CRISC IT Risk Identification Practice Test 6 — 15 Questions

Question 1

An organization is updating its IT risk universe. Which of the following is the MOST important factor to consider when defining the universe?

Accepted Answer

All potential IT risks regardless of likelihood, including cyber, operational, compliance, third-party, project, and change risks. The IT risk universe should be comprehensive — it must capture all potential IT risks regardless of likelihood, including cyber, operational, compliance, third-party, project, and change risks. Defining the universe is an identification exercise, not a prioritization exercise; filtering by likelihood, budget, or past occurrence at this stage would create blind spots and undermine the risk register's completeness.

Answer

Historical loss data only

Answer

Risks that are within the current budget to mitigate

Answer

Only risks that have been realized in the past year

Question 2

During a risk identification workshop, the team identifies several vulnerabilities. Which TWO of the following are examples of operational vulnerability identification? (Select two.)

Accepted Answer

Inadequate access control review process. Operational vulnerability identification focuses on weaknesses in day-to-day processes, procedures, and human/administrative controls rather than specific technical flaws in systems or code. Option A, an inadequate access control review process, is correct because it is a procedural/process weakness—failing to periodically review who has access means operational controls are not being maintained, which is a classic operational vulnerability. Option D, weak password policy enforcement, is correct because it reflects a failure in enforcing an administrative/operational control (e.g., not applying complexity, rotation, or lockout rules), which is a process and governance issue rather than a single technical defect. By contrast, option B (outdated firewall firmware) and option C (missing security patches on servers) are technical vulnerabilities tied to unpatched software/hardware, and option E (SQL injection in the web application) is a technical application flaw, so they fall under technical rather than operational vulnerability identification.

Answer

Outdated firewall firmware

Answer

Missing security patches on servers

Answer

SQL injection vulnerability in the web application

Question 3

During the risk identification process, an IT risk universe is defined. Which of the following BEST describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. An IT risk universe is a comprehensive inventory of all potential IT risks facing the organization — it is the master list from which risk assessments, prioritization, and treatment decisions are drawn. It defines the scope of what the organization considers 'in scope' for IT risk management, ensuring no material risk category is overlooked. It is not limited to vulnerabilities, incidents, or a single categorization scheme.

Answer

A list of all known vulnerabilities in the organization's IT systems

Answer

A database of past security incidents and their root causes

Answer

A framework for categorizing risks into strategic, operational, financial, and compliance

Question 4

A risk practitioner is categorizing IT risks for a manufacturing company. Which of the following risks would be classified as an 'operational' IT risk?

Accepted Answer

Risk of production line downtime due to a server failure. Operational IT risks relate to the day-to-day functioning of IT systems and processes. Production line downtime due to a system failure directly impacts operations.

Answer

Risk of financial loss from a ransomware payment

Answer

Risk of non-compliance with GDPR for customer data stored in the EU

Answer

Risk of reputational damage from a data breach

Question 5

Which of the following is the PRIMARY source for identifying known software vulnerabilities in a systematic manner?

Accepted Answer

National Vulnerability Database (NVD). The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data, built upon the CVE (Common Vulnerabilities and Exposures) list. It provides a systematic, structured, and continuously updated source of known software vulnerabilities, including CVSS scores, CWE classifications, and affected product configurations. For CRISC, it is the authoritative primary source for identifying vulnerabilities in a repeatable, comprehensive manner, unlike the other options which are either not vulnerability databases or not systematic.

Answer

OSINT feeds from social media

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 6

An organization uses threat intelligence feeds from an Information Sharing and Analysis Center (ISAC). What is the PRIMARY benefit of using ISACs?

Accepted Answer

They facilitate sharing of sector-specific threat intelligence. ISACs (Information Sharing and Analysis Centers) are sector-specific organizations that collect, analyze, and disseminate threat intelligence relevant to a particular industry (e.g., FS-ISAC for financial services, H-ISAC for healthcare). Their primary value is enabling members to share timely, sector-relevant threat indicators and defensive guidance that they could not easily obtain individually. This directly matches option A.

Answer

They provide free antivirus software to members

Answer

They offer legally binding threat response protocols

Answer

They replace the need for internal threat hunting

Question 7

A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?

Accepted Answer

A new cloud service may inadvertently expose customer PII due to misconfiguration. The risk appetite statement explicitly declares low tolerance for compliance risk, and exposing customer PII triggers regulatory/legal obligations (e.g., GDPR, CCPA, contractual data-protection clauses). Because compliance risk is the organization's stated low-tolerance area, any scenario with potential PII exposure must be escalated immediately to senior management. The other scenarios fall within the 'moderate operational risk' appetite the company has already accepted.

Answer

A planned system upgrade may cause two hours of downtime during maintenance window

Answer

A vendor is late in delivering a software patch for a low-severity bug

Answer

An employee mistakenly deletes a non-critical test database

Question 8

Which of the following BEST describes the difference between a threat actor who is a 'hacktivist' and one who is an 'organized crime' actor?

Accepted Answer

Hacktivists are motivated by ideology; organized crime actors are motivated by financial gain. It accurately captures the fundamental distinction between hacktivists and organized crime actors: motivation. Hacktivists are driven by ideological, political, or social causes, and their attacks are often symbolic or aimed at raising awareness. Organized crime actors, on the other hand, are primarily motivated by financial gain, engaging in activities like ransomware, fraud, and data theft for profit. This motivational difference is a core concept in risk management, as it influences the threat's targeting, persistence, and methods.

Answer

Hacktivists target only government entities; organized crime targets only businesses

Answer

Hacktivists are always insiders; organized crime actors are external

Answer

Hacktivists use advanced persistent threats (APTs); organized crime uses commodity malware

Question 9

A risk scenario is being developed for a phishing attack leading to credential theft. Using ISACA's risk scenario template, which component would describe the 'threat event'?

Accepted Answer

A user clicks a malicious link in a phishing email. In ISACA's risk scenario template, the 'threat event' component describes the specific action or occurrence that triggers risk — here, a user clicking a malicious link in a phishing email. This is the initiating event that, combined with the threat actor and vulnerable asset, produces the risk. The threat event is distinct from the threat actor (who), the vulnerability (what weakness), and the impact (what happens next).

Answer

The organization's email security filter fails to block the phishing email

Answer

The attacker is an organized crime group based overseas

Answer

The compromised credentials are used to access a financial system

Question 10

Which of the following is an example of a 'configuration vulnerability' that should be identified during vulnerability assessment?

Accepted Answer

Default administrative passwords left unchanged on a network device. A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

Answer

A buffer overflow in a custom application

Answer

An SQL injection flaw in a web form

Answer

Missing security patches on a server

Question 11

When developing IT risk scenarios, connecting them to business impact is critical. Which of the following BEST describes how a risk practitioner should link a technical scenario to business impact?

Accepted Answer

Quantify the impact in terms of financial loss, regulatory penalty, and operational disruption. Quantifying impact in terms of financial loss, regulatory penalty, and operational disruption best links a technical risk scenario to business impact because it translates technical events into measurable business consequences. This allows risk to be expressed in terms that executives and business owners can understand and prioritize. It also supports cost-benefit analysis of risk treatment options.

Answer

Assign a likelihood rating and an inherent risk score

Answer

Describe the technical steps of the attack in detail

Answer

Reference industry benchmarks for similar scenarios

Question 12

During risk identification, a risk manager is reviewing threat intelligence sources. Which THREE of the following are considered legitimate sources of threat intelligence? (Choose three.)

Accepted Answer

Government advisories such as CISA Known Exploited Vulnerabilities (KEV) catalog. OSINT (open-source intelligence), ISACs (sector-specific sharing), and government advisories (e.g., CISA KEV) are established threat intelligence sources. Social media rumor and vendor sales pitches are not reliable.

Answer

Unverified social media rumors

Answer

Vendor sales presentations

Question 13

A retail company is establishing an IT risk universe. Which of the following should be included as a primary category of IT risk?

Accepted Answer

Third-party risk. Third-party risk is a primary IT risk category because organizations increasingly depend on vendors, cloud providers, and service integrators whose failures, breaches, or non-compliance directly affect the organization's IT risk posture. It belongs in the IT risk universe alongside categories such as cybersecurity, availability, data integrity, and compliance risk. Market, inflation, and interest rate risks are financial/market risks, not IT risk categories.

Answer

Market risk

Answer

Inflation risk

Answer

Interest rate risk

Question 14

During a threat modeling exercise for a new web application, the team uses STRIDE. Which threat type under STRIDE corresponds to an attacker modifying data in transit?

Accepted Answer

Tampering. In STRIDE, Tampering refers to the unauthorized modification of data, whether at rest or in transit. An attacker modifying data in transit (e.g., man-in-the-middle altering a message) is the canonical example of Tampering. It violates integrity.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing

Question 15

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Accepted Answer

Actor. In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

Answer

Event

Answer

Threat type

Answer

Asset/Resource