CRISC IT Risk Identification Practice Test 2 — 15 Questions

Question 1

A company's risk appetite statement specifies that the organization is willing to accept a moderate level of operational risk to achieve strategic agility. This statement directly influences which activity during IT risk identification?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establishing risk tolerance thresholds for operational risk. Risk appetite guides which risks are acceptable and helps prioritize risk scenarios, influencing the scope of risk identification.

Answer

Defining the IT risk universe

Answer

Determining the risk capacity of the organization

Answer

Selecting threat intelligence sources

Question 2

Which of the following is a primary source of threat intelligence that provides real-time information about active cyber threats and indicators of compromise?

Accepted Answer

OSINT. OSINT (Open-Source Intelligence) is the correct answer because it encompasses publicly available information from diverse sources—such as social media, forums, threat feeds, and government advisories—that can provide real-time updates on active cyber threats and indicators of compromise (IOCs). Unlike static frameworks or databases, OSINT is continuously updated and can include timely data on emerging attacks, malware signatures, and attacker tactics. This makes it a primary source for real-time threat intelligence in risk management contexts.

Answer

OWASP Top 10

Answer

CIS Benchmarks

Answer

NVD

Question 3

A financial institution is identifying IT risks associated with a new mobile banking application. Which TWO threat modeling techniques are best suited for this scenario? (Select two.)

Accepted Answer

STRIDE. STRIDE (A) is correct because it is a structured, Microsoft-originated threat modeling methodology that systematically categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, which directly maps to the security concerns of a mobile banking application handling authentication, transactions, and sensitive financial data. PASTA (B) is correct because it is a risk-centric, attacker-oriented methodology (Process for Attack Simulation and Threat Analysis) that aligns business objectives with technical threats, making it well suited for a financial institution that must tie IT risks to business impact and regulatory concerns. VAST (C) is not among the selected answers because, while it is a scalable agile threat modeling framework, it is not one of the two techniques identified as best suited here. TRIKE (D) is not selected because it is a risk-based threat modeling framework focused on security and privacy requirements modeling, but it is not marked as correct for this scenario. OWASP Top 10 (E) is not selected because it is a awareness document listing common web application vulnerabilities rather than a threat modeling technique.

Answer

VAST

Answer

TRIKE

Answer

OWASP Top 10

Question 4

A risk manager is developing a risk scenario for a potential data breach involving a third-party cloud provider. According to the ISACA risk scenario template, which THREE elements must be included? (Select three.)

Accepted Answer

Asset/resource. According to the ISACA risk scenario template, a risk scenario must be built around three core elements: the asset/resource (A), which identifies what is at risk in the third-party cloud data breach; the threat actor (E), which specifies who or what could cause the breach; and the consequence (B), which describes the resulting business impact. These three components together define the scenario by linking the target, the source of the threat, and the outcome. Control effectiveness (C) is not a required element of the scenario itself; it is assessed separately when evaluating risk likelihood and impact. Risk owner (D) is also not part of the scenario template; it is assigned during risk response and accountability processes rather than scenario definition.

Answer

Control effectiveness

Answer

Risk owner

Question 5

Which threat modeling technique is specifically designed to be integrated into Agile and DevSecOps processes, providing a visual and simple approach?

Accepted Answer

VAST. VAST (Visual Agile and Simple Threat) is tailored for Agile and DevSecOps environments, emphasizing simplicity and visual representation.

Answer

TRIKE

Answer

PASTA

Answer

STRIDE

Question 6

An organization's risk register contains a scenario: 'A nation-state actor exploits an unpatched vulnerability in a public-facing web application, leading to data exfiltration of customer PII.' According to ISACA's risk scenario template, which element is MISSING from this description?

Accepted Answer

Timing. ISACA's risk scenario template typically includes elements such as actor, threat type, event, asset, timing, detection, and consequence. The scenario describes the actor (nation-state), threat type (exploitation of unpatched vulnerability), event (data exfiltration), and asset (customer PII), but it does not specify when the event occurs or over what timeframe — the timing element is missing. Detection is also not explicitly stated, but timing is the element most clearly absent from the described components.

Answer

Detection

Answer

Consequence

Answer

Vulnerability

Question 7

An organization is conducting a threat identification exercise using the STRIDE model. Which threat type would be MOST relevant when analyzing a banking application that allows fund transfers between accounts?

Accepted Answer

Tampering. Tampering involves unauthorized modification of data or messages, and a banking application that allows fund transfers is directly exposed to tampering threats such as altering transaction amounts, account numbers, or transfer instructions. STRIDE's Tampering category is the most relevant because the integrity of financial transactions is the primary asset at risk.

Answer

Repudiation

Answer

Spoofing

Answer

Information Disclosure

Question 8

A risk practitioner is identifying vulnerabilities in an organization's IT environment. Which TWO of the following are examples of 'operational vulnerability identification'? (Choose two.)

Accepted Answer

Lack of segregation of duties in IT administration. Lack of segregation of duties in IT administration is an operational vulnerability. It arises from inadequate processes and controls within the organization's operations, such as allowing a single administrator to both approve and execute changes, which increases the risk of unauthorized or malicious actions. This is a process-level weakness, not a technical flaw in a specific system or code.

Answer

SQL injection vulnerability in a web application

Answer

Default passwords on network devices

Answer

Missing security patches on critical servers

Question 9

A risk register is being created for a new ERP implementation project. Which TWO of the following risks should be included in the project's risk register? (Choose two.)

Accepted Answer

Risk of project delays due to resource shortages. Options C and D are correct because they are project-management risks directly tied to the ERP implementation effort: resource shortages can delay deliverables and milestones, and scope creep can drive costs beyond the approved budget, both of which belong in the project risk register. Option A is incorrect because a misconfigured cloud storage data breach is an operational/security risk typically tracked in a security or IT risk register rather than the project risk register. Option B is incorrect because regulatory non-compliance with data protection laws is a compliance/legal risk usually managed in a corporate compliance or enterprise risk register. Option E is incorrect because data center hardware failure is an infrastructure/operational risk handled by IT operations and business continuity planning, not the ERP project's risk register.

Answer

Risk of data breach due to misconfigured cloud storage

Answer

Risk of regulatory non-compliance with new data protection laws

Answer

Risk of hardware failure in the data center

Question 10

A financial institution uses threat intelligence from an Information Sharing and Analysis Center (ISAC). This is an example of which type of threat intelligence source?

Accepted Answer

ISAC. ISACs are industry-specific, trusted communities for sharing threat intelligence.

Answer

Open-source intelligence (OSINT)

Answer

Government advisories

Answer

Commercial feeds

Question 11

A risk analyst is identifying operational vulnerabilities. Which TWO of the following are examples of operational vulnerability identification?

Accepted Answer

Discovering lack of security awareness training. Operational vulnerabilities stem from weaknesses in people, processes, and day-to-day controls rather than from technical code or configuration defects. Option D is correct because a lack of security awareness training is a classic human/process weakness that enables social engineering, phishing, and policy violations, making it an operational vulnerability. Option E is correct because inadequate access controls reflect a flawed operational process (e.g., missing least-privilege enforcement, poor account provisioning/review), which is an operational rather than purely technical issue. Option A is incorrect because reviewing CIS Benchmarks addresses technical configuration hardening baselines, not operational process weaknesses. Option B is incorrect because SQL injection flaws are software/code-level technical vulnerabilities found through secure code review or SAST/DAST. Option C is incorrect because patch scanning identifies technical vulnerabilities (missing software updates) via tools like Nessus or Qualys, not operational ones.

Answer

Reviewing CIS Benchmarks for server configuration

Answer

Analyzing SQL injection flaws in code

Answer

Scanning for missing patches using a vulnerability scanner

Question 12

A multinational corporation is developing a new e-commerce platform using microservices architecture. The security team is conducting a threat modeling exercise to identify potential application-level threats. Which TWO threat modeling methodologies are most appropriate for this DevSecOps environment?

Accepted Answer

STRIDE. STRIDE (B) is correct because it is a developer-centric threat modeling methodology that categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, making it ideal for identifying application-level threats in a microservices DevSecOps pipeline. PASTA (D) is correct because it is a risk-centric, attacker-oriented methodology that aligns business objectives with technical threats through seven stages, which suits the complex, distributed nature of a multinational e-commerce microservices platform. OWASP Top 10 (C) is not a threat modeling methodology but a awareness list of common web application vulnerabilities, so it does not provide the structured threat enumeration required here. VAST (A) is a scalable agile threat modeling framework but is less commonly adopted for application-level threat identification than STRIDE or PASTA in this context, and TRIKE (E) is a risk-based methodology focused on security auditing and compliance rather than the application threat modeling needed for a DevSecOps microservices environment.

Answer

VAST

Answer

OWASP Top 10

Answer

TRIKE

Question 13

An organization is updating its IT risk universe to include emerging threats. The CISO wants to ensure the risk register captures realistic risk scenarios. Which THREE components are essential for constructing a complete risk scenario according to ISACA's risk scenario template?

Accepted Answer

Event. According to ISACA's risk scenario template, a complete risk scenario must identify the Event (A), which describes what happens (e.g., data breach, service outage), the Actor (B), which identifies who or what causes the event (e.g., malicious insider, external attacker, nature), and the Threat type (C), which classifies the nature of the threat (e.g., cyber, physical, human error). These three components together define the who, what, and how of the scenario, enabling realistic risk assessment and response planning. Timing (D) and Detection (E) are relevant operational factors but are not part of the core ISACA risk scenario construct; timing may appear in some templates as a contextual attribute, but it is not one of the three essential components, and detection relates to controls rather than scenario definition.

Answer

Timing

Answer

Detection

Question 14

A financial services firm is assessing vulnerabilities in its web application. The team wants to identify application-level vulnerabilities that could be exploited. Which TWO vulnerability identification techniques should be prioritized for this purpose?

Accepted Answer

SAST (Static Application Security Testing). SAST (Static Application Security Testing) analyzes source code for vulnerabilities, and DAST (Dynamic Application Security Testing) tests running applications. IAST combines both but is less common. CVE database and CIS Benchmarks are asset- and configuration-focused, not application-specific.

Answer

IAST (Interactive Application Security Testing)

Answer

CVE database review

Answer

CIS Benchmarks comparison

Question 15

An organization is creating a risk register for its IT risk universe. The risk manager needs to categorize risks to align with the enterprise risk management framework. Which TWO risk categories are most commonly used in IT risk identification?

Accepted Answer

Operational. Operational risk (A) is a core IT risk category because it covers failures in day-to-day processes, systems, people, and technology—such as outages, misconfigurations, and human error—which are central to IT risk identification. Compliance risk (D) is also a standard IT risk category because IT must satisfy legal, regulatory, and contractual requirements (e.g., GDPR, HIPAA, PCI DSS, SOX), and noncompliance is a primary risk driver in the IT risk universe. Financial (B), reputational (C), and strategic (E) risks are valid enterprise risk domains, but they are typically treated as broader business-level categories or downstream impacts rather than the two most commonly used IT-specific risk categories in risk identification.

Answer

Financial

Answer

Reputational

Answer

Strategic