CRISC IT Risk Identification Practice Test 4 — 15 Questions

Question 1

During IT risk identification, which document serves as the central repository for all identified risks, their characteristics, and current status?

Accepted Answer

Risk register. The risk register is the formal document that captures all identified risks, their attributes, and ongoing management status.

Answer

Threat model

Answer

Vulnerability database

Answer

Business impact analysis

Question 2

An organization is assessing risks related to a new cloud-based CRM system. The risk team is developing a risk scenario. Which of the following is the BEST example of a complete risk scenario following the ISACA template?

Accepted Answer

An external attacker (actor) performs a SQL injection (threat type) to exfiltrate customer records from the CRM database (event/asset); occurs during off-hours (timing); detected by IDS after 2 hours (detection); leads to regulatory fines and reputational damage (consequence).. A complete risk scenario includes actor, threat type, event, asset, timing, detection, and consequence.

Answer

A DDoS attack on the CRM disrupts service, leading to operational downtime.

Answer

A hacker exploits a vulnerability in the CRM to steal customer data, resulting in financial loss.

Answer

A disgruntled employee leaks data from the CRM, causing reputational damage.

Question 3

In the context of threat modeling for a web application, which technique is specifically designed to be integrated into Agile and DevSecOps processes, emphasizing collaboration and visualization?

Accepted Answer

VAST. VAST (Visual, Agile, and Simple Threat modeling) is tailored for Agile and DevSecOps environments.

Answer

STRIDE

Answer

TRIKE

Answer

PASTA

Question 4

A company's risk appetite statement specifies that the organization is willing to accept a moderate level of operational risk to achieve strategic agility. This statement directly influences which activity during IT risk identification?

Accepted Answer

Establishing risk tolerance thresholds for operational risk. Risk appetite guides which risks are acceptable and helps prioritize risk scenarios, influencing the scope of risk identification.

Answer

Defining the IT risk universe

Answer

Determining the risk capacity of the organization

Answer

Selecting threat intelligence sources

Question 5

Which of the following is a primary source of threat intelligence that provides real-time information about active cyber threats and indicators of compromise?

Accepted Answer

OSINT. Open Source Intelligence (OSINT) includes publicly available data like threat feeds and forums.

Answer

OWASP Top 10

Answer

CIS Benchmarks

Answer

NVD

Question 6

A bank is identifying IT risks and categorizes a potential data breach as both a compliance risk (due to GDPR) and a reputational risk. This is an example of:

Accepted Answer

Multiple risk categories for a single risk. A single risk can belong to multiple categories; this is normal in risk categorization.

Answer

Risk aggregation

Answer

Improper risk classification

Answer

Risk scenario overlap

Question 7

During a threat modeling exercise using the STRIDE methodology, a security analyst identifies a threat where an attacker can modify data in transit between a web server and database. Which STRIDE category does this threat belong to?

Accepted Answer

Tampering. Tampering involves unauthorized modification of data, which is the 'T' in STRIDE.

Answer

Repudiation

Answer

Spoofing

Answer

Information Disclosure

Question 8

An organization uses the CISA Known Exploited Vulnerabilities (KEV) catalog as a primary source for vulnerability identification. This catalog is BEST described as:

Accepted Answer

A list of known exploited vulnerabilities maintained by the US government. CISA KEV lists vulnerabilities that have been actively exploited in the wild, providing prioritized vulnerability intelligence.

Answer

An application vulnerability scanning tool

Answer

A commercial threat intelligence feed

Answer

A configuration vulnerability assessment benchmark

Question 9

Which type of threat actor is characterized by having significant resources, advanced skills, and often state-sponsored objectives?

Accepted Answer

Nation-state APTs. Nation-state Advanced Persistent Threats (APTs) are sophisticated, well-funded, and often state-sponsored.

Answer

Script kiddies

Answer

Organized crime

Answer

Hacktivists

Question 10

In developing a risk scenario, connecting a threat event to business impact is crucial. Which of the following is the BEST example of a properly connected risk scenario?

Accepted Answer

A DDoS attack causes website unavailability for 4 hours, resulting in $500,000 lost sales and customer churn.. A proper connection shows the chain from threat to impact on business.

Answer

A firewall misconfiguration allows unauthorized access, causing a security incident.

Answer

A ransomware attack encrypts files, leading to IT department overtime.

Answer

An insider steals data, leading to legal fees.

Question 11

When performing asset-based vulnerability identification, a security analyst uses the Common Vulnerabilities and Exposures (CVE) database along with the National Vulnerability Database (NVD). Which of the following BEST describes the relationship between CVE and NVD?

Accepted Answer

CVE provides unique identifiers for vulnerabilities, and NVD provides additional analysis including CVSS scores.. CVE provides identifiers; NVD enriches with severity scores, impact metrics, and additional data.

Answer

Both databases are identical and maintained by the same organization.

Answer

CVE is the authoritative source for vulnerability scoring, while NVD assigns identifiers.

Answer

NVD lists only vulnerabilities that are actively exploited, while CVE lists all known vulnerabilities.

Question 12

An organization is updating its IT risk universe. Which of the following is the MOST important factor to consider when defining the universe?

Accepted Answer

All potential IT risks regardless of likelihood, including cyber, operational, compliance, third-party, project, and change risks. The risk universe should be comprehensive, covering all potential risks from various sources.

Answer

Historical loss data only

Answer

Risks that are within the current budget to mitigate

Answer

Only risks that have been realized in the past year

Question 13

A financial institution is identifying IT risks associated with a new mobile banking application. Which TWO threat modeling techniques are best suited for this scenario? (Select two.)

Accepted Answer

STRIDE. STRIDE is ideal for application threat modeling, and PASTA provides a risk-centric approach for critical applications.

Answer

VAST

Answer

TRIKE

Answer

OWASP Top 10

Question 14

A risk manager is developing a risk scenario for a potential data breach involving a third-party cloud provider. According to the ISACA risk scenario template, which THREE elements must be included? (Select three.)

Accepted Answer

Asset/resource. The ISACA risk scenario template mandates the inclusion of threat actor, asset/resource, and consequence as core elements. These three components define who/what causes the risk, what is affected, and the impact.

Answer

Control effectiveness

Answer

Risk owner

Question 15

During a risk identification workshop, the team identifies several vulnerabilities. Which TWO of the following are examples of operational vulnerability identification? (Select two.)

Accepted Answer

Inadequate access control review process. Operational vulnerabilities include process gaps, training gaps, and control weaknesses. Configuration issues and software flaws are technical vulnerabilities.

Answer

Outdated firewall firmware

Answer

Missing security patches on servers

Answer

SQL injection vulnerability in the web application