CRISC IT Risk Identification Practice Test 2 — 15 Questions

Question 1

An IT risk manager is categorizing risks identified during a recent assessment. Which TWO categories would include the risk of a system outage caused by a software bug?

Accepted Answer

Operational risk. A system outage due to a software bug is an operational risk (failure in IT operations) and can also be considered a financial risk if it leads to revenue loss or penalties.

Answer

Compliance risk

Answer

Strategic risk

Answer

Reputational risk

Question 2

An organization is developing an IT risk universe. Which of the following is the PRIMARY purpose of creating a comprehensive IT risk universe?

Accepted Answer

To ensure all potential IT risks are considered and documented. The IT risk universe captures all potential IT-related risks across the enterprise, ensuring that no significant risk area is overlooked during the risk identification process.

Answer

To prioritize risks based on their financial impact

Answer

To assign risk owners to each identified risk

Answer

To calculate the aggregated risk exposure for the organization

Question 3

During a risk assessment, the risk practitioner is identifying threats to an application. Which threat modeling technique is specifically designed to analyze application threats using categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Accepted Answer

STRIDE. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a threat modeling technique developed by Microsoft for identifying application security threats.

Answer

VAST

Answer

TRIKE

Answer

PASTA

Question 4

An organization has a risk appetite statement that says 'We accept up to $5 million in operational losses per year.' However, a new cloud migration project is estimated to have a potential operational loss of $8 million if a critical failure occurs. The risk capacity of the organization is $20 million. What should the risk practitioner recommend?

Accepted Answer

Implement risk treatment measures to reduce the potential loss to below $5 million. The risk tolerance threshold ($5 million) is exceeded by the potential loss ($8 million). The risk appetite is the amount of risk the organization is willing to accept, and this scenario exceeds it. While the risk capacity is higher, the appetite is not met, so risk treatment is needed to bring the residual risk within the tolerance.

Answer

Reject the project because the risk exceeds the risk appetite

Answer

Increase the risk appetite to $8 million to align with the project

Answer

Accept the risk because the risk capacity is $20 million

Question 5

Which of the following is a threat intelligence source that provides information about known exploited vulnerabilities, maintained by a government agency?

Accepted Answer

CISA KEV. CISA KEV (Known Exploited Vulnerabilities catalog) is maintained by the U.S. Cybersecurity and Infrastructure Security Agency and provides a list of vulnerabilities that have been exploited in the wild.

Answer

OSINT

Answer

NVD

Answer

ISACs

Question 6

During a vulnerability assessment, a risk practitioner identifies that a web application is vulnerable to SQL injection, which is listed in the OWASP Top 10. Which type of vulnerability identification technique MOST likely discovered this issue?

Accepted Answer

DAST (Dynamic Application Security Testing). DAST (Dynamic Application Security Testing) tests the running application for vulnerabilities like SQL injection by simulating attacks. SAST is static code analysis, IAST is interactive testing.

Answer

SAST (Static Application Security Testing)

Answer

CIS Benchmarks comparison

Answer

DISA STIG scanning

Question 7

An organization has a risk register that includes risks related to regulatory compliance, such as GDPR and SOX. The risk practitioner is now categorizing these risks. Which risk category would BEST fit these compliance-related risks?

Accepted Answer

Compliance risk. Compliance risks refer to risks associated with violations of laws, regulations, or contractual obligations. GDPR and SOX are regulatory requirements, so they fall under compliance risk.

Answer

Financial risk

Answer

Operational risk

Answer

Strategic risk

Question 8

A risk practitioner is developing a risk scenario for a data breach caused by an insider threat. Which of the following is the MOST realistic and complete risk scenario?

Accepted Answer

A disgruntled employee with excessive access privileges exfiltrates customer data to a competitor, resulting in a $2 million loss.. Describes a complete scenario: a threat actor (disgruntled employee) with a motive, a threat event (exfiltration), a vulnerability (excessive access), and a consequence (financial loss). Other options lack one element (e.g., no vulnerability or incomplete consequence).

Answer

A careless employee leaves a laptop unencrypted, leading to data loss, but no financial impact.

Answer

An external hacker uses stolen credentials to access the network and steal data, causing reputational damage.

Answer

A script kiddie launches a DDoS attack that disrupts service for 2 hours, causing no data loss.

Question 9

Which of the following threat actors is MOST likely to be motivated by ideology rather than financial gain?

Accepted Answer

Hacktivist. Hacktivists are typically motivated by political or social causes, not financial profit. Nation-state APTs may have strategic motives, organized crime is financially driven, script kiddies seek notoriety.

Answer

Organized crime

Answer

Nation-state APT

Answer

Script kiddie

Question 10

A risk practitioner is updating the risk register after a third-party security incident. Which of the following is the MOST important information to include in the risk register entry for this third-party risk?

Accepted Answer

A description of the risk event, its impact, and the response taken. The risk register should include a description of the risk event, its impact, and the response. While other details are relevant, the core of the entry is the event and its consequences.

Answer

The remediation plan and the risk owner's signature

Answer

The date of the incident and the amount of data compromised

Answer

The name and contact details of the third party

Question 11

An organization uses the PASTA threat modeling methodology for a new e-commerce platform. Which of the following is a key characteristic of PASTA?

Accepted Answer

It emphasizes business impact analysis and attack simulation. PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling methodology that includes business impact analysis and attack simulation, aligning security with business objectives.

Answer

It is a requirements-based model that uses a risk management perspective

Answer

It uses visual diagrams to represent threats in an agile manner

Answer

It focuses on agile development and integrates with DevSecOps

Question 12

When identifying vulnerabilities, which of the following is the BEST source for configuration-related vulnerabilities in operating systems?

Accepted Answer

CIS Benchmarks. CIS Benchmarks are industry-recognized configuration guidelines that help identify and remediate configuration-related vulnerabilities in operating systems. Unlike NVD or CVE which catalog known vulnerabilities, CIS Benchmarks provide actionable hardening steps for system configurations.

Answer

NVD

Answer

CVE database

Answer

OWASP Top 10

Question 13

Which TWO of the following are examples of operational vulnerabilities that a risk practitioner might identify?

Accepted Answer

Insufficient security awareness training for employees. Operational vulnerabilities include process gaps (e.g., lack of segregation of duties) and training gaps (e.g., insufficient awareness training). The other options are technical vulnerabilities or threat types.

Answer

Phishing emails targeting senior executives

Answer

SQL injection vulnerability in a web application

Answer

Unpatched software in the production environment

Question 14

A risk practitioner is developing risk scenarios for a new cloud service. Which THREE of the following elements should be included in a complete risk scenario?

Accepted Answer

Threat event. A complete risk scenario includes a threat actor, a threat event, and a consequence. Asset/resource is also important but not listed in the options; timing, detection, and response are supplementary. The three core elements from the list are threat actor, threat event, and consequence.

Answer

Response plan

Answer

Detection mechanism

Question 15

Which THREE of the following are common business impact categories used in risk scenarios?

Accepted Answer

Reputational damage. Common business impact categories include financial loss, regulatory penalty, and reputational damage. Technical downtime is a cause, not an impact category; strategic misalignment is a risk factor.

Answer

Strategic misalignment

Answer

Technical downtime