CRISC IT Risk Identification Practice Test 11 — 15 Questions

Question 1

A risk practitioner is performing risk identification for a manufacturing firm that relies on industrial control systems (ICS) to operate assembly lines. The practitioner is cataloging vulnerabilities that could be exploited to disrupt production. Which TWO of the following represent vulnerabilities rather than threats? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Flat network architecture that allows engineering workstations to reach production PLCs without segmentation.. Vulnerabilities are internal weaknesses or conditions that a threat can exploit, such as unpatched PLCs with known flaws and flat network architecture exposing production systems. Threat actors and natural events exist independently and are classified as threats. Correctly separating the two is essential because treatment differs: vulnerabilities are remediated through patching, segmentation, and configuration, while threats are addressed by reducing exposure and improving detection and response.

Answer

A severe storm causing extended power loss to the manufacturing plant.

Answer

A nation-state group conducting reconnaissance against critical manufacturing infrastructure.

Answer

Ransomware operators targeting industrial organizations for extortion payments.

Question 2

A risk practitioner is cataloging external factors that could create IT risk for a logistics firm expanding into a new country. Which TWO of the following are external factors that should be included in the risk identification effort? (Choose two.)

Accepted Answer

New data residency and privacy regulations in the target country.. External factors are conditions outside the organization's control that shape its risk landscape. New data residency and privacy regulations and the maturity of local telecom and power infrastructure both originate in the target country's legal and physical environment, so they must be identified during expansion planning. Internal items such as staff skills, training rates, and encryption choices are capability and control decisions the firm governs itself.

Answer

The organization's chosen encryption standard for data at rest.

Answer

The firm's internal security awareness training completion rate.

Answer

The technical skill level of the firm's current IT staff.

Question 3

A retail bank is documenting its risk appetite for IT risk. The board states that the bank will accept only minimal risk of unauthorized disclosure of customer payment data, but is willing to accept moderate availability risk in internal reporting systems. A risk practitioner is asked to translate this statement into operational terms. Which action BEST reflects establishing risk tolerance in this context?

Accepted Answer

Defining measurable thresholds, such as a maximum acceptable number of payment data records exposed per year, for each risk category. Risk appetite is the amount of risk an organization is willing to accept in pursuit of value, while risk tolerance translates that appetite into measurable, monitorable limits. Expressing the board's statement as maximum acceptable exposure counts for payment data and separate downtime limits for internal reporting systems makes the appetite operational. The other choices are response or assessment activities that do not establish the quantitative boundaries the board's differentiated statement requires.

Answer

Documenting the inherent risk rating of the payment data system in the risk register

Answer

Purchasing cyber insurance to transfer the financial impact of a payment data breach

Answer

Conducting a penetration test of the payment card processing environment

Question 4

A hospital's risk practitioner is building a risk register entry for the loss of a critical electronic health record (EHR) system. The practitioner wants to express the risk in a way that combines the probability of the event with the magnitude of its business impact so that leadership can compare it against other enterprise risks. Which of the following BEST represents this expression?

Accepted Answer

Risk score derived from a likelihood and impact matrix. Risk must be expressed so that dissimilar risks can be compared and prioritized. Combining likelihood with impact in a matrix yields a risk score that reflects both dimensions, works for financial and nonfinancial consequences, and aligns with how IT risk registers are typically populated. Monetary measures such as annualized loss expectancy address only expected financial loss, while control self-assessment results and indicator breach counts are inputs to assessment rather than the risk expression itself.

Answer

Key risk indicator (KRI) threshold breach count

Answer

Annualized loss expectancy (ALE)

Answer

Control self-assessment (CSA) result

Question 5

A risk practitioner is using the Delphi technique to estimate the likelihood of a sophisticated ransomware attack against a hospital network. The first round of expert opinions produced widely divergent estimates. Which of the following is the MOST appropriate next step in the Delphi process?

Accepted Answer

Provide a statistical summary of the first-round estimates to the experts and ask them to revise their estimates in a second anonymous round.. The Delphi technique is an iterative, anonymous expert elicitation method. After the first round, the facilitator provides a statistical summary of the responses, such as the median and range, to the experts. The experts then revise their estimates in a second anonymous round. This process repeats until consensus or stability is achieved. Providing feedback and allowing revision is the defining characteristic of Delphi, making the second anonymous round the correct next step.

Answer

Replace the expert panel with a quantitative Monte Carlo simulation to model the ransomware likelihood.

Answer

Discard the highest and lowest estimates and average the remaining responses to produce a single likelihood value.

Answer

Convene a face-to-face meeting where experts debate their estimates until a unanimous consensus is reached.

Question 6

A risk practitioner is assessing the likelihood that a nation-state actor will exfiltrate intellectual property from an aerospace manufacturer. The practitioner wants to express likelihood using a factor that reflects how attractive the manufacturer is as a target relative to its peers. Which approach BEST supports this?

Accepted Answer

Score likelihood using a threat attractiveness rating that weighs sector, data value, and geopolitical relevance.. Likelihood for a deliberate, actor-driven threat should reflect the adversary's intent and the target's relative appeal, not the volume of incidental events or control gaps. A threat attractiveness rating built from sector, data value, and geopolitical relevance captures why a nation-state would choose this aerospace manufacturer, keeps the likelihood factor independent of impact and vulnerability inputs, and gives a stable basis for comparing the same risk over successive assessment cycles.

Answer

Assess likelihood by the number of open vulnerabilities rated critical in the last external scan.

Answer

Derive likelihood from the annualized loss expectancy calculated for previous intellectual property incidents.

Answer

Rate likelihood using the historical frequency of malware infections recorded by the endpoint protection platform.

Question 7

A risk practitioner is identifying risks for a pharmaceutical company that shares clinical trial data with external research partners. The practitioner learns that partners access the data through a shared portal with role-based access, and that one partner recently terminated its agreement but retained portal credentials. Which of the following is the MOST significant risk identification finding?

Accepted Answer

Terminated partners retain valid portal credentials after their agreements end.. The strongest finding is the confirmed existence of valid credentials held by a partner whose agreement has ended. That is a concrete threat-to-asset path affecting sensitive clinical trial data, and it must be documented and assessed. General concerns about role design, data sharing, or unstated authentication gaps are either design questions or unsupported assumptions compared with this active exposure.

Answer

Clinical trial data is shared with external research partners at all.

Answer

The portal's role-based access model may not align with the principle of least privilege.

Answer

The portal does not enforce multi-factor authentication for partner logins.

Question 8

A risk practitioner is using the MITRE ATT&CK framework to identify threats relevant to a financial services firm's cloud-hosted trading platform. The practitioner wants to focus on techniques adversaries use after obtaining initial access to cloud infrastructure. Which of the following BEST describes how ATT&CK should be applied in this risk identification effort?

Accepted Answer

Map relevant ATT&CK techniques to the platform's assets and controls to identify gaps in detection and mitigation coverage.. ATT&CK is most valuable in risk identification when its techniques are mapped to the organization's assets and existing controls, exposing coverage gaps in detection and mitigation. It describes adversary behavior but does not supply likelihood scores, replace a risk taxonomy, or determine budget priorities by itself. The practitioner should use the mapping to build credible scenarios and then combine that insight with likelihood, impact, and risk appetite to drive treatment decisions.

Answer

Replace the organization's risk taxonomy with ATT&CK tactic categories to simplify risk register reporting.

Answer

Use ATT&CK technique identifiers as the sole basis for prioritizing risk treatment budgets across the firm.

Answer

Use ATT&CK techniques to assign a numerical likelihood score to each identified risk in the register.

Question 9

A risk practitioner at a regional hospital is building a risk register and needs to classify each identified risk by its source. During interviews, staff describe a recurring situation: a radiology scheduling application has no automated account deprovisioning, so terminated employees retain access for weeks until a supervisor manually reports them. Which risk identification category BEST describes this finding?

Accepted Answer

A vulnerability, because the absence of automated deprovisioning is a weakness that an actor could exploit.. The missing automated deprovisioning capability is a weakness in an IT process that a threat source could exploit, which by definition is a vulnerability. Identifying it as such allows the risk practitioner to link it to relevant threat sources, assess likelihood and impact, and drive remediation such as automated identity lifecycle management. Threat events describe occurrences, appetite statements describe tolerance, and control objectives describe desired outcomes, none of which match the observed condition.

Answer

A threat event, because terminated employees could intentionally misuse their retained access.

Answer

A control objective, because the hospital should define a target for account removal timing.

Answer

A risk appetite statement, because the hospital has implicitly accepted delayed deprovisioning.

Question 10

A risk practitioner is selecting a risk analysis technique for a new mobile banking feature. The team has limited historical loss data, the feature involves several interconnected components, and stakeholders disagree about how failures propagate between them. Management wants a technique that structures expert judgment about causal pathways and produces a visual model of how component failures combine to cause the top-level loss event. Which technique BEST meets these requirements?

Accepted Answer

Fault tree analysis. Fault tree analysis is a deductive technique that begins with a top-level undesired event and uses logic gates to represent combinations of contributing failures, making it ideal when historical data is scarce and causal relationships are disputed. It structures expert judgment and produces a diagram of failure propagation. Annualized loss expectancy quantifies monetary risk but needs data the team lacks, Delphi aggregates opinions without a causal model, and business impact analysis focuses on disruption consequences to business functions.

Answer

Delphi technique

Answer

Business impact analysis

Answer

Annualized loss expectancy calculation

Question 11

A retail bank's risk practitioner is assessing the risk that a core banking system outage could halt transaction processing. The practitioner wants to identify the specific conditions or characteristics of the environment that could allow the outage to occur or worsen its effect, rather than the events themselves. Which of the following is the practitioner identifying?

Accepted Answer

Vulnerabilities. Risk identification separates the threat, which is what can cause harm, from the vulnerability, which is the condition that allows the threat to succeed or magnifies the consequence. The practitioner's focus on characteristics of the environment that permit or worsen an outage therefore points to vulnerabilities. Documenting these conditions is what enables the organization to select controls that address the actual weaknesses in the core banking environment.

Answer

Threat events

Answer

Risk appetite statements

Answer

Key performance indicators

Question 12

A hospital's risk practitioner is identifying risks to its electronic health record platform. The practitioner documents that a single system administrator holds the only account with rights to restore the production database, and no documented procedure exists for that task. Which risk factor does this finding PRIMARILY represent?

Accepted Answer

A vulnerability. The finding describes a condition, not an event or a desired state: one person uniquely holds restore rights and no procedure exists. That condition is a vulnerability because it can be exploited by ordinary events such as illness, turnover, or human error, and it amplifies the impact of any incident affecting the database. Recognizing it as a vulnerability directs remediation toward cross-training, documented runbooks, and separation of duties.

Answer

A risk appetite statement

Answer

A control objective

Answer

A threat event

Question 13

A risk practitioner is reviewing the organization's risk register and notices that a risk related to outdated encryption protocols on a file server has been assigned an owner. According to CRISC principles, what is the PRIMARY responsibility of the risk owner?

Accepted Answer

To ensure that the risk is managed appropriately and that decisions regarding its treatment are made and documented.. In CRISC, a risk owner is the individual accountable for managing a specific risk. Their primary responsibility is to ensure the risk is managed appropriately, which includes making and documenting decisions about risk treatment (accept, mitigate, transfer, avoid). They do not necessarily implement controls themselves, nor do they perform technical assessments or set organizational risk appetite. The risk owner ensures that the risk remains within tolerance and that actions are taken to address it.

Answer

To implement the technical controls necessary to mitigate the risk to an acceptable level.

Answer

To perform periodic vulnerability scans and penetration tests to identify changes in the risk profile.

Answer

To approve the organization's overall risk appetite statement and communicate it to the board of directors.

Question 14

A risk practitioner is quantifying the potential loss from a ransomware scenario affecting a hospital's electronic health record (EHR) platform. Historical data shows an average of two disruptive malware incidents per year, a 30% probability that any single incident escalates to full EHR encryption, and an estimated $4,000,000 business impact when the EHR is unavailable for a full day. What is the annualized loss expectancy (ALE) for this scenario?

Accepted Answer

$2,400,000. Annualized loss expectancy is derived by first computing single loss expectancy, which is the impact of $4,000,000 multiplied by the 30% probability of escalation, giving $1,200,000. Multiplying that by the annualized rate of occurrence of two incidents per year produces $2,400,000. This expected annual loss can be weighed directly against the yearly cost of controls such as immutable backups, segmentation, and detection tooling.

Answer

$12,000,000

Answer

$1,200,000

Answer

$8,000,000

Question 15

A risk practitioner is reviewing the risk register of an e-commerce company and finds that several risks were identified only through past incident reports. The chief risk officer asks how to broaden risk identification to surface risks that have not yet materialized. Which of the following approaches is MOST effective for identifying emerging and previously unconsidered risks?

Accepted Answer

Conduct scenario analysis workshops with business, technology, and external stakeholders to explore plausible future events.. Scenario analysis workshops are forward-looking and draw on cross-functional and external perspectives to imagine plausible events that have no internal incident history. They are well suited to surfacing emerging risks such as regulatory shifts, technology changes, and third-party dependencies. Historical incident reviews, audit findings, and vulnerability counts are valuable but backward-looking or narrow in scope, so they cannot fulfill the goal of identifying risks that have not yet materialized.

Answer

Increase the frequency of reviewing historical incident tickets to capture patterns in past outages.

Answer

Track the number of open vulnerabilities in the vulnerability management system and escalate when thresholds are exceeded.

Answer

Rely on the annual external audit findings to identify control weaknesses that could become risks.