CRISC IT Risk Identification Practice Test 6 — 15 Questions

Question 1

A retail company is establishing an IT risk universe. Which of the following should be included as a primary category of IT risk?

Accepted Answer

Third-party risk. The IT risk universe should include all potential IT risks, and third-party risks are a key category due to reliance on vendors.

Answer

Market risk

Answer

Inflation risk

Answer

Interest rate risk

Question 2

During a threat modeling exercise for a new web application, the team uses STRIDE. Which threat type under STRIDE corresponds to an attacker modifying data in transit?

Accepted Answer

Tampering. Tampering refers to unauthorized modification of data, which is a threat type in STRIDE.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing

Question 3

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Accepted Answer

Actor. In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

Answer

Event

Answer

Threat type

Answer

Asset/Resource

Question 4

A financial institution uses threat intelligence from an Information Sharing and Analysis Center (ISAC). This is an example of which type of threat intelligence source?

Accepted Answer

ISAC. ISACs are industry-specific, trusted communities for sharing threat intelligence.

Answer

Open-source intelligence (OSINT)

Answer

Government advisories

Answer

Commercial feeds

Question 5

Which threat actor is most likely motivated by political ideology and may target government systems?

Accepted Answer

Hacktivist. Hacktivists are threat actors whose primary motivation is political ideology, social activism, or protest. They often target government systems to disrupt operations, deface websites, or leak sensitive information in order to advance their political agenda, making option C correct.

Answer

Organized crime

Answer

Nation-state APT

Answer

Script kiddie

Question 6

A security analyst is reviewing CVE entries and NVD data to identify vulnerabilities in software assets. This activity is part of which vulnerability identification approach?

Accepted Answer

Asset-based vulnerability identification. CVE and NVD are databases for known software vulnerabilities, aligning with asset-based vulnerability identification.

Answer

Configuration vulnerability assessment

Answer

Application vulnerability identification

Answer

Operational vulnerability identification

Question 7

An organization uses the PASTA threat modeling methodology. In which stage would the team identify threat agents and their capabilities?

Accepted Answer

Threat analysis. PASTA's third stage involves profiling threat agents and their capabilities.

Answer

Define objectives

Answer

Vulnerability analysis

Answer

Decompose application

Question 8

A risk manager is categorizing IT risks. Which risk category would a potential fine for violating GDPR be assigned to?

Accepted Answer

Compliance. Compliance risk involves violations of laws, regulations, or contractual obligations.

Answer

Operational

Answer

Financial

Answer

Strategic

Question 9

Which of the following best describes risk capacity?

Accepted Answer

The maximum risk the organization can absorb before threatening viability. Risk capacity is the maximum level of risk an organization can absorb before its viability is threatened.

Answer

The acceptable risk level for each risk category

Answer

The total risk identified in the risk universe

Answer

The amount of risk the organization is willing to accept

Question 10

A company is updating its risk register. Which of the following is the primary purpose of a risk register?

Accepted Answer

To record and track identified risks and their treatment. The risk register centralizes identified risks, their analysis, and treatment plans.

Answer

To define risk appetite

Answer

To store threat intelligence feeds

Answer

To document all IT assets

Question 11

During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?

Accepted Answer

It is tailored for use in agile and DevOps environments. VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.

Answer

It requires detailed system architecture upfront

Answer

It replaces the need for vulnerability scanning

Answer

It focuses on compliance requirements only

Question 12

A risk analyst is identifying operational vulnerabilities. Which TWO of the following are examples of operational vulnerability identification?

Accepted Answer

Discovering lack of security awareness training. Operational vulnerabilities include process gaps and training gaps, not technical configuration or code flaws.

Answer

Reviewing CIS Benchmarks for server configuration

Answer

Analyzing SQL injection flaws in code

Answer

Scanning for missing patches using a vulnerability scanner

Question 13

Which THREE of the following are common consequences in an IT risk scenario?

Accepted Answer

Financial loss. Financial loss, regulatory penalty, and reputational damage are typical consequences in risk scenarios.

Answer

Increased market share

Answer

Employee satisfaction

Question 14

A risk practitioner is using the TRIKE threat modeling methodology. Which TWO of the following are characteristics of TRIKE?

Accepted Answer

It is a requirements-based model. TRIKE is requirements-based and uses actor- and asset-centric views.

Answer

It is designed for analyzing denial-of-service threats

Answer

It is a visual, agile methodology for DevSecOps

Answer

It focuses on attack trees and threat libraries

Question 15

Which TWO of the following are types of insider threats?

Accepted Answer

Malicious. Insider threats can be malicious (intentional harm) or negligent (unintentional mistakes).

Answer

Nation-state

Answer

Hacktivist

Answer

Script kiddie