CRISC IT Risk Identification Practice Test 12 — 15 Questions

Question 1

A manufacturer is identifying IT risk associated with a legacy inventory management system that no longer receives vendor security patches. The risk practitioner documents the unsupported platform as a vulnerability. Which additional asset-based factor should the practitioner evaluate to determine how this vulnerability contributes to overall risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The value and criticality of the asset to business operations. Vulnerabilities gain risk significance through the assets they affect, so determining the value and criticality of the legacy inventory system establishes the potential business consequence of exploitation. Without this asset context, an unpatched platform is merely a technical finding. Vendor counts, audit cadence, and open finding totals are organizational metrics that do not describe how much loss the manufacturer would suffer from this specific vulnerability.

Answer

The frequency of the organization's internal audit cycle

Answer

The total count of open findings in the risk register

Answer

The number of vendors in the organization's third-party inventory

Question 2

A risk practitioner is performing an external threat environment analysis for a retail chain that accepts card payments. The practitioner wants to identify which external factors should be treated as inputs to the likelihood of payment card data compromise. Which TWO of the following are the MOST appropriate inputs? (Choose two.)

Accepted Answer

The prevalence and activity level of organized criminal groups that monetize stolen card data.. External threat inputs describe conditions outside the organization's control that shape how likely an attack is. Organized criminal activity that monetizes card data, and published reports of skimming and shimming techniques used against comparable retailers, both reflect adversary capability and intent in the card payment ecosystem. Terminal counts, cashier turnover, and audit completion are internal attributes better suited to vulnerability, impact, or assurance analysis.

Answer

The percentage of the chain's stores that have completed a recent internal audit.

Answer

The turnover rate among store cashiers and the adequacy of their security awareness training.

Answer

The number of point-of-sale terminals the chain operates across all stores.

Question 3

A global logistics company's risk practitioner is identifying risks for a new customs-clearance application. She wants to ensure the risk identification is complete before moving to analysis. Which of the following approaches BEST supports completeness of the risk identification?

Accepted Answer

Facilitating structured workshops with business, IT, compliance, and third-party representatives using a risk taxonomy as a prompt. Complete risk identification requires broad, structured input across business, technology, compliance, and third-party perspectives. A facilitated workshop using a risk taxonomy as a prompt systematically covers categories and surfaces interdependencies that single-source methods miss. Documentation reviews, vulnerability scans, and individual interviews each provide narrow slices and cannot by themselves ensure completeness before analysis.

Answer

Running an automated vulnerability scan against the application's internet-facing components and importing the results

Answer

Reviewing only the application's architecture diagrams and data flow documentation produced by the development team

Answer

Interviewing the application's lead developer about the technologies and frameworks used to build the system

Question 4

A risk practitioner at a software company is reviewing external sources to identify emerging IT risks that could affect the organization's cloud-hosted products. The practitioner wants to use sources that provide structured, timely information about newly disclosed software weaknesses. Which TWO of the following sources BEST meet this need? (Choose two.)

Accepted Answer

National Vulnerability Database (NVD) records. Emerging IT risk identification benefits from external, structured, and current sources that describe newly disclosed weaknesses. CVE listings supply standardized identifiers for disclosed vulnerabilities, and NVD records add severity scoring and product mappings that let the practitioner prioritize. Together they provide the timeliness and structure needed. Internal surveys, past audit findings, and facilities logs are either retrospective, unrelated to software weaknesses, or both, so they cannot fulfill the same purpose.

Answer

Prior-year internal audit findings

Answer

Internal employee satisfaction survey results

Answer

Facilities maintenance work order logs

Question 5

A financial services firm is conducting a risk assessment for a new mobile banking application. The risk practitioner needs to evaluate the likelihood of a threat exploiting a vulnerability. Which of the following factors is MOST relevant when assessing the likelihood of a threat event?

Accepted Answer

The technical skill and motivation of threat actors targeting the mobile banking application.. When assessing likelihood, the risk practitioner focuses on factors that influence the probability of a threat event, such as threat capability, motivation, and the attractiveness of the target. In this scenario, the technical skill and motivation of threat actors targeting the mobile banking application directly affect how likely an attack is. Asset value, control effectiveness, and regulatory penalties are more related to impact or residual risk, not the inherent likelihood of the threat event.

Answer

The regulatory penalties that could result from a data breach involving the mobile application.

Answer

The monetary value of the assets that could be impacted by the threat event.

Answer

The effectiveness of the controls currently in place to prevent or detect the threat event.

Question 6

A risk practitioner is facilitating a workshop to identify risks for a new customer-facing payment portal. The CISO wants the exercise to capture risks arising from both internal process weaknesses and external threat sources without producing an unmanageable list. Which approach is MOST appropriate for structuring the risk identification effort?

Accepted Answer

Use a structured technique such as scenario analysis that pairs threat sources with affected assets and business processes.. Structured scenario analysis pairs credible threat sources with the assets and business processes they could affect, producing a comprehensive yet bounded set of risk statements. This technique captures internal weaknesses such as process gaps and external sources such as criminal actors in a consistent format, supports later likelihood and impact assessment, and keeps the register manageable. Testing, unrestricted brainstorming, and vendor templates each fall short on coverage, consistency, or relevance.

Answer

Conduct a penetration test of the portal and register only the findings that result in successful exploitation.

Answer

Ask each workshop participant to submit an unrestricted list of every concern they have about the portal.

Answer

Adopt the vendor's standard risk register template and record the categories the vendor already populated.

Question 7

A risk practitioner is identifying risks associated with the decommissioning of a legacy data center. The organization plans to migrate all remaining applications to a cloud environment. Which TWO of the following are the MOST significant risks that should be included in the risk register for this project? (Choose two.)

Accepted Answer

Incomplete destruction of sensitive data on decommissioned storage media, leading to unauthorized disclosure.. The decommissioning of a legacy data center involves unique risks. Loss of institutional knowledge can lead to migration errors and outages, while incomplete data destruction can cause data breaches. These two risks are directly tied to the decommissioning process and should be prioritized in the risk register. Regulatory data residency, cloud cost spikes, and continuity plan updates are important but are either related to the cloud migration itself or are control activities, not the primary risks of decommissioning.

Answer

Failure to update the IT service continuity plan to reflect the new cloud architecture.

Answer

Inability to meet new regulatory requirements for data residency in the cloud environment.

Answer

Increased cloud subscription costs due to unexpected usage spikes after migration.

Question 8

A utility company's risk practitioner is defining the scope of a risk identification exercise for a new advanced metering infrastructure. The practitioner must decide which elements to include. Which action BEST ensures the identification exercise covers the full risk landscape?

Accepted Answer

Include internal processes, third parties, and dependencies that interact with the new infrastructure.. A complete identification exercise follows the service and data flows rather than the project's technical boundary. For advanced metering infrastructure, that means including internal billing and outage processes, third-party communication providers, field operations, and regulatory dependencies, because risks frequently arise at these interfaces. A technology-only scope, a register-driven scope, or a deferred timeline would all leave material exposures unidentified or identified too late to influence design.

Answer

Limit the exercise to the technologies the project team will deploy directly.

Answer

Base scope on the risk categories already recorded in the enterprise risk register.

Answer

Defer identification until the infrastructure has been operating for one full billing cycle.

Question 9

A global manufacturer's risk committee is defining the organization's risk capacity and risk appetite for IT risk. The chief risk officer asks the practitioner to clarify how these two concepts relate. Which of the following statements is MOST accurate?

Accepted Answer

Risk capacity is the maximum risk the organization can bear, and risk appetite is the amount of risk it is willing to accept, with appetite normally set within capacity.. Risk capacity defines the outer limit of risk the organization can absorb, while risk appetite is the lower, deliberately chosen level of risk it is willing to accept to pursue objectives. Appetite is normally set within capacity so that a buffer remains for unexpected losses. This hierarchy lets the committee translate strategy into tolerances and limits, and it prevents risk-taking from silently approaching the point where the organization's viability is threatened.

Answer

Risk appetite applies only to financial risks, while risk capacity applies only to IT and operational risks.

Answer

Risk appetite is the maximum loss the organization can absorb, while risk capacity is the amount of risk management is willing to pursue for returns.

Answer

Risk capacity and risk appetite are interchangeable terms that both describe management's willingness to accept risk.

Question 10

A risk practitioner is assessing the effectiveness of the control environment supporting an online trading platform. Management asserts that controls are mature, but the practitioner must determine which activities constitute control monitoring rather than one-time assurance. Which TWO of the following activities are examples of ongoing control monitoring? (Choose two.)

Accepted Answer

Reviewing a monthly dashboard of failed login attempts and account lockouts against defined thresholds.. Ongoing monitoring relies on recurring observation with defined thresholds, ownership, and escalation. Reviewing authentication dashboards against thresholds and tracking remediation of open findings both provide continuous visibility into whether controls operate as intended and allow timely intervention. Periodic penetration tests, annual self-assessments, and register documentation are point-in-time or record-keeping activities that do not deliver the continuous feedback loop monitoring requires.

Answer

Documenting the control environment in the risk register during the annual risk assessment cycle.

Answer

Performing a control self-assessment workshop with process owners at the start of the fiscal year.

Answer

Commissioning an external penetration test of the trading platform once every two years.

Question 11

A regional insurance company has just completed an IT risk assessment and documented the identified risks in a central repository. The risk practitioner now wants to ensure that each risk has an assigned owner, a defined response, and a status that can be tracked over time. Which of the following should the practitioner use to meet these needs?

Accepted Answer

A risk register. The central repository for documented risks, with fields for ownership, response, and status, is the risk register. It is the mechanism that turns assessment output into managed, trackable items and provides the basis for reporting on treatment progress. The other artifacts listed serve different purposes: impact analysis, control assessment, and continuity planning all feed or complement risk management but do not replace the register.

Answer

A control self-assessment (CSA) questionnaire

Answer

An IT service continuity plan

Answer

A business impact analysis (BIA)

Question 12

A financial services firm is identifying risks for a new mobile banking feature that will rely on a third-party identity verification provider. The vendor has provided a SOC 2 Type II report, but the firm has not yet reviewed it. Which of the following BEST describes how the firm should treat the vendor-related risk during identification?

Accepted Answer

Record the vendor dependency as a risk and assess it after reviewing the report's scope, period, and exceptions.. Third-party dependencies must be identified and recorded regardless of the assurance a vendor provides. The firm should log the dependency and then assess it using the SOC 2 Type II report's scope, coverage period, complementary user entity controls, and exceptions, so that residual risk is judged realistically. Assurance evidence informs the assessment; it does not remove the dependency from the register or transfer the firm's accountability.

Answer

Exclude vendor risk from the register because the SOC 2 Type II report demonstrates adequate controls.

Answer

Transfer the risk entirely to the vendor by referencing the SOC 2 report in the contract.

Answer

Defer identification until the vendor completes a penetration test of the identity verification platform.

Question 13

A risk practitioner at a regional bank is building risk scenarios for the new mobile check deposit feature. The team has identified the event 'attackers exploit a vulnerability in the image processing library to inject malicious code.' Which of the following BEST describes the element that is missing from this risk scenario?

Accepted Answer

The asset or business process affected and the resulting business impact.. ISACA describes a risk scenario as a threat event acting on an asset or process and producing a business impact. The stem supplies the threat and vulnerability but omits the affected asset and consequence, so the practitioner cannot assess likelihood or impact meaningfully. Adding the asset and impact makes the scenario actionable for risk analysis and prioritization.

Answer

The threat community profile, including capability and intent.

Answer

The control environment currently in place to mitigate the event.

Answer

The regulatory requirement that mandates protection of customer data.

Question 14

A hospital's risk practitioner is identifying risks for a new telehealth platform. The IT director asks which source would be MOST useful for identifying vulnerabilities specific to the platform's underlying commercial software components. Which of the following should the practitioner use?

Accepted Answer

The Common Vulnerabilities and Exposures (CVE) database.. CVE is the standard reference catalog for publicly known vulnerabilities in commercial and open-source products, making it the most direct source for identifying weaknesses in the telehealth platform's software components. The other sources address incidents, business impact, or service performance rather than the technical vulnerabilities present in the commercial software itself.

Answer

A business impact analysis (BIA) questionnaire.

Answer

The IT balanced scorecard and service level reports.

Answer

The organization's incident response postmortem reports.

Question 15

A risk practitioner is assessing the risk of a distributed denial-of-service (DDoS) attack against an online retailer's public storefront. The CISO asks which factors would MOST directly increase the likelihood that such an attack would succeed in disrupting service. (Choose two.)

Accepted Answer

The storefront's public IP addresses are easily discoverable through DNS records.. DDoS success hinges on whether attack traffic can reach and overwhelm the target. Missing upstream mitigation lets traffic hit the origin unfiltered, and discoverable origin IP addresses let attackers bypass protective layers to strike directly. Together these conditions materially raise the likelihood of service disruption, while payment options, marketing spikes, and support outsourcing do not directly determine whether the attack succeeds.

Answer

The retailer's marketing team runs frequent flash sales with unpredictable traffic spikes.

Answer

The retailer accepts multiple payment card brands at checkout.

Answer

The retailer's customer service team is outsourced to a third party.