CRISC IT Risk Identification Practice Test 8 — 15 Questions

Question 1

A risk practitioner is conducting an IT risk assessment for a retail bank's new mobile payment application. The threat landscape includes hacktivists, organized crime, and insiders. The practitioner needs to estimate the likelihood of a data breach. Which of the following factors is MOST important to consider when estimating likelihood?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The effectiveness of existing controls and the threat's capability to exploit them.. Likelihood estimation in IT risk assessment depends on threat capability and motivation relative to control effectiveness. For a mobile payment app, threats like organized crime have high capability, but robust controls can reduce likelihood. The correct factor directly addresses this relationship, while others focus on impact, vulnerability count, or benchmarks that do not provide a direct likelihood estimate.

Answer

The industry benchmarks for mobile payment application security spending.

Answer

The number of vulnerabilities identified in the application's source code.

Answer

The financial impact of a potential data breach on the bank's reputation.

Question 2

A risk practitioner at a regional bank is compiling a list of internal threat sources for the enterprise risk assessment. Which TWO of the following are internal threat sources that should be included? (Choose two.)

Accepted Answer

A terminated employee who retained a VPN credential. Internal threat sources are actors who operate within or with trusted access to the organization, including current and former employees, contractors, and other insiders with authorized privileges. The terminated employee with a retained credential and the contractor with privileged platform access both meet that definition. Hacktivists, nation-state actors, and organized crime groups are external sources even when they target the bank.

Answer

A nation-state actor conducting espionage against financial regulators

Answer

An organized crime group running ransomware campaigns

Answer

A hacktivist group targeting the bank's public website

Question 3

A risk manager at a healthcare organization is identifying risks related to the use of Internet of Medical Things (IoMT) devices. The organization has a large number of legacy devices that cannot be patched. Which of the following is the MOST significant risk factor to consider when assessing the risk of a ransomware attack?

Accepted Answer

The devices are connected to the network without segmentation.. The most significant risk factor is the lack of network segmentation, which allows ransomware to spread from vulnerable IoMT devices to critical systems. Legacy devices that cannot be patched are inherently risky, but segmentation can contain the impact. Other factors like default passwords or vendor diversity are important but can be addressed more readily than architectural segmentation.

Answer

The devices generate a large volume of data that is stored indefinitely.

Answer

The devices use default administrative passwords that are rarely changed.

Answer

The devices are manufactured by various vendors with different security standards.

Question 4

A financial services firm's risk practitioner is building a risk register entry for a customer-facing mobile banking application hosted in a public cloud. The application stores PII and processes payments. Management wants to understand the inherent risk before any controls are considered. Which of the following BEST represents the inherent risk of this asset?

Accepted Answer

The likelihood and impact of loss assuming no controls are in place, derived from the threat environment and the asset's value and exposure.. Inherent risk is the exposure that exists before controls are applied, built from the threat environment and the value and exposure of the asset. For a mobile banking app holding PII and processing payments, the practitioner must assess realistic threat events and their potential impacts without crediting existing safeguards. This baseline enables meaningful comparison once control effectiveness is evaluated and residual risk is determined.

Answer

The aggregate cost of the security controls deployed to protect the mobile application and its supporting cloud infrastructure.

Answer

The likelihood and impact of loss after all implemented controls have been applied and validated by internal audit.

Answer

The maximum regulatory fine the firm could face if the application suffered a data breach involving customer PII.

Question 5

A multinational bank is assessing the risk of a distributed denial-of-service (DDoS) attack on its online banking platform. The risk practitioner has identified that the platform is hosted in a single data center with no redundancy. Which of the following BEST describes the relationship between the threat, vulnerability, and risk in this scenario?

Accepted Answer

The DDoS attack is the threat, the single data center is the vulnerability, and the risk is the potential service outage.. In risk terminology, a threat is something that can exploit a vulnerability, a vulnerability is a weakness, and risk is the potential for loss when a threat exploits a vulnerability. Here, the DDoS attack is the threat, the single data center is the vulnerability, and the potential service outage is the risk. Correctly distinguishing these elements is fundamental to IT risk identification and ensures appropriate treatment.

Answer

The DDoS attack is the risk, the single data center is the threat, and the potential service outage is the vulnerability.

Answer

The DDoS attack is the vulnerability, the single data center is the threat, and the risk is the potential service outage.

Answer

The DDoS attack is the threat, the single data center is the risk, and the potential service outage is the vulnerability.

Question 6

A retail bank is building a risk register for its newly deployed mobile payment API. The CISO asks the risk practitioner to classify the risk that attackers could manipulate the API request parameters to bypass transaction limits. Under which CRISC risk identification category should this risk PRIMARILY be recorded?

Accepted Answer

IT security risk. The risk described is a deliberate adversarial action that violates the integrity and authorized use of the payment API, which is the essence of IT security risk. Placing it in that category ensures it is assessed against threat actors, exploitable vulnerabilities, and security controls, and it drives the right treatment such as input validation and authorization hardening, rather than being handled as an availability, compliance, or delivery issue.

Answer

IT project risk

Answer

IT operational risk

Answer

IT compliance risk

Question 7

A mid-sized hospital is building its IT risk register. The risk practitioner wants to express the organization's tolerance for a ransomware event that would disrupt electronic health records for 24 hours. Which of the following BEST represents a structured way to document this tolerance?

Accepted Answer

A documented risk appetite statement that specifies the maximum acceptable downtime and data loss for EHR systems.. A risk appetite statement is the formal mechanism for expressing how much risk an organization is willing to accept. It translates broad tolerance into specific, measurable limits such as maximum downtime and data loss. This gives the risk practitioner a clear benchmark for evaluating whether a ransomware risk is within or outside acceptable boundaries, enabling consistent risk response decisions.

Answer

A vulnerability assessment report showing unpatched EHR servers.

Answer

A risk register entry that lists ransomware as a high-likelihood, high-impact risk.

Answer

A business impact analysis that estimates the financial cost of a 24-hour EHR outage.

Question 8

A risk practitioner at a regional bank is building a threat landscape for its new mobile payment platform. A recently published report from a national CERT indicates that a loosely organized group has been targeting payment APIs across the region, exploiting known authentication weaknesses. The practitioner wants to determine whether this group should be treated as a relevant threat source in the risk register. Which of the following is the MOST appropriate FIRST step?

Accepted Answer

Assess the group's capability, intent, and opportunity against the bank's specific mobile payment assets.. Threat sources become relevant only when evaluated against the organization's own assets through capability, intent, and opportunity. A CERT report signals activity in the sector, but the bank must determine whether the group can realistically reach and exploit its mobile payment APIs. That asset-centric analysis is the first step before the threat is entered into the risk register or any control is selected.

Answer

Immediately add the group to the risk register as a high-rated threat because it appears in a national CERT report.

Answer

Implement additional authentication controls on the mobile payment APIs to mitigate the reported weaknesses.

Answer

Subscribe to additional commercial threat intelligence feeds to obtain more detail on the group's activities.

Question 9

A risk practitioner is selecting a risk analysis technique for a new payment processing system. The team has limited historical loss data, wants to incorporate expert judgment, and needs to prioritize risks for management review. Which technique is MOST appropriate?

Accepted Answer

Delphi technique to gather and converge expert opinions on likelihood and impact.. When historical loss data is scarce and expert judgment must be captured, the Delphi technique provides a structured, anonymous, iterative approach that converges on consensus estimates of likelihood and impact. It reduces individual bias and yields a defensible prioritization suitable for management review. Quantitative methods like Monte Carlo require reliable data, while fault tree and business impact analysis serve different analytical purposes.

Answer

Business impact analysis to determine recovery time and recovery point objectives for the payment system.

Answer

Fault tree analysis to trace the logical combinations of failures that could cause a payment outage.

Answer

Monte Carlo simulation using historical loss distributions from the past five years.

Question 10

A risk practitioner is conducting a risk assessment for a new customer-facing mobile application. The practitioner wants to identify risks by examining how data flows between the mobile client, the API gateway, and the backend database. Which of the following techniques is being applied?

Accepted Answer

Threat modeling. Threat modeling is the structured technique for examining system architecture, trust boundaries, and data flows to identify where threats can act. Tracing data between the mobile client, API gateway, and database is exactly the data-flow analysis that threat modeling performs. The other techniques address control evaluation, automated weakness detection, or business process criticality rather than architectural data movement.

Answer

Vulnerability scanning

Answer

Business impact analysis

Answer

Control self-assessment

Question 11

A risk practitioner at a regional bank is building a risk register entry for the loss of a critical core banking application. The head of IT operations insists on recording a single, point-in-time likelihood estimate of 15% derived from last year's incident log, and refuses to consider any range. Which CRISC-aligned principle should the practitioner apply to MOST appropriately represent this IT risk?

Accepted Answer

Model likelihood and impact as distributions reflecting uncertainty around the estimates.. Expressing likelihood and impact as distributions acknowledges that estimates carry uncertainty, which is central to sound IT risk analysis. A point estimate of 15% implies false precision and hides tail risk that could threaten the core banking service. Distributions let the bank compare risk against tolerance, prioritize controls, and communicate exposure honestly to stakeholders without overstating confidence in a single number.

Answer

Replace the likelihood figure with the industry average downtime for comparable core banking platforms.

Answer

Escalate the disagreement to the board and let it decide whether the 15% figure is acceptable.

Answer

Multiply the 15% likelihood by the maximum credible loss to obtain a single annualized loss expectancy.

Question 12

A risk practitioner at a healthcare insurer is identifying risks for a new telehealth platform. The platform integrates with a third-party video vendor, stores protected health information, and must comply with HIPAA. Which of the following is the MOST appropriate FIRST step in identifying IT risk for this platform?

Accepted Answer

Inventory the platform's assets, data flows, and regulatory obligations to define the risk context.. Effective risk identification starts with establishing context: the assets involved, the data flows, the dependencies, and the regulatory environment. Inventorying the telehealth platform's components, protected health information movement, and HIPAA obligations gives the practitioner the basis to enumerate threats and vulnerabilities. Only after this scope is defined do activities such as vendor assurance review, penetration testing, and insurance decisions become targeted and defensible.

Answer

Perform a penetration test of the telehealth platform before go-live.

Answer

Purchase cyber insurance to transfer the financial impact of a breach.

Answer

Review the third-party video vendor's SOC 2 report and contract terms.

Question 13

A risk practitioner at a financial services firm is identifying IT risk scenarios for a new mobile banking application. The firm uses the ISACA risk scenario development approach. Which TWO of the following are essential components of a well-defined risk scenario? (Choose two.)

Accepted Answer

The asset or business process at risk.. A well-defined risk scenario includes the threat actor and motivation, the asset or business process at risk, the vulnerability or condition that enables the event, and the potential impact. The threat actor and asset are the two essential components listed here. Together they frame the event so that likelihood and impact can be assessed and appropriate risk responses can be selected.

Answer

The regulatory penalty schedule for data breaches.

Answer

The specific control framework used to mitigate the risk.

Answer

The annualized loss expectancy (ALE) calculation.

Question 14

A risk practitioner is conducting a risk assessment for a new mobile application that will process credit card payments. The practitioner needs to identify relevant threats. Which of the following is the MOST appropriate source for identifying threats specific to this application?

Accepted Answer

A threat intelligence feed that includes mobile and payment card threats. Threat intelligence feeds are designed to provide up-to-date information on threats relevant to specific technologies and industries. For a mobile payment app, a feed covering mobile and payment card threats will identify threat actors, attack vectors, and emerging TTPs. This enables the risk practitioner to build a realistic threat landscape. Other sources like audit findings or continuity plans are secondary and do not offer the same breadth or currency.

Answer

The business continuity plan for the payment processing system

Answer

The IT department's list of approved software vendors

Answer

The organization's previous audit findings for other applications

Question 15

A risk practitioner at a regional hospital is building a risk register entry for the loss of availability of its electronic health record (EHR) system. The practitioner wants to express the risk in a way that supports later quantification and treatment decisions. Which of the following BEST describes how the risk should be documented in the register?

Accepted Answer

As a paired statement of the event, its cause, and its business impact, such as 'EHR outage caused by ransomware exploitation of an unpatched server, leading to delayed clinical care and regulatory reporting failure'.. Expressing risk as a cause-event-impact triplet gives the practitioner the components needed to estimate likelihood and magnitude and to select treatment. It also links technical conditions to business outcomes, which is what the register is for. The other choices capture only an actor, only a vulnerability inventory, or an unsupported acceptance decision, none of which supports quantification or comparison across the risk portfolio.

Answer

As a list of all unpatched servers and their IP addresses across the clinical network.

Answer

As a statement of the threat source only, such as 'ransomware gang targeting healthcare'.

Answer

As an accepted risk with no further detail because the EHR vendor holds a Business Associate Agreement.