CRISC IT Risk Identification Practice Test 3 — 15 Questions

Question 1

Which of the following best describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. The IT risk universe is a comprehensive inventory of all potential IT risks that could affect the organization, serving as a foundational input for risk identification and assessment.

Answer

A catalog of all IT assets and their vulnerabilities

Answer

A list of all past security incidents

Answer

A set of risk scenarios used for quantitative analysis

Question 2

A security analyst is using a threat modeling approach that focuses on identifying threats based on the system's requirements and design. Which threat modeling methodology is being used?

Accepted Answer

TRIKE. TRIKE is a requirements-based threat modeling methodology that uses a risk management framework to identify threats based on system requirements.

Answer

STRIDE

Answer

VAST

Answer

PASTA

Question 3

An organization has identified a new vulnerability in its web application that could allow SQL injection attacks. Which of the following sources would MOST likely have been used to identify this vulnerability?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code for vulnerabilities like SQL injection before deployment, making it a key tool for identifying application vulnerabilities.

Answer

CIS Benchmarks

Answer

NVD

Answer

DISA STIG

Question 4

During a risk assessment, the risk practitioner develops a scenario involving a disgruntled employee exfiltrating sensitive customer data through a USB drive. The organization has a strict policy against removable media but lacks technical controls to prevent USB usage. Which element of the risk scenario is the vulnerability?

Accepted Answer

Lack of technical controls to prevent USB usage. The vulnerability is the lack of technical controls to prevent USB usage, which is a weakness that can be exploited by the threat actor (disgruntled employee) to cause the threat event (data exfiltration).

Answer

Data exfiltration

Answer

Disgruntled employee

Answer

Sensitive customer data

Question 5

Which of the following is the PRIMARY purpose of a risk register?

Accepted Answer

To document and manage identified risks throughout their lifecycle. The risk register is a central repository for documenting identified risks, their analysis, and planned responses, enabling ongoing monitoring and management.

Answer

To calculate the organization's risk appetite

Answer

To report risks to regulatory authorities

Answer

To track the status of risk treatment plans

Question 6

An organization is implementing a new cloud-based customer relationship management (CRM) system. Which of the following risk categories would BEST describe the risk of the CRM system failing to meet performance expectations?

Accepted Answer

Operational risk. Operational risk includes failures in internal processes, people, systems, or external events. Performance failure of a new system is an operational risk.

Answer

Compliance risk

Answer

Strategic risk

Answer

Reputational risk

Question 7

A risk practitioner is using the ISACA risk scenario template to document a scenario. The template includes elements such as threat actor, threat type, event, asset/resource, timing, detection, and response. Which element describes the likelihood that the threat event will occur within a specific timeframe?

Accepted Answer

Timing. The 'timing' element in the ISACA scenario template captures when the event might occur and the likelihood within that timeframe, which is a key factor in determining risk probability.

Answer

Threat type

Answer

Response

Answer

Detection

Question 8

Which of the following threat actors is MOST likely to be motivated by financial gain and possess moderate to high technical capabilities?

Accepted Answer

Organized crime. Organized crime groups are primarily motivated by financial gain and often have sophisticated technical skills to carry out attacks such as ransomware, data theft, or fraud.

Answer

Hacktivist

Answer

Nation-state APT

Answer

Script kiddie

Question 9

An organization's board has issued a risk appetite statement indicating that the company is willing to accept a moderate level of operational risk but has zero tolerance for compliance violations. This statement primarily defines which of the following?

Accepted Answer

Risk appetite. Risk appetite is the amount of risk the organization is willing to accept in pursuit of its objectives. The board's statement sets the overall appetite for different risk categories.

Answer

Risk tolerance thresholds

Answer

Risk criteria

Answer

Risk capacity

Question 10

When using STRIDE for threat modeling, which threat category involves an attacker gaining unauthorized access to a system by pretending to be a legitimate user?

Accepted Answer

Spoofing. Spoofing in STRIDE refers to impersonating something or someone else to gain unauthorized access, such as using stolen credentials.

Answer

Repudiation

Answer

Information Disclosure

Answer

Tampering

Question 11

A risk practitioner is connecting a risk scenario to business impact. The scenario involves a ransomware attack that encrypts critical financial systems, resulting in a two-week outage. Which of the following is the MOST appropriate business impact category?

Accepted Answer

Operational disruption. Operational disruption directly affects the organization's ability to conduct business operations, such as system outages. While financial loss may result, the primary impact is operational disruption.

Answer

Regulatory penalty

Answer

Reputational damage

Answer

Financial loss

Question 12

An organization is assessing risks related to a third-party cloud provider. Which of the following is the BEST source of threat intelligence for identifying threats targeting the cloud infrastructure?

Accepted Answer

ISACs. ISACs (Information Sharing and Analysis Centers) provide sector-specific threat intelligence and can share information about threats targeting cloud infrastructure relevant to the organization's industry.

Answer

Government advisories

Answer

OSINT

Answer

Commercial feeds

Question 13

A risk practitioner is updating the risk register and needs to categorize risks. Which TWO of the following are standard risk categories used in IT risk management?

Accepted Answer

Strategic. Strategic and operational are standard risk categories. Financial and reputational are also common, but the question asks for the two that are standard in IT risk management frameworks. Both strategic and operational are universally recognized.

Answer

Budgetary

Answer

Technical

Answer

Environmental

Question 14

A project manager is identifying risks for a new software development project using Agile methodology. Which THREE threat modeling techniques are BEST suited for Agile/DevSecOps environments?

Accepted Answer

VAST. STRIDE is lightweight and can be used in Agile. PASTA is more comprehensive but can be adapted. VAST is specifically designed for Agile and DevSecOps. TRIKE is more requirements-heavy and less suited for Agile.

Answer

TRIKE

Answer

Attack trees

Question 15

When developing realistic risk scenarios, which THREE components are essential according to the ISACA risk scenario template?

Accepted Answer

Threat actor. The ISACA risk scenario template includes threat actor, threat event, and asset/resource as essential components. Timing, detection, and response are also included but are not always considered essential for the basic scenario.

Answer

Mitigation cost

Answer

Detection speed