CRISC IT Risk Identification Practice Test 7 — 15 Questions

Question 1

Which threat actor is most likely motivated by political ideology and may target government systems?

Accepted Answer

Hacktivist. Hacktivists are threat actors whose primary motivation is political ideology, social activism, or protest. They often target government systems to disrupt operations, deface websites, or leak sensitive information in order to advance their political agenda, making option C correct.

Answer

Organized crime

Answer

Nation-state APT

Answer

Script kiddie

Question 2

A security analyst is reviewing CVE entries and NVD data to identify vulnerabilities in software assets. This activity is part of which vulnerability identification approach?

Accepted Answer

Asset-based vulnerability identification. Reviewing CVE entries and NVD data to identify vulnerabilities in software assets is asset-based vulnerability identification, because it maps known vulnerabilities to specific inventoried assets. The approach starts from the asset inventory and correlates it with vulnerability databases. Configuration, application, and operational categories describe different scopes, not the CVE/NVD correlation activity.

Answer

Configuration vulnerability assessment

Answer

Application vulnerability identification

Answer

Operational vulnerability identification

Question 3

An organization uses the PASTA threat modeling methodology. In which stage would the team identify threat agents and their capabilities?

Accepted Answer

Threat analysis. PASTA's third stage involves profiling threat agents and their capabilities.

Answer

Define objectives

Answer

Vulnerability analysis

Answer

Decompose application

Question 4

A risk manager is categorizing IT risks. Which risk category would a potential fine for violating GDPR be assigned to?

Accepted Answer

Compliance. A fine for violating GDPR is a direct consequence of failing to meet a legal/regulatory obligation, which is the definition of compliance risk. Compliance risk encompasses penalties, sanctions, and legal actions arising from non-conformance with laws, regulations, and standards. Although the fine is monetary, its root cause is regulatory non-compliance, so it belongs in the compliance category.

Answer

Operational

Answer

Financial

Answer

Strategic

Question 5

Which of the following best describes risk capacity?

Accepted Answer

The maximum risk the organization can absorb before threatening viability. Risk capacity is the maximum amount of risk an organization can absorb before its viability, solvency, or strategic objectives are threatened — it is an objective, externally-influenced limit. It differs from risk appetite (willingness to accept risk) and risk tolerance (acceptable deviation around appetite). The correct answer captures the 'maximum absorbable' framing that distinguishes capacity from the other risk concepts.

Answer

The acceptable risk level for each risk category

Answer

The total risk identified in the risk universe

Answer

The amount of risk the organization is willing to accept

Question 6

A company is updating its risk register. Which of the following is the primary purpose of a risk register?

Accepted Answer

To record and track identified risks and their treatment. A risk register's primary purpose is to serve as the central repository that records identified risks, their owners, likelihood/impact ratings, and treatment decisions (mitigate, transfer, accept, avoid), enabling ongoing tracking and reporting. It is a living document used by risk managers to monitor status over time. Defining risk appetite is a governance activity that precedes and informs the register, not its purpose.

Answer

To define risk appetite

Answer

To store threat intelligence feeds

Answer

To document all IT assets

Question 7

During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?

Accepted Answer

It is tailored for use in agile and DevOps environments. VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.

Answer

It requires detailed system architecture upfront

Answer

It replaces the need for vulnerability scanning

Answer

It focuses on compliance requirements only

Question 8

Which THREE of the following are common consequences in an IT risk scenario?

Accepted Answer

Financial loss. In IT risk scenarios, a common consequence is financial loss (A), because incidents such as data breaches, downtime, or fraud directly incur remediation costs, lost revenue, and legal fees. A regulatory penalty (D) is also a standard consequence, since failures to comply with laws or standards like GDPR, HIPAA, or PCI DSS can result in fines and sanctions. Reputational damage (E) is likewise a typical consequence, as publicized security or availability failures erode customer trust and brand value. By contrast, increased market share (B) and employee satisfaction (C) are generally positive business outcomes, not consequences of risk events, so they do not belong in this list.

Answer

Increased market share

Answer

Employee satisfaction

Question 9

A risk practitioner is using the TRIKE threat modeling methodology. Which TWO of the following are characteristics of TRIKE?

Accepted Answer

It is a requirements-based model. TRIKE is requirements-based and uses actor- and asset-centric views.

Answer

It is designed for analyzing denial-of-service threats

Answer

It is a visual, agile methodology for DevSecOps

Answer

It focuses on attack trees and threat libraries

Question 10

Which TWO of the following are types of insider threats?

Accepted Answer

Malicious. Insider threats can be malicious (intentional harm) or negligent (unintentional mistakes).

Answer

Nation-state

Answer

Hacktivist

Answer

Script kiddie

Question 11

A risk practitioner at a healthcare payer is building the risk identification taxonomy for a new claims-processing platform. The CISO asks why the taxonomy must explicitly distinguish between a 'threat event' and a 'loss event' rather than treating both as 'risk' in the register. Which statement BEST justifies that distinction?

Accepted Answer

A threat event is a potential occurrence that may exploit a vulnerability, while a loss event is a realized occurrence that has already produced an adverse business impact.. The taxonomy must separate potential from realized occurrences because likelihood estimation attaches to threat events while impact estimation attaches to events that have actually caused harm. A threat event may exploit a vulnerability without ever producing loss, and a loss event confirms that the exposure materialized. Keeping them distinct allows the practitioner to model scenarios, set likelihood and impact parameters independently, and later feed realized outcomes back into the assessment to validate or adjust prior estimates.

Answer

A threat event is measured only in monetary terms, while a loss event is measured only in qualitative severity ratings such as high, medium, or low.

Answer

A threat event is recorded only in the risk register, while a loss event is recorded only in the incident management system, so the two never need to be linked.

Answer

A threat event is always externally sourced from attackers, whereas a loss event is always internally sourced from employee error or process failure.

Question 12

A risk practitioner is facilitating a risk identification workshop for a retail bank's new real-time payments service. Business stakeholders keep proposing controls such as multifactor authentication and transaction limits as 'risks.' Which action BEST keeps the identification phase technically sound?

Accepted Answer

Reframe each suggestion by asking what adverse event the control is meant to prevent, and record that adverse event as the risk.. Risk identification captures uncertain events that could affect objectives, while controls are the responses selected later during risk treatment. When stakeholders offer a control, the practitioner should ask what adverse event it is meant to prevent and record that event as the risk. This preserves the register's integrity, allows likelihood and impact to be estimated meaningfully, and keeps the control where it belongs, in treatment planning, so evaluation and appetite comparison remain coherent.

Answer

Escalate to the CISO because stakeholders who cannot distinguish controls from risks should not participate in risk identification workshops.

Answer

Accept the control suggestions as risks but tag them so they are excluded later during risk evaluation and treatment planning.

Answer

Record both the controls and the underlying events in the register, then let the risk committee decide which entries to retain.

Question 13

A hospital's risk practitioner is building a risk register entry for a ransomware attack on its electronic health record (EHR) system. The practitioner wants to express the risk in terms of how often the event is expected to occur and how much it would cost if it did. Which of the following BEST describes the two components being quantified?

Accepted Answer

Likelihood and impact. Quantitative risk analysis expresses each risk event through the probability it will occur and the resulting loss if it does. Likelihood and impact are the standard ISACA dimensions used in a risk register entry, and they can be combined into annualized loss expectancy. Governance thresholds, contributing factors, and control-state comparisons are separate concepts that do not describe the two quantified components.

Answer

Threat and vulnerability

Answer

Inherent risk and residual risk

Answer

Risk appetite and risk tolerance

Question 14

A risk practitioner at a payments processor is reviewing the organization's risk register and notices that several risk entries describe only the consequence, such as 'customer data is exposed.' The practitioner wants each entry to follow the ISACA risk scenario structure. Which of the following should the practitioner add to each entry to complete the scenario?

Accepted Answer

A threat source and an event, with the asset and consequence. ISACA risk scenarios are built from a threat source, an event, the asset or resource at risk, and the consequence. The existing register entries stop at consequence, so the practitioner must add the missing threat source, event, and affected asset to make each scenario complete and analyzable. Ratings, remediation fields, and compliance references are downstream or supplementary information, not structural components of the scenario.

Answer

A regulatory citation and an audit finding reference

Answer

A risk score and a heat map color

Answer

A control owner and a remediation due date

Question 15

A risk practitioner at a regional hospital is building a risk register for its new electronic health record (EHR) system. The system stores protected health information (PHI) and is subject to HIPAA. The practitioner wants to ensure that the risk register captures the potential for unauthorized disclosure of PHI. Which of the following should the practitioner PRIMARILY use to identify the relevant threats and vulnerabilities for this system?

Accepted Answer

A vulnerability assessment combined with a threat modeling exercise. Threat modeling and vulnerability assessment are complementary techniques that together provide a comprehensive identification of threats and vulnerabilities. Threat modeling explores how threat agents could exploit weaknesses, while vulnerability assessment discovers actual technical flaws. This combination ensures the risk register is grounded in both design-level and operational weaknesses, which is essential for a system holding PHI. Other methods either focus on control effectiveness or impact, not identification.

Answer

A review of the vendor's SOC 2 Type II report

Answer

A control self-assessment (CSA) workshop with clinical staff

Answer

A business impact analysis (BIA) focused on recovery time objectives