CRISC IT Risk Identification Practice Test 10 — 15 Questions

Question 1

A risk practitioner is using the ISACA risk scenario development approach to articulate a risk related to a third-party payment processor. The practitioner wants to ensure the scenario includes all key components. Which of the following components is MOST critical to include to enable effective risk analysis and treatment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The asset, threat, vulnerability, and potential impact. A well-structured risk scenario includes the asset, threat, vulnerability, and impact. These components allow the practitioner to assess the probability and consequence of the risk and to design appropriate responses. Other details like threat actor names, costs, or regulations are secondary and do not replace the fundamental elements needed for risk analysis and treatment.

Answer

The name of the specific threat actor group

Answer

The regulatory requirements applicable to the payment processor

Answer

The cost of the third-party processor's service

Question 2

A risk practitioner is identifying IT risk scenarios for a new e-commerce platform. The platform will process credit card payments and store customer data. Which TWO of the following are examples of external threats that should be considered in the risk identification process? (Choose two.)

Accepted Answer

Organized criminal groups targeting payment card data.. External threats are actors or events outside the organization that can cause harm. Organized criminal groups and hacktivists are both external threat actors with different motivations. They should be included in risk identification for an e-commerce platform. The other options describe internal threats or vulnerabilities, which are not external threats.

Answer

Third-party service providers with inadequate security controls.

Answer

Disgruntled employees with access to customer databases.

Answer

Software bugs in the e-commerce application code.

Question 3

A risk practitioner is identifying external threats to a retail bank's online transaction platform. The bank wants to understand threats that originate from outside the organization and target customer accounts. Which TWO of the following are external threats relevant to this scenario? (Choose two.)

Accepted Answer

Hacktivists defacing the bank's public website to protest its lending practices.. External threats originate outside the organization and involve actors or events that can affect its assets. Organized criminal credential stuffing and hacktivist website defacement both fit because they are externally initiated and target the bank's online presence or customer accounts. Internal errors, developer mistakes, and provider outages are important risks but do not meet the external threat actor criterion for this analysis.

Answer

A database administrator accidentally deleting transaction records during routine maintenance.

Answer

A developer introducing a logic flaw into the transaction code during an internal sprint.

Answer

A third-party cloud provider's data center experiencing a power outage.

Question 4

A hospital's risk practitioner is assessing a new telehealth platform that stores protected health information. During risk identification, she maps threats to the platform. Which of the following BEST illustrates a threat to this platform rather than a vulnerability or a control weakness?

Accepted Answer

A ransomware group known to target healthcare providers is actively scanning for exposed telehealth endpoints. A threat is an actor or event with the potential to cause harm, while a vulnerability is a weakness that a threat can exploit. The ransomware group targeting healthcare providers is an external threat source with demonstrated intent and capability. Unpatched components, predictable tokens, and missing assessments are internal weaknesses or control gaps that a threat could exploit, not threats themselves.

Answer

The platform's session tokens are generated with insufficient randomness and can be predicted by an attacker

Answer

The hospital has not yet completed a SOC 2 Type II assessment for the telehealth vendor

Answer

The platform's video-conferencing component has not been patched against a recently published remote code execution flaw

Question 5

A retail company's risk practitioner is reviewing how risks flow between the enterprise risk management function and the IT risk function. The CISO argues that IT risks should be reported only within IT, while the CRO wants material IT risks elevated to the enterprise register. Which CRISC principle BEST resolves this disagreement?

Accepted Answer

IT risk is a subset of enterprise risk and material IT risks should be integrated into enterprise risk reporting.. The correct principle is that IT risk is a subset of enterprise risk and material IT risks belong in enterprise reporting. This ensures business leadership sees how technology exposures affect objectives and can allocate resources and set tolerance accordingly. IT still performs the technical analysis, but the results flow upward so governance and strategy reflect the full risk landscape rather than a fragmented view.

Answer

Both registers should be maintained independently and reconciled only during the annual external audit.

Answer

IT risks should remain under the CISO because only technical staff can interpret their likelihood.

Answer

The CRO should take over all IT risk analysis to ensure consistent methodology across the enterprise.

Question 6

A risk analyst is identifying threats to a retail bank's newly deployed public application programming interface (API) that allows third-party fintech partners to initiate account transfers. Which of the following is the MOST relevant threat to consider during risk identification for this API?

Accepted Answer

An attacker exploits broken object level authorization to initiate transfers from accounts they do not own.. The most relevant threat to a public API that initiates account transfers is abuse of authorization logic, such as broken object level authorization, because it directly enables unauthorized financial transactions. Physical accidents, competitive intelligence, and power outages are generic threats that do not address the specific exposure created by exposing transfer functionality to third parties. Identifying API-specific threats ensures controls such as object-level access checks and strong authentication are designed appropriately.

Answer

A regional power outage causes the bank's secondary data center to fail over to the primary site.

Answer

An insider in the facilities team accidentally spills coffee on a server in the data center.

Answer

A competitor hires a private investigator to photograph the bank's executive team at a conference.

Question 7

A risk practitioner is analyzing the risk of insider threat in a software development company. The practitioner wants to assess the likelihood of a developer exfiltrating source code. Which of the following factors would MOST directly increase the likelihood of this risk?

Accepted Answer

The developer has elevated access privileges to the source code repository.. The likelihood of an insider threat depends on motivation, opportunity, and capability. Elevated access privileges provide the opportunity for a developer to exfiltrate source code, making it the most direct factor increasing likelihood. Other factors like turnover or training frequency may influence the environment but do not directly enable the theft. Access control is therefore a critical control point.

Answer

The company's security awareness training is conducted annually.

Answer

The company has a high turnover rate among developers.

Answer

The source code repository is hosted in a third-party cloud environment.

Question 8

A manufacturing firm's risk practitioner is facilitating a workshop to identify IT risks for a new industrial control system (ICS) rollout. Operational engineers, IT staff, and a third-party integrator are present. Which of the following approaches BEST supports comprehensive IT risk identification in this setting?

Accepted Answer

Facilitate a structured, cross-functional workshop using techniques such as brainstorming and scenario analysis, supplemented by asset and threat information.. Cross-functional, structured workshops combine the operational, technical, and business knowledge needed to identify risks comprehensively, and supplementing them with asset and threat data grounds the discussion in evidence. Relying on a vendor, a single team's scan output, or waiting for live incidents all narrow the input or defer identification until treatment is far more costly.

Answer

Postpone identification until the ICS has been in production for six months so real incidents can be observed.

Answer

Rely solely on the third-party integrator's risk assessment because they designed the ICS architecture.

Answer

Ask only the IT security team to complete a vulnerability scan and treat the scan output as the risk list.

Question 9

A national retail chain is building a risk register for its new e-commerce platform. The CISO asks the risk practitioner to identify the inherent risk associated with a recently disclosed SQL injection vulnerability in a third-party payment gateway module. Which of the following BEST describes inherent risk in this scenario?

Accepted Answer

The risk that exists before any controls or mitigation efforts are applied to the SQL injection vulnerability in the payment gateway module.. Inherent risk is the level of risk before any controls or mitigation actions are applied. In the context of the SQL injection vulnerability, it represents the raw exposure that the organization faces if nothing is done. This baseline is essential for risk practitioners to prioritize risks and later evaluate the effectiveness of controls by comparing inherent and residual risk. The other options describe residual risk, vendor-specific risk, or risk appetite exceedance, none of which define inherent risk.

Answer

The risk that the third-party payment gateway vendor will fail to patch the SQL injection vulnerability within the agreed service level agreement.

Answer

The risk that the organization's risk appetite statement will be exceeded due to the SQL injection vulnerability.

Answer

The level of risk that remains after the organization implements compensating controls such as a web application firewall and input validation.

Question 10

A risk practitioner at a regional hospital is building a risk register entry for the loss of availability of the electronic health record (EHR) system. The CIO asks which element of the risk scenario establishes the frequency with which the loss event is expected to occur so that the register can be prioritized against other entries. Which component of the risk scenario should the practitioner document?

Accepted Answer

Threat event frequency. Threat event frequency is the factor-based component that states how often the threat community is expected to act against the asset, so it is the element that establishes occurrence rate for the risk register entry. Loss magnitude components describe impact, while vulnerabilities describe exploitable weaknesses. Only threat event frequency directly supports the annualized loss expectancy comparison the CIO wants for prioritizing the EHR availability risk.

Answer

Secondary risk

Answer

Primary loss magnitude

Answer

Vulnerability

Question 11

A risk practitioner at a regional bank is building a risk register and needs to classify each identified risk by its origin. The practitioner documents a risk that a critical payment switch will fail during peak transaction volume because a fan assembly in the switch has exceeded its mean time between failures. Which risk category BEST applies to this entry?

Accepted Answer

IT operational risk. The scenario describes a loss event caused by the routine operation of technology infrastructure, so it belongs in the IT operational risk category. That classification supports aggregation with other availability and performance risks, drives appropriate preventive controls such as condition-based maintenance and redundant components, and allows residual risk to be measured after treatment. Strategic, compliance, and inherent risk labels describe different dimensions and would misdirect the response.

Answer

Inherent risk

Answer

Strategic risk

Answer

Compliance risk

Question 12

A risk manager is assessing the risk of a distributed denial-of-service (DDoS) attack on a critical online service. The service has a service-level agreement (SLA) that requires 99.9% uptime. The manager has identified that the likelihood of a DDoS attack is high, but the impact is considered low because the service can fail over to a backup data center. Which of the following should the risk manager do NEXT?

Accepted Answer

Validate the effectiveness of the failover mechanism under a DDoS attack.. The risk manager's impact assessment relies on the failover mechanism working during a DDoS attack. Before proceeding, the manager must validate that the failover can handle a DDoS scenario. If it cannot, the impact may be higher than assumed. Validating the control ensures the risk assessment is accurate and informs subsequent risk response decisions.

Answer

Transfer the risk by purchasing cyber insurance for DDoS attacks.

Answer

Mitigate the risk by implementing a DDoS protection service.

Answer

Accept the risk because the impact is low and the SLA can be met.

Question 13

A risk practitioner is preparing a risk register for a hospital's new telemedicine platform. During interviews, the CIO states that the platform's availability is critical because clinicians rely on it for urgent consultations. The practitioner needs to document how this business dependency influences risk identification. Which of the following BEST describes the role of business criticality in this context?

Accepted Answer

It establishes the potential business impact if the platform's availability is compromised.. Business criticality expresses how important an asset is to the organization and therefore drives the impact dimension of risk. For a telemedicine platform used in urgent consultations, an availability loss can affect patient safety, regulatory standing, and reputation. Documenting this dependency allows the practitioner to assign a defensible impact rating during identification, which supports later prioritization and response.

Answer

It specifies the control framework that must be applied to protect the platform.

Answer

It determines the likelihood that a threat will exploit a vulnerability on the platform.

Answer

It defines the risk appetite threshold that the board must approve for the platform.

Question 14

A risk practitioner at an insurance company is identifying risks for a newly deployed customer portal that integrates with a third-party identity provider. She wants to document external factors that could increase the likelihood of a data breach. Which TWO of the following are external risk factors she should capture? (Choose two.)

Accepted Answer

The identity provider's recent history of service outages and security incidents disclosed in its public trust reports. External risk factors are conditions outside the organization's direct control that affect the likelihood or impact of a risk event. A third-party identity provider's incident history and changing regulatory penalty regimes both originate outside the insurer and vary independently of its own actions. Internal policies, privileged account counts, and change management processes are internal conditions or controls that the organization itself shapes.

Answer

The insurer's internal policy requiring multi-factor authentication for all administrative access to the portal

Answer

The insurer's internal change management process for deploying portal updates

Answer

The number of privileged accounts the insurer's own IT staff hold on the portal's backend systems

Question 15

An insurance company is expanding into a new country and must identify IT risks arising from local data protection law, which requires customer data to remain within national borders. The risk practitioner is mapping this requirement into the enterprise risk register. Which of the following is the MOST appropriate way to characterize this risk?

Accepted Answer

As an enterprise risk that links the legal obligation to the market-entry objective, with ownership shared among legal, compliance, and technology stakeholders.. A cross-border data residency obligation affects legal compliance, technology architecture, and the strategic decision to enter a market, so it belongs in the enterprise risk register with clear linkage to business objectives and shared ownership. This placement lets leadership weigh treatment costs against expansion value. Treating it as purely technical, isolated from strategy, or deferred until enforcement all misplace the risk and weaken governance.

Answer

As a technology risk owned by the infrastructure team, because data residency is enforced through server location.

Answer

As a compliance risk with no linkage to strategic objectives, since the requirement is external and mandatory.

Answer

As an operational risk to be accepted until a regulator raises a concern, at which point it can be reassessed.