Free CIS-RC sample questions with answers
Try these 10 free Risk and Compliance practice questions covering policy and compliance, entities, risk management and issues. Choose your answer, then check it to see an explanation for every option.
These questions are original and written from the official exam blueprint. They are not real exam questions. The full course has 209 questions in 5 timed exams.
New to this exam? Read the CIS Risk and Compliance (CIS-RC) Study Guide: IRM Blueprint, Key Topics and Study Plan first.
- Question 1 of 10Policy and ComplianceSingle answer
Show answer & explanations
Correct answer: C
- A. IssueIssues track findings that need remediation.
- B. Risk statementRisk statements describe potential risks in the risk library.
- C. Authority documentCorrect. Authority documents store external regulations, standards and frameworks.
- D. PolicyPolicies are the organization's internal rules.
Explanation: Authority documents are broken into citations, which can be mapped to your policy statements to show how internal controls cover external requirements.
- Question 2 of 10Policy and ComplianceSingle answer
Show answer & explanations
Correct answer: C
- A. EntitiesEntities are the things being governed, like business units or applications.
- B. IndicatorsIndicators monitor controls or risks.
- C. CitationsCorrect. Citations are the specific requirements within an authority document.
- D. ControlsControls are generated for entities from policy statements.
Explanation: Mapping citations to policy statements creates traceability from regulation to control.
- Question 3 of 10Policy and ComplianceSingle answer
Show answer & explanations
Correct answer: B
- A. They are imported from authority documents automaticallyAuthority documents provide citations; controls come from policy statements.
- B. They are generated from policy statements (control objectives) for each entity in scopeCorrect. A control is the instance of a policy statement for a specific entity.
- C. They are created by closing issuesIssues track remediation; they don't create controls.
- D. They are created manually on each CIManual creation per CI doesn't scale and bypasses the library.
Explanation: Library-driven generation keeps controls consistent across entities and makes changes to the library easy to roll out.
- Question 4 of 10EntitiesSingle answer
Show answer & explanations
Correct answer: D
- A. Entity classEntity classes categorize entities; they do not generate them.
- B. Authority documentHolds external regulations.
- C. Risk frameworkOrganizes risk statements.
- D. Entity typeCorrect. Entity types define a table and a filter; matching records become entities.
Explanation: Entity types keep the scope of governance in sync with the underlying data, so new matching records become entities automatically.
- Question 5 of 10Risk ManagementSingle answer
Show answer & explanations
Correct answer: A
- A. Risk statementCorrect. Risks are instances of risk statements for specific entities.
- B. CitationCitations belong to authority documents.
- C. Policy exceptionUsed to request a temporary exemption from a control.
- D. Indicator templateUsed to create indicators.
Explanation: As with controls, risks are generated from the library so that each entity is assessed consistently.
- Question 6 of 10Risk ManagementSingle answer
Show answer & explanations
Correct answer: A
- A. The risk that remains after considering the effectiveness of existing controlsCorrect. Residual risk reflects exposure after mitigation.
- B. The maximum risk the organization is willing to acceptThat is closer to risk appetite or tolerance.
- C. The risk before any controls are consideredThat is inherent risk.
- D. The risk of the parent entityRisk rollup is a separate concept.
Explanation: Comparing inherent and residual risk shows how much value controls provide and where additional mitigation is needed.
- Question 7 of 10Continuous MonitoringSingle answer
Show answer & explanations
Correct answer: B
- A. Policy statementsLibrary definitions.
- B. IndicatorsCorrect. Indicators gather evidence automatically (e.g., from a query, script or analytics) and can fail a control.
- C. CitationsCitations are requirements, not monitoring.
- D. Entity classesCategorize entities.
Explanation: Continuous monitoring with indicators reduces the manual effort of attestations and provides objective evidence.
- Question 8 of 10Issue ManagementSingle answer
Show answer & explanations
Correct answer: B
- A. A new entityEntities are generated from entity types.
- B. An issueCorrect. Issues track the finding and its remediation.
- C. A risk statementRisk statements are library records.
- D. A new authority documentAuthority documents are regulations, not findings.
Explanation: Issues can have remediation tasks and link back to the control, giving auditors a full history.
- Question 9 of 10Policy and ComplianceSingle answer
Show answer & explanations
Correct answer: D
- A. Risk assessmentAssesses the likelihood and impact of risks.
- B. Entity scopingDefines which entities are governed.
- C. Citation mappingLinks regulations to policy statements.
- D. Control attestationCorrect. Attestations collect owner responses as evidence of compliance.
Explanation: Attestation responses update the control's status; non-compliant responses can create issues automatically.
- Question 10 of 10Policy and ComplianceSingle answer
Show answer & explanations
Correct answer: B
- A. Deletion of the controlRemoving controls hides the gap and breaks audit history.
- B. A policy exceptionCorrect. Policy exceptions document and approve a temporary deviation from a control.
- C. A new authority documentUnrelated to temporary deviations.
- D. A change to the entity type filterChanging scope to avoid a control is not appropriate.
Explanation: Exceptions keep the organization transparent about accepted risk, with an approval, justification and end date.
Your result
0 / 10