CRISC IT Risk Identification Practice Test 5 — 15 Questions

Question 1

During the risk identification process, an IT risk universe is defined. Which of the following BEST describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. The IT risk universe is a comprehensive inventory of all potential IT risks that could affect the organization, serving as the foundation for further risk assessment and treatment.

Answer

A list of all known vulnerabilities in the organization's IT systems

Answer

A database of past security incidents and their root causes

Answer

A framework for categorizing risks into strategic, operational, financial, and compliance

Question 2

Which threat modeling technique is specifically designed to be integrated into Agile and DevSecOps processes, providing a visual and simple approach?

Accepted Answer

VAST. VAST (Visual Agile and Simple Threat) is tailored for Agile and DevSecOps environments, emphasizing simplicity and visual representation.

Answer

TRIKE

Answer

PASTA

Answer

STRIDE

Question 3

An organization's risk register contains a scenario: 'A nation-state actor exploits an unpatched vulnerability in a public-facing web application, leading to data exfiltration of customer PII.' According to ISACA's risk scenario template, which element is MISSING from this description?

Accepted Answer

Timing. ISACA's risk scenario template includes: actor, threat type, event, asset/resource, timing, detection, and response. The scenario lacks timing (when the event occurs or duration).

Answer

Detection

Answer

Consequence

Answer

Vulnerability

Question 4

A risk practitioner is categorizing IT risks for a manufacturing company. Which of the following risks would be classified as an 'operational' IT risk?

Accepted Answer

Risk of production line downtime due to a server failure. Operational IT risks relate to the day-to-day functioning of IT systems and processes. Production line downtime due to a system failure directly impacts operations.

Answer

Risk of financial loss from a ransomware payment

Answer

Risk of non-compliance with GDPR for customer data stored in the EU

Answer

Risk of reputational damage from a data breach

Question 5

Which of the following is the PRIMARY source for identifying known software vulnerabilities in a systematic manner?

Accepted Answer

National Vulnerability Database (NVD). The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data, including CVE entries and severity scores.

Answer

OSINT feeds from social media

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 6

An organization uses threat intelligence feeds from an Information Sharing and Analysis Center (ISAC). What is the PRIMARY benefit of using ISACs?

Accepted Answer

They facilitate sharing of sector-specific threat intelligence. ISACs provide sector-specific threat intelligence and enable trusted information sharing among members, often with real-time alerts on relevant threats.

Answer

They provide free antivirus software to members

Answer

They offer legally binding threat response protocols

Answer

They replace the need for internal threat hunting

Question 7

A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?

Accepted Answer

A new cloud service may inadvertently expose customer PII due to misconfiguration. Given the low tolerance for compliance risk, any potential compliance violation (like PII exposure) must be escalated immediately, even if operational risk is moderate.

Answer

A planned system upgrade may cause two hours of downtime during maintenance window

Answer

A vendor is late in delivering a software patch for a low-severity bug

Answer

An employee mistakenly deletes a non-critical test database

Question 8

Which of the following BEST describes the difference between a threat actor who is a 'hacktivist' and one who is an 'organized crime' actor?

Accepted Answer

Hacktivists are motivated by ideology; organized crime actors are motivated by financial gain. Hacktivists are typically motivated by political or social causes, while organized crime groups are primarily financially motivated.

Answer

Hacktivists target only government entities; organized crime targets only businesses

Answer

Hacktivists are always insiders; organized crime actors are external

Answer

Hacktivists use advanced persistent threats (APTs); organized crime uses commodity malware

Question 9

A risk scenario is being developed for a phishing attack leading to credential theft. Using ISACA's risk scenario template, which component would describe the 'threat event'?

Accepted Answer

A user clicks a malicious link in a phishing email. The threat event is the action that triggers the risk scenario. In this case, 'A user clicks a malicious link in a phishing email' is the event that leads to the compromise.

Answer

The organization's email security filter fails to block the phishing email

Answer

The attacker is an organized crime group based overseas

Answer

The compromised credentials are used to access a financial system

Question 10

Which of the following is an example of a 'configuration vulnerability' that should be identified during vulnerability assessment?

Accepted Answer

Default administrative passwords left unchanged on a network device. A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

Answer

A buffer overflow in a custom application

Answer

An SQL injection flaw in a web form

Answer

Missing security patches on a server

Question 11

When developing IT risk scenarios, connecting them to business impact is critical. Which of the following BEST describes how a risk practitioner should link a technical scenario to business impact?

Accepted Answer

Quantify the impact in terms of financial loss, regulatory penalty, and operational disruption. The correct approach is to map the technical scenario to specific business outcomes such as financial loss, regulatory penalties, or reputational damage, allowing management to understand the significance.

Answer

Assign a likelihood rating and an inherent risk score

Answer

Describe the technical steps of the attack in detail

Answer

Reference industry benchmarks for similar scenarios

Question 12

An organization is conducting a threat identification exercise using the STRIDE model. Which threat type would be MOST relevant when analyzing a banking application that allows fund transfers between accounts?

Accepted Answer

Tampering. STRIDE includes: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Tampering is the unauthorized modification of data, directly relevant to fund transfers where transaction amounts or destinations could be altered.

Answer

Repudiation

Answer

Spoofing

Answer

Information Disclosure

Question 13

A risk practitioner is identifying vulnerabilities in an organization's IT environment. Which TWO of the following are examples of 'operational vulnerability identification'? (Choose two.)

Accepted Answer

Lack of segregation of duties in IT administration. Lack of segregation of duties in IT administration is an operational vulnerability. It arises from inadequate processes and controls within the organization's operations, such as allowing a single administrator to both approve and execute changes, which increases the risk of unauthorized or malicious actions. This is a process-level weakness, not a technical flaw in a specific system or code.

Answer

SQL injection vulnerability in a web application

Answer

Default passwords on network devices

Answer

Missing security patches on critical servers

Question 14

During risk identification, a risk manager is reviewing threat intelligence sources. Which THREE of the following are considered legitimate sources of threat intelligence? (Choose three.)

Accepted Answer

Government advisories such as CISA Known Exploited Vulnerabilities (KEV) catalog. OSINT (open-source intelligence), ISACs (sector-specific sharing), and government advisories (e.g., CISA KEV) are established threat intelligence sources. Social media rumor and vendor sales pitches are not reliable.

Answer

Unverified social media rumors

Answer

Vendor sales presentations

Question 15

A risk register is being created for a new ERP implementation project. Which TWO of the following risks should be included in the project's risk register? (Choose two.)

Accepted Answer

Risk of project delays due to resource shortages. Project risks include delays, budget overruns, and scope changes. Data breach and regulatory non-compliance are operational/compliance risks that may apply post-implementation but are not specific to the project's execution.

Answer

Risk of data breach due to misconfigured cloud storage

Answer

Risk of regulatory non-compliance with new data protection laws

Answer

Risk of hardware failure in the data center