CRISC IT Risk Identification Practice Test 1 — 15 Questions

Question 1

An organization is developing its IT risk universe. Which of the following is the BEST source of information for identifying potential IT risks?

Accepted Answer

Threat intelligence feeds from ISACs. Threat intelligence feeds from Information Sharing and Analysis Centers (ISACs) provide sector-specific, timely, and actionable information about emerging threats, threat actors, and attack vectors relevant to the organization's industry. This makes them the best source for proactively identifying potential IT risks because they reflect the current threat landscape rather than past events. ISACs aggregate anonymized data from multiple organizations, giving a broader and more current view than internal sources alone.

Answer

Industry benchmarking reports

Answer

Results from the latest internal audit

Answer

Historical loss data from the finance department

Question 2

During a risk identification workshop, a risk owner proposes a scenario: 'A disgruntled employee with privileged access exfiltrates customer data to a competitor.' In the context of the ISACA risk scenario template, which element is missing if the scenario only includes the actor, threat type, event, and asset?

Accepted Answer

Timing and detection. The ISACA risk scenario template includes actor, threat type, event, asset, timing, detection, and consequence. The scenario provides the actor (disgruntled employee), threat type (privileged access misuse), event (data exfiltration), and asset (customer data), but it does not specify when the event occurs or how it is detected. Therefore, timing and detection are the missing elements.

Answer

Business impact

Answer

Consequence

Answer

Vulnerability

Question 3

A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?

Accepted Answer

Categorize the risks. After identification, risks should be categorized to enable proper analysis and response. Categorization helps in understanding the nature of each risk and assigning ownership.

Answer

Assign risk owners

Answer

Determine risk response

Answer

Assess the inherent risk level

Question 4

A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?

Accepted Answer

IAST (Interactive Application Security Testing). IAST instruments the running application and correlates runtime execution with source code, producing findings with context about actual reachability and data flow. This context lets teams prioritize vulnerabilities that are actually exploitable in the business context, cutting through the noise from SAST and DAST. IAST's runtime insight ties findings to real execution paths, making it the best fit for business-risk-based prioritization.

Answer

OWASP ZAP automated scanner

Answer

Manual penetration testing

Answer

CVE database search

Question 5

A security team is using the STRIDE threat modeling methodology for a new web application. Which threat type under STRIDE would be MOST relevant to a SQL injection vulnerability?

Accepted Answer

Tampering. SQL injection allows an attacker to tamper with data, violating integrity. STRIDE includes Tampering as the threat that involves unauthorized modification of data.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing

Question 6

An IT risk manager is categorizing risks identified during a recent assessment. Which TWO categories would include the risk of a system outage caused by a software bug?

Accepted Answer

Operational risk. Operational risk covers failures in internal processes, systems, and people, which directly includes a system outage caused by a software bug. Option D (Financial risk) is also correct because such an outage can produce direct financial losses through lost revenue, SLA penalties, recovery costs, and productivity downtime. Compliance risk (B) is not the primary category here since it concerns violations of laws, regulations, or standards, not the outage itself. Strategic risk (C) relates to failed business strategy or market positioning, and reputational risk (E) concerns damage to brand or public trust, neither of which is the direct categorization of a software-bug-induced outage.

Answer

Compliance risk

Answer

Strategic risk

Answer

Reputational risk

Question 7

A risk practitioner is developing a risk scenario for a data breach caused by an insider threat. Which of the following is the MOST realistic and complete risk scenario?

Accepted Answer

A disgruntled employee with excessive access privileges exfiltrates customer data to a competitor, resulting in a $2 million loss.. A realistic and complete risk scenario must include a credible threat actor, a specific vulnerability or condition, the threat event, and a meaningful business impact. Option A does this: a disgruntled employee (threat actor) with excessive access privileges (vulnerability) exfiltrates customer data to a competitor (event), resulting in a $2 million loss (impact). This aligns with CRISC's emphasis on scenario-based risk analysis.

Answer

A careless employee leaves a laptop unencrypted, leading to data loss, but no financial impact.

Answer

An external hacker uses stolen credentials to access the network and steal data, causing reputational damage.

Answer

A script kiddie launches a DDoS attack that disrupts service for 2 hours, causing no data loss.

Question 8

Which TWO of the following are examples of operational vulnerabilities that a risk practitioner might identify?

Accepted Answer

Insufficient security awareness training for employees. Operational vulnerabilities are weaknesses in day-to-day processes, procedures, and human controls rather than technical flaws in code or systems. Option A (Insufficient security awareness training for employees) is correct because it is a people-and-process weakness that enables social engineering and human error, which is a classic operational vulnerability a risk practitioner would flag. Option C (Lack of segregation of duties in financial systems) is correct because it is a control/process design weakness that allows one person to perform conflicting tasks, increasing fraud and error risk — an operational, not technical, vulnerability. Option B (Phishing emails targeting senior executives) is a threat event or attack technique, not a vulnerability, so it does not belong. Option D (SQL injection vulnerability in a web application) is a technical/software vulnerability in code, not an operational one. Option E (Unpatched software in the production environment) is a technical/patch-management vulnerability in the system configuration, not an operational process weakness.

Answer

Phishing emails targeting senior executives

Answer

SQL injection vulnerability in a web application

Answer

Unpatched software in the production environment

Question 9

A security analyst is using a threat modeling approach that focuses on identifying threats based on the system's requirements and design. Which threat modeling methodology is being used?

Accepted Answer

TRIKE. TRIKE is a threat modeling methodology that takes a risk-based, requirements-driven approach. It focuses on defining the system's security requirements and then identifying threats that could violate those requirements, making it distinct from other methodologies that are more design- or attacker-centric. This aligns with the question's emphasis on 'requirements and design' as the basis for threat identification.

Answer

STRIDE

Answer

VAST

Answer

PASTA

Question 10

An organization has identified a new vulnerability in its web application that could allow SQL injection attacks. Which of the following sources would MOST likely have been used to identify this vulnerability?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes application source code or bytecode without executing it, and is specifically designed to detect coding flaws such as unsanitized input leading to SQL injection. Because SQL injection is a code-level defect, SAST is the most likely source to identify it during development. It flags tainted data flows from user input to database queries.

Answer

CIS Benchmarks

Answer

NVD

Answer

DISA STIG

Question 11

Which of the following is the PRIMARY purpose of a risk register?

Accepted Answer

To document and manage identified risks throughout their lifecycle. The primary purpose of a risk register is to document identified risks and manage them throughout their lifecycle — including ownership, assessment, treatment plans, status, and review. It is the central repository that supports risk monitoring, reporting, and decision-making. While it can inform risk appetite and support reporting, those are secondary uses, not its primary purpose.

Answer

To calculate the organization's risk appetite

Answer

To report risks to regulatory authorities

Answer

To track the status of risk treatment plans

Question 12

A risk practitioner is using the ISACA risk scenario template to document a scenario. The template includes elements such as threat actor, threat type, event, asset/resource, timing, detection, and response. Which element describes the likelihood that the threat event will occur within a specific timeframe?

Accepted Answer

Timing. The ISACA risk scenario template defines 'timing' as the element that captures the likelihood of the threat event occurring within a specific timeframe. It addresses the probability dimension of risk, answering 'how likely is this event to happen and when?' This is distinct from other elements like threat type (nature of the threat) or detection/response (controls). Timing directly informs risk assessment by quantifying the frequency or probability component of risk.

Answer

Threat type

Answer

Response

Answer

Detection

Question 13

An organization is assessing risks related to a third-party cloud provider. Which of the following is the BEST source of threat intelligence for identifying threats targeting the cloud infrastructure?

Accepted Answer

ISACs. ISACs (Information Sharing and Analysis Centers) provide sector-specific threat intelligence and can share information about threats targeting cloud infrastructure relevant to the organization's industry.

Answer

Government advisories

Answer

OSINT

Answer

Commercial feeds

Question 14

A risk practitioner is updating the risk register and needs to categorize risks. Which TWO of the following are standard risk categories used in IT risk management?

Accepted Answer

Strategic. Option B (Strategic) is correct because strategic risk is a standard IT risk management category covering risks that affect an organization's ability to achieve its long-term goals, such as technology shifts, competitive pressures, or misaligned IT investments. Option E (Operational) is correct because operational risk is a recognized category encompassing risks from day-to-day processes, people, systems, and internal controls, including IT service failures, human error, and process breakdowns. These categories align with widely used frameworks such as COSO ERM and ISO 31000, which classify risks by strategic, operational, financial, and compliance/hazard domains. Option A (Budgetary) is not a standard top-level risk category; financial risk is the recognized category, and budgetary concerns are typically a subset of it. Option C (Technical) is not a standard risk category in IT risk management frameworks; technical issues are usually treated as sources or causes of operational or strategic risk rather than a distinct category. Option D (Environmental) is not a standard IT risk category; environmental risk is typically a subcategory of hazard or compliance risk, not a primary classification.

Answer

Budgetary

Answer

Technical

Answer

Environmental

Question 15

A project manager is identifying risks for a new software development project using Agile methodology. Which THREE threat modeling techniques are BEST suited for Agile/DevSecOps environments?

Accepted Answer

VAST. VAST (B) is correct because Visual, Agile, and Simple Threat modeling was explicitly designed to scale threat modeling across Agile and DevOps teams, integrating into CI/CD pipelines with automated, developer-friendly output. STRIDE (D) is correct because it is a lightweight, per-element technique (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) that maps well to iterative sprints and incremental design reviews. PASTA (E) is correct because Process for Attack Simulation and Threat Analysis is a risk-centric, seven-stage methodology that aligns business objectives with technical threats and fits the iterative, risk-driven nature of Agile delivery. TRIKE (A) is not marked correct because it is a risk-based, requirements-driven model better suited to formal waterfall-style analysis than rapid Agile iterations. Attack trees (C) are not marked correct because, while useful for decomposing specific attack goals, they are a general-purpose technique rather than an Agile/DevSecOps-oriented methodology and are typically more manual and less scalable in sprint cadence.

Answer

TRIKE

Answer

Attack trees