CRISC IT Risk Identification — 30 Questions

Question 1

An organization is developing its IT risk universe. Which of the following is the BEST source of information for identifying potential IT risks?

Accepted Answer

Threat intelligence feeds from ISACs. Threat intelligence feeds from Information Sharing and Analysis Centers (ISACs) provide sector-specific, timely, and actionable information about emerging threats, threat actors, and attack vectors relevant to the organization's industry. This makes them the best source for proactively identifying potential IT risks because they reflect the current threat landscape rather than past events. ISACs aggregate anonymized data from multiple organizations, giving a broader and more current view than internal sources alone.

Answer

Industry benchmarking reports

Answer

Results from the latest internal audit

Answer

Historical loss data from the finance department

Question 2

During a risk identification workshop, a risk owner proposes a scenario: 'A disgruntled employee with privileged access exfiltrates customer data to a competitor.' In the context of the ISACA risk scenario template, which element is missing if the scenario only includes the actor, threat type, event, and asset?

Accepted Answer

Timing and detection. The ISACA risk scenario template includes actor, threat type, event, asset, timing, detection, and consequence. The scenario provides the actor (disgruntled employee), threat type (privileged access misuse), event (data exfiltration), and asset (customer data), but it does not specify when the event occurs or how it is detected. Therefore, timing and detection are the missing elements.

Answer

Business impact

Answer

Consequence

Answer

Vulnerability

Question 3

A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?

Accepted Answer

Categorize the risks. After identification, risks should be categorized to enable proper analysis and response. Categorization helps in understanding the nature of each risk and assigning ownership.

Answer

Assign risk owners

Answer

Determine risk response

Answer

Assess the inherent risk level

Question 4

A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?

Accepted Answer

IAST (Interactive Application Security Testing). IAST instruments the running application and correlates runtime execution with source code, producing findings with context about actual reachability and data flow. This context lets teams prioritize vulnerabilities that are actually exploitable in the business context, cutting through the noise from SAST and DAST. IAST's runtime insight ties findings to real execution paths, making it the best fit for business-risk-based prioritization.

Answer

OWASP ZAP automated scanner

Answer

Manual penetration testing

Answer

CVE database search

Question 5

A security team is using the STRIDE threat modeling methodology for a new web application. Which threat type under STRIDE would be MOST relevant to a SQL injection vulnerability?

Accepted Answer

Tampering. SQL injection allows an attacker to tamper with data, violating integrity. STRIDE includes Tampering as the threat that involves unauthorized modification of data.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing

Question 6

An IT risk manager is categorizing risks identified during a recent assessment. Which TWO categories would include the risk of a system outage caused by a software bug?

Accepted Answer

Operational risk. Operational risk covers failures in internal processes, systems, and people, which directly includes a system outage caused by a software bug. Option D (Financial risk) is also correct because such an outage can produce direct financial losses through lost revenue, SLA penalties, recovery costs, and productivity downtime. Compliance risk (B) is not the primary category here since it concerns violations of laws, regulations, or standards, not the outage itself. Strategic risk (C) relates to failed business strategy or market positioning, and reputational risk (E) concerns damage to brand or public trust, neither of which is the direct categorization of a software-bug-induced outage.

Answer

Compliance risk

Answer

Strategic risk

Answer

Reputational risk

Question 7

A risk practitioner is developing a risk scenario for a data breach caused by an insider threat. Which of the following is the MOST realistic and complete risk scenario?

Accepted Answer

A disgruntled employee with excessive access privileges exfiltrates customer data to a competitor, resulting in a $2 million loss.. A realistic and complete risk scenario must include a credible threat actor, a specific vulnerability or condition, the threat event, and a meaningful business impact. Option A does this: a disgruntled employee (threat actor) with excessive access privileges (vulnerability) exfiltrates customer data to a competitor (event), resulting in a $2 million loss (impact). This aligns with CRISC's emphasis on scenario-based risk analysis.

Answer

A careless employee leaves a laptop unencrypted, leading to data loss, but no financial impact.

Answer

An external hacker uses stolen credentials to access the network and steal data, causing reputational damage.

Answer

A script kiddie launches a DDoS attack that disrupts service for 2 hours, causing no data loss.

Question 8

Which TWO of the following are examples of operational vulnerabilities that a risk practitioner might identify?

Accepted Answer

Insufficient security awareness training for employees. Operational vulnerabilities are weaknesses in day-to-day processes, procedures, and human controls rather than technical flaws in code or systems. Option A (Insufficient security awareness training for employees) is correct because it is a people-and-process weakness that enables social engineering and human error, which is a classic operational vulnerability a risk practitioner would flag. Option C (Lack of segregation of duties in financial systems) is correct because it is a control/process design weakness that allows one person to perform conflicting tasks, increasing fraud and error risk — an operational, not technical, vulnerability. Option B (Phishing emails targeting senior executives) is a threat event or attack technique, not a vulnerability, so it does not belong. Option D (SQL injection vulnerability in a web application) is a technical/software vulnerability in code, not an operational one. Option E (Unpatched software in the production environment) is a technical/patch-management vulnerability in the system configuration, not an operational process weakness.

Answer

Phishing emails targeting senior executives

Answer

SQL injection vulnerability in a web application

Answer

Unpatched software in the production environment

Question 9

A security analyst is using a threat modeling approach that focuses on identifying threats based on the system's requirements and design. Which threat modeling methodology is being used?

Accepted Answer

TRIKE. TRIKE is a threat modeling methodology that takes a risk-based, requirements-driven approach. It focuses on defining the system's security requirements and then identifying threats that could violate those requirements, making it distinct from other methodologies that are more design- or attacker-centric. This aligns with the question's emphasis on 'requirements and design' as the basis for threat identification.

Answer

STRIDE

Answer

VAST

Answer

PASTA

Question 10

An organization has identified a new vulnerability in its web application that could allow SQL injection attacks. Which of the following sources would MOST likely have been used to identify this vulnerability?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes application source code or bytecode without executing it, and is specifically designed to detect coding flaws such as unsanitized input leading to SQL injection. Because SQL injection is a code-level defect, SAST is the most likely source to identify it during development. It flags tainted data flows from user input to database queries.

Answer

CIS Benchmarks

Answer

NVD

Answer

DISA STIG

Question 11

Which of the following is the PRIMARY purpose of a risk register?

Accepted Answer

To document and manage identified risks throughout their lifecycle. The primary purpose of a risk register is to document identified risks and manage them throughout their lifecycle — including ownership, assessment, treatment plans, status, and review. It is the central repository that supports risk monitoring, reporting, and decision-making. While it can inform risk appetite and support reporting, those are secondary uses, not its primary purpose.

Answer

To calculate the organization's risk appetite

Answer

To report risks to regulatory authorities

Answer

To track the status of risk treatment plans

Question 12

A risk practitioner is using the ISACA risk scenario template to document a scenario. The template includes elements such as threat actor, threat type, event, asset/resource, timing, detection, and response. Which element describes the likelihood that the threat event will occur within a specific timeframe?

Accepted Answer

Timing. The ISACA risk scenario template defines 'timing' as the element that captures the likelihood of the threat event occurring within a specific timeframe. It addresses the probability dimension of risk, answering 'how likely is this event to happen and when?' This is distinct from other elements like threat type (nature of the threat) or detection/response (controls). Timing directly informs risk assessment by quantifying the frequency or probability component of risk.

Answer

Threat type

Answer

Response

Answer

Detection

Question 13

An organization is assessing risks related to a third-party cloud provider. Which of the following is the BEST source of threat intelligence for identifying threats targeting the cloud infrastructure?

Accepted Answer

ISACs. ISACs (Information Sharing and Analysis Centers) provide sector-specific threat intelligence and can share information about threats targeting cloud infrastructure relevant to the organization's industry.

Answer

Government advisories

Answer

OSINT

Answer

Commercial feeds

Question 14

A risk practitioner is updating the risk register and needs to categorize risks. Which TWO of the following are standard risk categories used in IT risk management?

Accepted Answer

Strategic. Option B (Strategic) is correct because strategic risk is a standard IT risk management category covering risks that affect an organization's ability to achieve its long-term goals, such as technology shifts, competitive pressures, or misaligned IT investments. Option E (Operational) is correct because operational risk is a recognized category encompassing risks from day-to-day processes, people, systems, and internal controls, including IT service failures, human error, and process breakdowns. These categories align with widely used frameworks such as COSO ERM and ISO 31000, which classify risks by strategic, operational, financial, and compliance/hazard domains. Option A (Budgetary) is not a standard top-level risk category; financial risk is the recognized category, and budgetary concerns are typically a subset of it. Option C (Technical) is not a standard risk category in IT risk management frameworks; technical issues are usually treated as sources or causes of operational or strategic risk rather than a distinct category. Option D (Environmental) is not a standard IT risk category; environmental risk is typically a subcategory of hazard or compliance risk, not a primary classification.

Answer

Budgetary

Answer

Technical

Answer

Environmental

Question 15

A project manager is identifying risks for a new software development project using Agile methodology. Which THREE threat modeling techniques are BEST suited for Agile/DevSecOps environments?

Accepted Answer

VAST. VAST (B) is correct because Visual, Agile, and Simple Threat modeling was explicitly designed to scale threat modeling across Agile and DevOps teams, integrating into CI/CD pipelines with automated, developer-friendly output. STRIDE (D) is correct because it is a lightweight, per-element technique (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) that maps well to iterative sprints and incremental design reviews. PASTA (E) is correct because Process for Attack Simulation and Threat Analysis is a risk-centric, seven-stage methodology that aligns business objectives with technical threats and fits the iterative, risk-driven nature of Agile delivery. TRIKE (A) is not marked correct because it is a risk-based, requirements-driven model better suited to formal waterfall-style analysis than rapid Agile iterations. Attack trees (C) are not marked correct because, while useful for decomposing specific attack goals, they are a general-purpose technique rather than an Agile/DevSecOps-oriented methodology and are typically more manual and less scalable in sprint cadence.

Answer

TRIKE

Answer

Attack trees

Question 16

A company's risk appetite statement specifies that the organization is willing to accept a moderate level of operational risk to achieve strategic agility. This statement directly influences which activity during IT risk identification?

Accepted Answer

Establishing risk tolerance thresholds for operational risk. Risk appetite guides which risks are acceptable and helps prioritize risk scenarios, influencing the scope of risk identification.

Answer

Defining the IT risk universe

Answer

Determining the risk capacity of the organization

Answer

Selecting threat intelligence sources

Question 17

Which of the following is a primary source of threat intelligence that provides real-time information about active cyber threats and indicators of compromise?

Accepted Answer

OSINT. OSINT (Open-Source Intelligence) is the correct answer because it encompasses publicly available information from diverse sources—such as social media, forums, threat feeds, and government advisories—that can provide real-time updates on active cyber threats and indicators of compromise (IOCs). Unlike static frameworks or databases, OSINT is continuously updated and can include timely data on emerging attacks, malware signatures, and attacker tactics. This makes it a primary source for real-time threat intelligence in risk management contexts.

Answer

OWASP Top 10

Answer

CIS Benchmarks

Answer

NVD

Question 18

A financial institution is identifying IT risks associated with a new mobile banking application. Which TWO threat modeling techniques are best suited for this scenario? (Select two.)

Accepted Answer

STRIDE. STRIDE (A) is correct because it is a structured, Microsoft-originated threat modeling methodology that systematically categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, which directly maps to the security concerns of a mobile banking application handling authentication, transactions, and sensitive financial data. PASTA (B) is correct because it is a risk-centric, attacker-oriented methodology (Process for Attack Simulation and Threat Analysis) that aligns business objectives with technical threats, making it well suited for a financial institution that must tie IT risks to business impact and regulatory concerns. VAST (C) is not among the selected answers because, while it is a scalable agile threat modeling framework, it is not one of the two techniques identified as best suited here. TRIKE (D) is not selected because it is a risk-based threat modeling framework focused on security and privacy requirements modeling, but it is not marked as correct for this scenario. OWASP Top 10 (E) is not selected because it is a awareness document listing common web application vulnerabilities rather than a threat modeling technique.

Answer

VAST

Answer

TRIKE

Answer

OWASP Top 10

Question 19

A risk manager is developing a risk scenario for a potential data breach involving a third-party cloud provider. According to the ISACA risk scenario template, which THREE elements must be included? (Select three.)

Accepted Answer

Asset/resource. According to the ISACA risk scenario template, a risk scenario must be built around three core elements: the asset/resource (A), which identifies what is at risk in the third-party cloud data breach; the threat actor (E), which specifies who or what could cause the breach; and the consequence (B), which describes the resulting business impact. These three components together define the scenario by linking the target, the source of the threat, and the outcome. Control effectiveness (C) is not a required element of the scenario itself; it is assessed separately when evaluating risk likelihood and impact. Risk owner (D) is also not part of the scenario template; it is assigned during risk response and accountability processes rather than scenario definition.

Answer

Control effectiveness

Answer

Risk owner

Question 20

Which threat modeling technique is specifically designed to be integrated into Agile and DevSecOps processes, providing a visual and simple approach?

Accepted Answer

VAST. VAST (Visual Agile and Simple Threat) is tailored for Agile and DevSecOps environments, emphasizing simplicity and visual representation.

Answer

TRIKE

Answer

PASTA

Answer

STRIDE