and document deficiencies in control conditions and security posture within IT systems. This knowledge of weaknesses forms the foundation for prioritization and remediation planning.
Why the other options are wrong
- A. Determining the best course of action based on threat and impact is risk analysis and decision-making that follows assessment results, not the assessment's primary objective.
- C. Reducing effort in identification is an efficiency consideration, not the primary objective of assessments.
Question 5
Which of the following is a potential risk associated with IT hardware or devices?
Show answer and explanation
Correct answer: B. Lack of interoperability
Lack of interoperability is a typical risk tied to IT hardware and devices, where equipment from different vendors or generations cannot work together, disrupting operations or forcing costly replacement. It arises from the devices themselves rather than from software or network activity.
Why the other options are wrong
- A. Loss of source code is a software and intellectual property risk, not a hardware or device risk.
- C. A sniffing attack is a network threat that intercepts data in transit, not a risk inherent to the hardware or devices.
Question 6
Publishing I&T risk-related policies and procedures BEST enables an enterprise to:
Show answer and explanation
Correct answer: C. set the overall expectations for risk management.
Publishing risk-related policies and procedures establishes the foundational framework and organizational expectations for how risk management should be conducted enterprise-wide. While compliance and accountability are important outcomes, the primary enabling function of publishing these policies is to set clear, organization-wide expectations that guide all stakeholders on risk management requirements and expectations.
Why the other options are wrong
- A. Compliance is a result of following policies, not the primary enablement function of publishing them.
- B. Accountability follows from established policies but is not what publishing policies primarily enables.
Question 7
Which of the following is MOST important when defining an organization’s risk scope?
Show answer and explanation
Correct answer: A. Understanding the impacts of the risk environment to the organization
Understanding the impacts of the risk environment to the organization is the most important factor when defining risk scope because it ensures the scope is tailored to what actually matters to the enterprise. A risk scope must be grounded in how external and internal risk factors affect organizational objectives and operations; without this understanding, the scope may be misaligned with organizational priorities.
Why the other options are wrong
- B. A top-down approach is a methodology for implementing risk management but does not define the scope itself.
- C. Risk reporting requirements are derived from scope definition, not foundational to defining it.
Question 8
Which of the following is the PRIMARY outcome of a risk scoping activity?
Show answer and explanation
Correct answer: C. Identification of potential high-impact risk areas throughout the enterprise
The primary outcome of risk scoping is the identification of potential high-impact risk areas throughout the enterprise. Risk scoping establishes the boundaries and focus areas for risk management activities by pinpointing where significant risks exist across the organization, which guides subsequent detailed risk assessment efforts.
Why the other options are wrong
- A. Emerging technology risks are a specific subset of risks that may be identified, not the primary outcome of scoping.
- B. Competitive benchmarking is not a primary outcome of risk scoping activities focused on identifying organizational risk areas.
Question 9
When determining the criticality of I&T assets, it is MOST important to identify:
Show answer and explanation
Correct answer: B. the business processes in which the asset is used to achieve objectives.
When determining asset criticality, identifying the business processes in which the asset is used to achieve objectives is most important because criticality is fundamentally about impact on business operations. An asset's criticality is measured by its role in enabling critical business processes; without understanding this connection, criticality assessments lack business context and relevance.
Why the other options are wrong
- A. Asset owners and valuation are relevant but secondary to understanding functional business criticality.
- C. Infrastructure details about processing and storage are technical characteristics rather than measures of business criticality.
Question 10
Which of the following represents a vulnerability associated with legacy systems using older technology?
Show answer and explanation
Correct answer: B. Inability to patch or apply system updates
The inability to patch or apply system updates represents a vulnerability because unpatched systems cannot be protected against known exploits and emerging threats. This is a direct security vulnerability that leaves legacy systems exposed to attack. Rising maintenance costs and missed technology opportunities are challenges but are not themselves vulnerabilities in the security sense.
Why the other options are wrong
- A. Rising maintenance costs are an economic challenge, not a vulnerability.
- C. Lost opportunity for emerging technologies is a strategic consideration, not a vulnerability.
What people say about the full IT Risk Fundamentals pack 5.0 from 1
The IT Risk Fundamentals exam seemed tough initially, but with the study materials, I was able to cover all the core concepts. I felt confident during the exam and passed without issues.
Question 11
Which of the following is an example of an inductive method to gather information?
Show answer and explanation
Correct answer: C. Penetration testing
Penetration testing is an inductive method because it gathers specific observations from actual system testing and builds general conclusions about security posture from those concrete findings. Controls gap analysis and vulnerability analysis are deductive methods that apply predetermined frameworks or known vulnerability catalogs to assess systems.
Why the other options are wrong
- A. Controls gap analysis is a deductive method that applies a predefined control framework to identify gaps.
- B. Vulnerability analysis is a deductive method that applies known vulnerability classifications to identify weaknesses.
Question 12
Which of the following is the BEST indication of a good risk culture?
Show answer and explanation
Correct answer: C. The enterprise learns from negative outcomes and treats the root cause.
A mature risk culture is evidenced by an organization's ability to learn from failures and address root causes rather than symptoms. This demonstrates genuine commitment to continuous improvement, psychological safety to report problems, and systemic thinking about risk. Organizations that treat negative outcomes as learning opportunities build trust and resilience.
Why the other options are wrong
- A. Merely emphasizing positive and negative elements of risk does not demonstrate action or cultural depth; acknowledgment alone is insufficient.
- B. Discussing risk facts within risk functions is important but is limited in scope; true culture requires learning and remediation across the entire enterprise.
Question 13
Which of the following risk analysis methods gathers different types of potential risk ideas to be validated and ranked by an individual or small groups during interviews?
Show answer and explanation
Correct answer: A. Delphi technique
The Delphi technique systematically gathers different types of potential risk ideas from multiple experts, then validates and ranks them through structured rounds of feedback and refinement. Experts provide input independently, reducing groupthink, and consensus emerges through iterations. This method is designed specifically for collecting diverse risk ideas and building toward validation and prioritization.
Why the other options are wrong
- B. Monte Carlo analysis is a quantitative simulation method used to model risk outcomes and probability distributions, not to gather and validate qualitative risk ideas.
- C. Brainstorming is an open, unstructured group technique for generating ideas; it does not include the systematic validation and ranking process that the Delphi technique provides.
Question 14
A bottom-up approach to developing I&T risk-related risk scenarios:
Show answer and explanation
Correct answer: B. is based on hypothetical situations envisioned by people performing specific I&T functions. should
A bottom-up approach to developing I&T risk scenarios is based on hypothetical situations envisioned by people performing specific I&T functions. This approach leverages the detailed knowledge and experience of practitioners working in specific IT roles who understand operational risks from their ground-level perspective. It is not a generic method for anyone, and it should be used in conjunction with top-down approaches for comprehensive coverage.
Why the other options are wrong
- A. Bottom-up is not generic; it specifically relies on expertise of people in particular IT functions.
- C. Bottom-up should be combined with top-down approaches, not used in isolation.
Question 15
Which of the following BEST supports a risk-aware culture within an enterprise?
Show answer and explanation
Correct answer: C. Risk is identified, documented, and discussed to make business decisions.
A risk-aware culture is built on transparency, open discussion, and integration of risk thinking into business decision-making. When risk is systematically identified, documented, and discussed as a normal part of strategic and operational planning, it demonstrates that the organization values informed decision-making and collective responsibility for managing uncertainty.
Why the other options are wrong
- A. Limiting risk discussion to departments isolates knowledge and prevents enterprise-wide learning; transparency across functions is essential to risk culture.
- B. Centralizing all risk activities in one function creates a siloed approach and reduces accountability across the business; culture requires distributed ownership.
Question 16
A risk practitioner has been tasked with analyzing new risk events added to the risk register. Which of the following analysis methods would BEST enable the risk practitioner to minimize ambiguity and subjectivity?
Show answer and explanation
Correct answer: A. Annual loss expectancy (ALE)
Annual loss expectancy (ALE) minimizes ambiguity and subjectivity by using quantitative, formulaic approaches: ALE = Single Loss Expectancy × Annualized Rate of Occurrence. This mathematical method produces consistent, repeatable results based on defined inputs, removing personal judgment from the analysis. The Delphi method and brainstorming both rely on expert opinion and group consensus, which introduce subjectivity.
Why the other options are wrong
- B. The Delphi method uses expert consensus and iterative feedback, which relies on subjective judgment and opinion rather than objective calculation.
- C. Brainstorming is an open-ended, creative technique that deliberately encourages subjective ideas and does not minimize ambiguity in risk quantification.
Question 17
How does an enterprise decide how much risk it is willing to take to meet its business objectives?
Show answer and explanation
Correct answer: B. By identifying the risk conditions of the business and the impact of the loss if these risks materialize
An enterprise determines how much risk to accept by understanding its business environment, identifying which risks exist, what would happen if they materialize, and what losses would result. This analysis of risk conditions and impact informs the decision about acceptable risk levels aligned with business objectives. Industry benchmarks and operational surveys alone lack the enterprise-specific context needed for sound appetite decisions.
Why the other options are wrong
- A. Industry standards provide context but do not account for an enterprise's unique strategic position, financial capacity, or objectives.
- C. Surveying what risks would stop operations identifies critical risks but does not directly establish how much risk the enterprise is willing to take overall.
Question 18
Of the following, which stakeholder group is MOST often responsible for risk governance?
Show answer and explanation
Correct answer: A. Board of directors
The Board of Directors holds ultimate governance responsibility within an enterprise and is accountable for setting the tone and strategic direction of risk management. While ERM functions and business units execute risk activities, governance authority, the oversight and accountability for risk management itself, rests with the Board.
Why the other options are wrong
- B. ERM typically manages and coordinates risk activities but does not hold governance authority; it reports to and supports the Board.
- C. Business units own and manage operational risks within their domains but do not set enterprise-wide governance policy.
That was 18 of 72.
The full ISACA IT Risk Fundamentals pack has all 72 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 36 free as one PDF by email. Get the Half Pack →