During a risk identification workshop, a risk owner proposes a scenario: 'A disgruntled employee with privileged access exfiltrates customer data to a competitor.' In the context of the ISACA risk scenario template, which element is missing if the scenario only includes the actor, threat type, event, and asset?
A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?
A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?
A security team is using the STRIDE threat modeling methodology for a new web application. Which threat type under STRIDE would be MOST relevant to a SQL injection vulnerability?
An IT risk manager is categorizing risks identified during a recent assessment. Which TWO categories would include the risk of a system outage caused by a software bug?
A risk practitioner is developing a risk scenario for a data breach caused by an insider threat. Which of the following is the MOST realistic and complete risk scenario?
A security analyst is using a threat modeling approach that focuses on identifying threats based on the system's requirements and design. Which threat modeling methodology is being used?
An organization has identified a new vulnerability in its web application that could allow SQL injection attacks. Which of the following sources would MOST likely have been used to identify this vulnerability?
A risk practitioner is using the ISACA risk scenario template to document a scenario. The template includes elements such as threat actor, threat type, event, asset/resource, timing, detection, and response. Which element describes the likelihood that the threat event will occur within a specific timeframe?
An organization is assessing risks related to a third-party cloud provider. Which of the following is the BEST source of threat intelligence for identifying threats targeting the cloud infrastructure?
A risk practitioner is updating the risk register and needs to categorize risks. Which TWO of the following are standard risk categories used in IT risk management?
A project manager is identifying risks for a new software development project using Agile methodology. Which THREE threat modeling techniques are BEST suited for Agile/DevSecOps environments?
A company's risk appetite statement specifies that the organization is willing to accept a moderate level of operational risk to achieve strategic agility. This statement directly influences which activity during IT risk identification?
Which of the following is a primary source of threat intelligence that provides real-time information about active cyber threats and indicators of compromise?
A financial institution is identifying IT risks associated with a new mobile banking application. Which TWO threat modeling techniques are best suited for this scenario? (Select two.)
A risk manager is developing a risk scenario for a potential data breach involving a third-party cloud provider. According to the ISACA risk scenario template, which THREE elements must be included? (Select three.)
An organization's risk register contains a scenario: 'A nation-state actor exploits an unpatched vulnerability in a public-facing web application, leading to data exfiltration of customer PII.' According to ISACA's risk scenario template, which element is MISSING from this description?
An organization is conducting a threat identification exercise using the STRIDE model. Which threat type would be MOST relevant when analyzing a banking application that allows fund transfers between accounts?
A risk practitioner is identifying vulnerabilities in an organization's IT environment. Which TWO of the following are examples of 'operational vulnerability identification'? (Choose two.)
A risk register is being created for a new ERP implementation project. Which TWO of the following risks should be included in the project's risk register? (Choose two.)
A financial institution uses threat intelligence from an Information Sharing and Analysis Center (ISAC). This is an example of which type of threat intelligence source?
A multinational corporation is developing a new e-commerce platform using microservices architecture. The security team is conducting a threat modeling exercise to identify potential application-level threats. Which TWO threat modeling methodologies are most appropriate for this DevSecOps environment?
An organization is updating its IT risk universe to include emerging threats. The CISO wants to ensure the risk register captures realistic risk scenarios. Which THREE components are essential for constructing a complete risk scenario according to ISACA's risk scenario template?
A financial services firm is assessing vulnerabilities in its web application. The team wants to identify application-level vulnerabilities that could be exploited. Which TWO vulnerability identification techniques should be prioritized for this purpose?
An organization is creating a risk register for its IT risk universe. The risk manager needs to categorize risks to align with the enterprise risk management framework. Which TWO risk categories are most commonly used in IT risk identification?
A critical infrastructure organization is enhancing its threat identification capabilities. The risk team wants to leverage threat intelligence sources to identify emerging threats. Which THREE sources are most relevant for obtaining actionable threat intelligence?
A risk analyst is reviewing the organization's risk register and notes that a risk related to a third-party cloud provider's data breach has been assigned an inherent risk level of high and a residual risk level of low. Which of the following BEST explains this difference?
A risk practitioner is reviewing the organization's asset inventory to support risk identification for a legacy order management system. The practitioner wants to distinguish between vulnerabilities that are inherent to the technology and those that are introduced by how the system is used or maintained. Which TWO of the following are examples of vulnerabilities introduced by how the system is used or maintained? (Choose two.)
A risk practitioner is facilitating a workshop to identify risks for a core banking modernization program. During the session, participants disagree about whether the legacy mainframe's end-of-support status constitutes a risk or an issue. Which of the following statements BEST clarifies the distinction for the workshop participants?
A manufacturing firm's risk practitioner is identifying risks for a legacy industrial control system that cannot be patched. Management asks which risk response is MOST appropriate given that the system must remain in production for another three years. Which of the following should the practitioner recommend?
A risk practitioner is conducting an IT risk identification workshop for a company migrating its customer relationship management platform to a public cloud provider. During the workshop, participants list several conditions that could expose the organization to loss. Which TWO of the following conditions qualify as IT risk events rather than controls, assets, or consequences? (Choose two.)
A company is adopting a DevSecOps approach and wants to conduct threat modeling early in the development lifecycle. Which threat modeling methodology is BEST suited for this environment due to its focus on agile and continuous integration?
An organization is categorizing IT risks. Which of the following risk categories would include the risk of regulatory fines due to non-compliance with data protection laws?
A multinational corporation uses commercial threat intelligence feeds and participates in an ISAC. However, they recently missed a critical vulnerability exploited in the wild that was not in their feeds. Which additional source should they incorporate to improve vulnerability identification?
A company is developing risk scenarios for business impact analysis. Which of the following scenario components directly links the risk event to potential financial loss?
An organization's board has set a risk appetite statement that says: 'We accept moderate levels of operational risk but will not tolerate any compliance violations.' During risk identification, which type of risk should be given the HIGHEST priority?
An organization is conducting a vulnerability assessment of its IT assets. Which of the following sources is MOST authoritative for identifying known software vulnerabilities?
A risk manager is developing risk scenarios to present to the board. Which TWO elements are essential for connecting a risk scenario to business impact?
A company is implementing a risk identification process for third-party risks. Which THREE factors should be considered when identifying risks from a critical software vendor?
During a risk assessment, the risk practitioner is identifying threats to an application. Which threat modeling technique is specifically designed to analyze application threats using categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
An organization has a risk appetite statement that says 'We accept up to $5 million in operational losses per year.' However, a new cloud migration project is estimated to have a potential operational loss of $8 million if a critical failure occurs. The risk capacity of the organization is $20 million. What should the risk practitioner recommend?
A risk practitioner is creating a risk scenario for a ransomware attack. Which of the following is the BEST sequence to describe the scenario using the ISACA risk scenarios template?
Which of the following is a threat intelligence source that provides information about known exploited vulnerabilities, maintained by a government agency?
During a vulnerability assessment, a risk practitioner identifies that a web application is vulnerable to SQL injection, which is listed in the OWASP Top 10. Which type of vulnerability identification technique MOST likely discovered this issue?
An organization has a risk register that includes risks related to regulatory compliance, such as GDPR and SOX. The risk practitioner is now categorizing these risks. Which risk category would BEST fit these compliance-related risks?
A risk practitioner is updating the risk register after a third-party security incident. Which of the following is the MOST important information to include in the risk register entry for this third-party risk?
A risk practitioner is developing risk scenarios for a new cloud service. Which THREE of the following elements should be included in a complete risk scenario?
During a risk assessment, the risk practitioner develops a scenario involving a disgruntled employee exfiltrating sensitive customer data through a USB drive. The organization has a strict policy against removable media but lacks technical controls to prevent USB usage. Which element of the risk scenario is the vulnerability?
An organization is implementing a new cloud-based customer relationship management (CRM) system. Which of the following risk categories would BEST describe the risk of the CRM system failing to meet performance expectations?
An organization's board has issued a risk appetite statement indicating that the company is willing to accept a moderate level of operational risk but has zero tolerance for compliance violations. This statement primarily defines which of the following?
When using STRIDE for threat modeling, which threat category involves an attacker gaining unauthorized access to a system by pretending to be a legitimate user?
A risk practitioner is connecting a risk scenario to business impact. The scenario involves a ransomware attack that encrypts critical financial systems, resulting in a two-week outage. Which of the following is the MOST appropriate business impact category?
An organization is assessing risks related to a new cloud-based CRM system. The risk team is developing a risk scenario. Which of the following is the BEST example of a complete risk scenario following the ISACA template?
In the context of threat modeling for a web application, which technique is specifically designed to be integrated into Agile and DevSecOps processes, emphasizing collaboration and visualization?
A bank is identifying IT risks and categorizes a potential data breach as both a compliance risk (due to GDPR) and a reputational risk. This is an example of:
During a threat modeling exercise using the STRIDE methodology, a security analyst identifies a threat where an attacker can modify data in transit between a web server and database. Which STRIDE category does this threat belong to?
An organization uses the CISA Known Exploited Vulnerabilities (KEV) catalog as a primary source for vulnerability identification. This catalog is BEST described as:
In developing a risk scenario, connecting a threat event to business impact is crucial. Which of the following is the BEST example of a properly connected risk scenario?
When performing asset-based vulnerability identification, a security analyst uses the Common Vulnerabilities and Exposures (CVE) database along with the National Vulnerability Database (NVD). Which of the following BEST describes the relationship between CVE and NVD?
During a risk identification workshop, the team identifies several vulnerabilities. Which TWO of the following are examples of operational vulnerability identification? (Select two.)
A risk practitioner is categorizing IT risks for a manufacturing company. Which of the following risks would be classified as an 'operational' IT risk?
A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?
A risk scenario is being developed for a phishing attack leading to credential theft. Using ISACA's risk scenario template, which component would describe the 'threat event'?
When developing IT risk scenarios, connecting them to business impact is critical. Which of the following BEST describes how a risk practitioner should link a technical scenario to business impact?
During risk identification, a risk manager is reviewing threat intelligence sources. Which THREE of the following are considered legitimate sources of threat intelligence? (Choose three.)
During a threat modeling exercise for a new web application, the team uses STRIDE. Which threat type under STRIDE corresponds to an attacker modifying data in transit?
A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?
A security analyst is reviewing CVE entries and NVD data to identify vulnerabilities in software assets. This activity is part of which vulnerability identification approach?
During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?
A risk practitioner at a healthcare payer is building the risk identification taxonomy for a new claims-processing platform. The CISO asks why the taxonomy must explicitly distinguish between a 'threat event' and a 'loss event' rather than treating both as 'risk' in the register. Which statement BEST justifies that distinction?
A risk practitioner is facilitating a risk identification workshop for a retail bank's new real-time payments service. Business stakeholders keep proposing controls such as multifactor authentication and transaction limits as 'risks.' Which action BEST keeps the identification phase technically sound?
A hospital's risk practitioner is building a risk register entry for a ransomware attack on its electronic health record (EHR) system. The practitioner wants to express the risk in terms of how often the event is expected to occur and how much it would cost if it did. Which of the following BEST describes the two components being quantified?
A risk practitioner at a payments processor is reviewing the organization's risk register and notices that several risk entries describe only the consequence, such as 'customer data is exposed.' The practitioner wants each entry to follow the ISACA risk scenario structure. Which of the following should the practitioner add to each entry to complete the scenario?
A risk practitioner at a regional hospital is building a risk register for its new electronic health record (EHR) system. The system stores protected health information (PHI) and is subject to HIPAA. The practitioner wants to ensure that the risk register captures the potential for unauthorized disclosure of PHI. Which of the following should the practitioner PRIMARILY use to identify the relevant threats and vulnerabilities for this system?
A risk practitioner is conducting an IT risk assessment for a retail bank's new mobile payment application. The threat landscape includes hacktivists, organized crime, and insiders. The practitioner needs to estimate the likelihood of a data breach. Which of the following factors is MOST important to consider when estimating likelihood?
A risk practitioner at a regional bank is compiling a list of internal threat sources for the enterprise risk assessment. Which TWO of the following are internal threat sources that should be included? (Choose two.)
A risk manager at a healthcare organization is identifying risks related to the use of Internet of Medical Things (IoMT) devices. The organization has a large number of legacy devices that cannot be patched. Which of the following is the MOST significant risk factor to consider when assessing the risk of a ransomware attack?
A financial services firm's risk practitioner is building a risk register entry for a customer-facing mobile banking application hosted in a public cloud. The application stores PII and processes payments. Management wants to understand the inherent risk before any controls are considered. Which of the following BEST represents the inherent risk of this asset?
A multinational bank is assessing the risk of a distributed denial-of-service (DDoS) attack on its online banking platform. The risk practitioner has identified that the platform is hosted in a single data center with no redundancy. Which of the following BEST describes the relationship between the threat, vulnerability, and risk in this scenario?
A retail bank is building a risk register for its newly deployed mobile payment API. The CISO asks the risk practitioner to classify the risk that attackers could manipulate the API request parameters to bypass transaction limits. Under which CRISC risk identification category should this risk PRIMARILY be recorded?
A mid-sized hospital is building its IT risk register. The risk practitioner wants to express the organization's tolerance for a ransomware event that would disrupt electronic health records for 24 hours. Which of the following BEST represents a structured way to document this tolerance?
A risk practitioner at a regional bank is building a threat landscape for its new mobile payment platform. A recently published report from a national CERT indicates that a loosely organized group has been targeting payment APIs across the region, exploiting known authentication weaknesses. The practitioner wants to determine whether this group should be treated as a relevant threat source in the risk register. Which of the following is the MOST appropriate FIRST step?
A risk practitioner is selecting a risk analysis technique for a new payment processing system. The team has limited historical loss data, wants to incorporate expert judgment, and needs to prioritize risks for management review. Which technique is MOST appropriate?
A risk practitioner is conducting a risk assessment for a new customer-facing mobile application. The practitioner wants to identify risks by examining how data flows between the mobile client, the API gateway, and the backend database. Which of the following techniques is being applied?
A risk practitioner at a regional bank is building a risk register entry for the loss of a critical core banking application. The head of IT operations insists on recording a single, point-in-time likelihood estimate of 15% derived from last year's incident log, and refuses to consider any range. Which CRISC-aligned principle should the practitioner apply to MOST appropriately represent this IT risk?
A risk practitioner at a healthcare insurer is identifying risks for a new telehealth platform. The platform integrates with a third-party video vendor, stores protected health information, and must comply with HIPAA. Which of the following is the MOST appropriate FIRST step in identifying IT risk for this platform?
A risk practitioner at a financial services firm is identifying IT risk scenarios for a new mobile banking application. The firm uses the ISACA risk scenario development approach. Which TWO of the following are essential components of a well-defined risk scenario? (Choose two.)
A risk practitioner is conducting a risk assessment for a new mobile application that will process credit card payments. The practitioner needs to identify relevant threats. Which of the following is the MOST appropriate source for identifying threats specific to this application?
A risk practitioner at a regional hospital is building a risk register entry for the loss of availability of its electronic health record (EHR) system. The practitioner wants to express the risk in a way that supports later quantification and treatment decisions. Which of the following BEST describes how the risk should be documented in the register?
A risk practitioner is facilitating a workshop to identify risks for a new customer data analytics platform. During the session, participants repeatedly describe how a competitor might copy the platform's features and how a regulator might question the platform's data retention practices. The practitioner wants to ensure the workshop produces structured risk statements rather than general concerns. Which of the following should the practitioner do NEXT?
A risk practitioner is mapping identified IT risks to the organization's risk taxonomy. A risk has been logged for 'unauthorized access to the HR system resulting from excessive user privileges.' Under which risk category should this be classified?
A hospital network is identifying IT risks for its newly deployed medical imaging archive. The risk practitioner wants to document risks in a way that links each risk to the business process it could disrupt. Which CRISC concept is the practitioner applying when connecting an IT risk to the business objective it threatens?
A risk practitioner is assessing the likelihood of a distributed denial-of-service (DDoS) attack against an online retailer's checkout service during peak shopping season. Which of the following factors would MOST increase the assessed likelihood of this event?
A risk practitioner is reviewing the organization's risk register and notices that a risk related to a legacy payroll system has been assigned an owner from the IT department. The risk owner is responsible for which of the following?
A newly hired risk analyst is asked to classify the organization's risk universe before any assessment begins. The analyst lists categories such as strategic, operational, financial, compliance, and reputational. Which of the following BEST explains why this categorization is useful for IT risk identification?
A risk practitioner is interviewing business unit leaders to identify IT risks for an annual risk assessment. One leader states that the customer relationship management system is critical because sales staff cannot work without it. Which of the following BEST describes the risk practitioner's next action to validate this input?
A risk practitioner is identifying risks associated with a new cloud-based customer relationship management (CRM) system. The organization has concerns about data leakage and service availability. Which TWO of the following are examples of vulnerabilities that could lead to these risks? (Choose two.)
A risk practitioner is analyzing the threat landscape for a hospital's connected medical devices. The devices run legacy operating systems that cannot be patched and are accessible from the clinical network. Which factor MOST increases the likelihood of exploitation?
A retail bank's risk practitioner is building a risk scenario for its online banking platform. He needs to estimate how frequently an attacker could realistically succeed in exploiting the platform's unpatched web tier. Which of the following provides the MOST quantitative basis for this estimate?
A risk practitioner is estimating the likelihood of a ransomware event affecting a manufacturing firm's operational technology environment. Historical incident data is sparse, so the practitioner convenes plant engineers, security staff, and the insurance broker to elicit calibrated estimates and combine them into a reasoned likelihood. Which technique is being used?
A risk practitioner is identifying risks for an organization that has adopted a bring-your-own-device policy for remote workers. The practitioner wants to document vulnerabilities that increase the likelihood of a data loss event. Which TWO of the following are MOST appropriately classified as vulnerabilities in this scenario? (Choose two.)
A global retailer is identifying IT risks related to a new cloud-based point-of-sale (POS) system. The risk practitioner wants to use a top-down approach. Which of the following is the MOST appropriate starting point for this approach?
A risk practitioner at a healthcare insurance company is building the risk register entry for ransomware affecting its claims-processing platform. The practitioner must document the loss event type, the asset at risk, and the expected loss magnitude in the organization's risk taxonomy. Which of the following BEST describes the risk component that represents the expected loss magnitude?
A risk practitioner is performing a risk assessment on an organization's use of a cloud-based payroll platform. The practitioner is identifying the inherent risk factors that exist before any controls are considered. Which TWO of the following are inherent risk factors for this scenario? (Choose two.)
A risk practitioner is using the ISACA risk scenario development approach to articulate a risk related to a third-party payment processor. The practitioner wants to ensure the scenario includes all key components. Which of the following components is MOST critical to include to enable effective risk analysis and treatment?
A risk practitioner is identifying IT risk scenarios for a new e-commerce platform. The platform will process credit card payments and store customer data. Which TWO of the following are examples of external threats that should be considered in the risk identification process? (Choose two.)
A risk practitioner is identifying external threats to a retail bank's online transaction platform. The bank wants to understand threats that originate from outside the organization and target customer accounts. Which TWO of the following are external threats relevant to this scenario? (Choose two.)
A hospital's risk practitioner is assessing a new telehealth platform that stores protected health information. During risk identification, she maps threats to the platform. Which of the following BEST illustrates a threat to this platform rather than a vulnerability or a control weakness?
A retail company's risk practitioner is reviewing how risks flow between the enterprise risk management function and the IT risk function. The CISO argues that IT risks should be reported only within IT, while the CRO wants material IT risks elevated to the enterprise register. Which CRISC principle BEST resolves this disagreement?
A risk analyst is identifying threats to a retail bank's newly deployed public application programming interface (API) that allows third-party fintech partners to initiate account transfers. Which of the following is the MOST relevant threat to consider during risk identification for this API?
A risk practitioner is analyzing the risk of insider threat in a software development company. The practitioner wants to assess the likelihood of a developer exfiltrating source code. Which of the following factors would MOST directly increase the likelihood of this risk?
A manufacturing firm's risk practitioner is facilitating a workshop to identify IT risks for a new industrial control system (ICS) rollout. Operational engineers, IT staff, and a third-party integrator are present. Which of the following approaches BEST supports comprehensive IT risk identification in this setting?
A national retail chain is building a risk register for its new e-commerce platform. The CISO asks the risk practitioner to identify the inherent risk associated with a recently disclosed SQL injection vulnerability in a third-party payment gateway module. Which of the following BEST describes inherent risk in this scenario?
A risk practitioner at a regional hospital is building a risk register entry for the loss of availability of the electronic health record (EHR) system. The CIO asks which element of the risk scenario establishes the frequency with which the loss event is expected to occur so that the register can be prioritized against other entries. Which component of the risk scenario should the practitioner document?
A risk practitioner at a regional bank is building a risk register and needs to classify each identified risk by its origin. The practitioner documents a risk that a critical payment switch will fail during peak transaction volume because a fan assembly in the switch has exceeded its mean time between failures. Which risk category BEST applies to this entry?
A risk manager is assessing the risk of a distributed denial-of-service (DDoS) attack on a critical online service. The service has a service-level agreement (SLA) that requires 99.9% uptime. The manager has identified that the likelihood of a DDoS attack is high, but the impact is considered low because the service can fail over to a backup data center. Which of the following should the risk manager do NEXT?
A risk practitioner is preparing a risk register for a hospital's new telemedicine platform. During interviews, the CIO states that the platform's availability is critical because clinicians rely on it for urgent consultations. The practitioner needs to document how this business dependency influences risk identification. Which of the following BEST describes the role of business criticality in this context?
A risk practitioner at an insurance company is identifying risks for a newly deployed customer portal that integrates with a third-party identity provider. She wants to document external factors that could increase the likelihood of a data breach. Which TWO of the following are external risk factors she should capture? (Choose two.)
An insurance company is expanding into a new country and must identify IT risks arising from local data protection law, which requires customer data to remain within national borders. The risk practitioner is mapping this requirement into the enterprise risk register. Which of the following is the MOST appropriate way to characterize this risk?
A risk practitioner is performing risk identification for a manufacturing firm that relies on industrial control systems (ICS) to operate assembly lines. The practitioner is cataloging vulnerabilities that could be exploited to disrupt production. Which TWO of the following represent vulnerabilities rather than threats? (Choose two.)
A risk practitioner is cataloging external factors that could create IT risk for a logistics firm expanding into a new country. Which TWO of the following are external factors that should be included in the risk identification effort? (Choose two.)
A retail bank is documenting its risk appetite for IT risk. The board states that the bank will accept only minimal risk of unauthorized disclosure of customer payment data, but is willing to accept moderate availability risk in internal reporting systems. A risk practitioner is asked to translate this statement into operational terms. Which action BEST reflects establishing risk tolerance in this context?
A hospital's risk practitioner is building a risk register entry for the loss of a critical electronic health record (EHR) system. The practitioner wants to express the risk in a way that combines the probability of the event with the magnitude of its business impact so that leadership can compare it against other enterprise risks. Which of the following BEST represents this expression?
A risk practitioner is using the Delphi technique to estimate the likelihood of a sophisticated ransomware attack against a hospital network. The first round of expert opinions produced widely divergent estimates. Which of the following is the MOST appropriate next step in the Delphi process?
A risk practitioner is assessing the likelihood that a nation-state actor will exfiltrate intellectual property from an aerospace manufacturer. The practitioner wants to express likelihood using a factor that reflects how attractive the manufacturer is as a target relative to its peers. Which approach BEST supports this?
A risk practitioner is identifying risks for a pharmaceutical company that shares clinical trial data with external research partners. The practitioner learns that partners access the data through a shared portal with role-based access, and that one partner recently terminated its agreement but retained portal credentials. Which of the following is the MOST significant risk identification finding?
A risk practitioner is using the MITRE ATT&CK framework to identify threats relevant to a financial services firm's cloud-hosted trading platform. The practitioner wants to focus on techniques adversaries use after obtaining initial access to cloud infrastructure. Which of the following BEST describes how ATT&CK should be applied in this risk identification effort?
A risk practitioner at a regional hospital is building a risk register and needs to classify each identified risk by its source. During interviews, staff describe a recurring situation: a radiology scheduling application has no automated account deprovisioning, so terminated employees retain access for weeks until a supervisor manually reports them. Which risk identification category BEST describes this finding?
A risk practitioner is selecting a risk analysis technique for a new mobile banking feature. The team has limited historical loss data, the feature involves several interconnected components, and stakeholders disagree about how failures propagate between them. Management wants a technique that structures expert judgment about causal pathways and produces a visual model of how component failures combine to cause the top-level loss event. Which technique BEST meets these requirements?
A retail bank's risk practitioner is assessing the risk that a core banking system outage could halt transaction processing. The practitioner wants to identify the specific conditions or characteristics of the environment that could allow the outage to occur or worsen its effect, rather than the events themselves. Which of the following is the practitioner identifying?
A hospital's risk practitioner is identifying risks to its electronic health record platform. The practitioner documents that a single system administrator holds the only account with rights to restore the production database, and no documented procedure exists for that task. Which risk factor does this finding PRIMARILY represent?
A risk practitioner is reviewing the organization's risk register and notices that a risk related to outdated encryption protocols on a file server has been assigned an owner. According to CRISC principles, what is the PRIMARY responsibility of the risk owner?
A risk practitioner is quantifying the potential loss from a ransomware scenario affecting a hospital's electronic health record (EHR) platform. Historical data shows an average of two disruptive malware incidents per year, a 30% probability that any single incident escalates to full EHR encryption, and an estimated $4,000,000 business impact when the EHR is unavailable for a full day. What is the annualized loss expectancy (ALE) for this scenario?
A risk practitioner is reviewing the risk register of an e-commerce company and finds that several risks were identified only through past incident reports. The chief risk officer asks how to broaden risk identification to surface risks that have not yet materialized. Which of the following approaches is MOST effective for identifying emerging and previously unconsidered risks?
A manufacturer is identifying IT risk associated with a legacy inventory management system that no longer receives vendor security patches. The risk practitioner documents the unsupported platform as a vulnerability. Which additional asset-based factor should the practitioner evaluate to determine how this vulnerability contributes to overall risk?
A risk practitioner is performing an external threat environment analysis for a retail chain that accepts card payments. The practitioner wants to identify which external factors should be treated as inputs to the likelihood of payment card data compromise. Which TWO of the following are the MOST appropriate inputs? (Choose two.)
A global logistics company's risk practitioner is identifying risks for a new customs-clearance application. She wants to ensure the risk identification is complete before moving to analysis. Which of the following approaches BEST supports completeness of the risk identification?
A risk practitioner at a software company is reviewing external sources to identify emerging IT risks that could affect the organization's cloud-hosted products. The practitioner wants to use sources that provide structured, timely information about newly disclosed software weaknesses. Which TWO of the following sources BEST meet this need? (Choose two.)
A financial services firm is conducting a risk assessment for a new mobile banking application. The risk practitioner needs to evaluate the likelihood of a threat exploiting a vulnerability. Which of the following factors is MOST relevant when assessing the likelihood of a threat event?
A risk practitioner is facilitating a workshop to identify risks for a new customer-facing payment portal. The CISO wants the exercise to capture risks arising from both internal process weaknesses and external threat sources without producing an unmanageable list. Which approach is MOST appropriate for structuring the risk identification effort?
A risk practitioner is identifying risks associated with the decommissioning of a legacy data center. The organization plans to migrate all remaining applications to a cloud environment. Which TWO of the following are the MOST significant risks that should be included in the risk register for this project? (Choose two.)
A utility company's risk practitioner is defining the scope of a risk identification exercise for a new advanced metering infrastructure. The practitioner must decide which elements to include. Which action BEST ensures the identification exercise covers the full risk landscape?
A global manufacturer's risk committee is defining the organization's risk capacity and risk appetite for IT risk. The chief risk officer asks the practitioner to clarify how these two concepts relate. Which of the following statements is MOST accurate?
A risk practitioner is assessing the effectiveness of the control environment supporting an online trading platform. Management asserts that controls are mature, but the practitioner must determine which activities constitute control monitoring rather than one-time assurance. Which TWO of the following activities are examples of ongoing control monitoring? (Choose two.)
A regional insurance company has just completed an IT risk assessment and documented the identified risks in a central repository. The risk practitioner now wants to ensure that each risk has an assigned owner, a defined response, and a status that can be tracked over time. Which of the following should the practitioner use to meet these needs?
A financial services firm is identifying risks for a new mobile banking feature that will rely on a third-party identity verification provider. The vendor has provided a SOC 2 Type II report, but the firm has not yet reviewed it. Which of the following BEST describes how the firm should treat the vendor-related risk during identification?
A risk practitioner at a regional bank is building risk scenarios for the new mobile check deposit feature. The team has identified the event 'attackers exploit a vulnerability in the image processing library to inject malicious code.' Which of the following BEST describes the element that is missing from this risk scenario?
A hospital's risk practitioner is identifying risks for a new telehealth platform. The IT director asks which source would be MOST useful for identifying vulnerabilities specific to the platform's underlying commercial software components. Which of the following should the practitioner use?
A risk practitioner is assessing the risk of a distributed denial-of-service (DDoS) attack against an online retailer's public storefront. The CISO asks which factors would MOST directly increase the likelihood that such an attack would succeed in disrupting service. (Choose two.)
A risk practitioner is estimating the likelihood of a ransomware event for a manufacturing firm. The firm has endpoint protection, network segmentation, and offline backups, but the practitioner learns that a third-party maintenance vendor has persistent remote access with shared credentials and no multi-factor authentication. Which of the following BEST explains how this finding should affect the likelihood estimate?
A risk practitioner is evaluating the risk that a cloud provider's regional outage disrupts a company's order management system. The company has a recovery time objective (RTO) of four hours, but the provider's documented regional recovery capability is estimated at twelve hours. Which of the following BEST characterizes the risk exposure this gap represents?