CRISC IT Risk Identification Practice Test 9 — 15 Questions

Question 1

A risk practitioner is facilitating a workshop to identify risks for a new customer data analytics platform. During the session, participants repeatedly describe how a competitor might copy the platform's features and how a regulator might question the platform's data retention practices. The practitioner wants to ensure the workshop produces structured risk statements rather than general concerns. Which of the following should the practitioner do NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reframe each concern into a risk statement linking a threat source, an asset, an event, and a potential business impact.. Risk identification produces structured statements that pair a threat source with an asset, an event, and a business impact. The workshop's raw concerns about competitors and regulators must be reframed this way so they can be scored, owned, and linked to controls. Registering, escalating, or converting them directly to control gaps bypasses the identification discipline and yields outputs that cannot be consistently managed.

Answer

Convert the concerns into control gaps so the security team can begin remediation planning immediately.

Answer

Escalate the workshop outputs to the board for a risk appetite decision before further analysis.

Answer

Record the concerns as-is in the risk register and assign owners for follow-up.

Question 2

A risk practitioner is mapping identified IT risks to the organization's risk taxonomy. A risk has been logged for 'unauthorized access to the HR system resulting from excessive user privileges.' Under which risk category should this be classified?

Accepted Answer

Operational risk, because it arises from inadequate internal processes and access controls.. Risk categorization should reflect the root cause of the risk event. Excessive user privileges are a failure of internal access management processes, which places the risk in the operational risk category. This classification drives treatment toward entitlement reviews, least-privilege enforcement, and segregation-of-duties controls. Compliance and financial consequences may follow, but they are impacts, not the originating category.

Answer

Financial risk, because a data breach could result in monetary losses and fines.

Answer

Strategic risk, because workforce data supports long-term talent planning.

Answer

Compliance risk, because HR data is subject to privacy regulations.

Question 3

A hospital network is identifying IT risks for its newly deployed medical imaging archive. The risk practitioner wants to document risks in a way that links each risk to the business process it could disrupt. Which CRISC concept is the practitioner applying when connecting an IT risk to the business objective it threatens?

Accepted Answer

Risk identification through business process mapping.. Connecting each IT risk to the business process and objective it can disrupt is business process mapping within risk identification. It shifts the conversation from technical faults to business consequences, enabling the hospital to prioritize risks that affect patient care and regulatory obligations. This linkage is what makes a risk register useful for decision making rather than a mere inventory of technical issues.

Answer

Penetration testing of the imaging network.

Answer

Control self-assessment of the imaging archive configuration.

Answer

Vulnerability scanning of the archive servers.

Question 4

A risk practitioner is assessing the likelihood of a distributed denial-of-service (DDoS) attack against an online retailer's checkout service during peak shopping season. Which of the following factors would MOST increase the assessed likelihood of this event?

Accepted Answer

Peer retailers experienced a surge in DDoS attacks during the same peak period last year. Likelihood reflects the probability that a threat will act against an exposed asset, so evidence of an active threat community targeting similar retailers in the same season is the strongest driver. Mitigating controls such as CDN-based DDoS protection lower likelihood, while resilience gaps and missing response plans primarily affect impact and recovery. Peer incident data is a standard threat intelligence input for likelihood estimation.

Answer

The checkout service uses a content delivery network with DDoS mitigation

Answer

The organization has no documented incident response plan for availability attacks

Answer

The checkout service is hosted in a single data center region

Question 5

A risk practitioner is reviewing the organization's risk register and notices that a risk related to a legacy payroll system has been assigned an owner from the IT department. The risk owner is responsible for which of the following?

Accepted Answer

Managing the risk and ensuring appropriate responses are executed.. The risk owner is accountable for managing a specific risk, including selecting and monitoring risk responses and ensuring the risk stays within acceptable limits. This role is distinct from control implementation, risk assessment, and appetite approval. Clearly defining risk ownership ensures that someone is accountable for each risk and that responses are executed and reported appropriately.

Answer

Implementing the technical controls to mitigate the risk.

Answer

Performing the annual risk assessment for the payroll system.

Answer

Approving the risk appetite statement for the organization.

Question 6

A newly hired risk analyst is asked to classify the organization's risk universe before any assessment begins. The analyst lists categories such as strategic, operational, financial, compliance, and reputational. Which of the following BEST explains why this categorization is useful for IT risk identification?

Accepted Answer

It provides a structured lens that helps ensure risks across business functions are surfaced and compared, and it supports consistent ownership and reporting.. Defining a risk universe by category gives the practitioner a structured way to surface risks from every function, apply consistent terminology, and roll results up for governance. It prevents blind spots and supports ownership and reporting. The alternatives either mistake categories for the register itself, assume unrealistic exclusivity, or skip the underlying assessments that make aggregation meaningful.

Answer

It replaces the need for a risk register because each category can be tracked in a separate spreadsheet.

Answer

It lets the analyst assign a single numeric risk score to the entire organization without assessing individual risks.

Answer

It guarantees that every risk will be assigned to exactly one category, eliminating duplicate register entries.

Question 7

A risk practitioner is interviewing business unit leaders to identify IT risks for an annual risk assessment. One leader states that the customer relationship management system is critical because sales staff cannot work without it. Which of the following BEST describes the risk practitioner's next action to validate this input?

Accepted Answer

Cross-reference the CRM system's criticality with business impact analysis and dependency data.. Stakeholder interviews are a key risk identification technique, but their outputs should be corroborated with objective evidence. Comparing the CRM criticality claim against the business impact analysis, recovery objectives, and dependency maps confirms whether the system genuinely supports critical processes. This validation reduces bias, improves the accuracy of the risk register, and supports defensible prioritization of risk treatment.

Answer

Accept the leader's statement and record the CRM system as a high-risk asset in the register.

Answer

Escalate the statement to the board risk committee for a final criticality decision.

Answer

Schedule a penetration test of the CRM system to determine its risk level.

Question 8

A risk practitioner is identifying risks associated with a new cloud-based customer relationship management (CRM) system. The organization has concerns about data leakage and service availability. Which TWO of the following are examples of vulnerabilities that could lead to these risks? (Choose two.)

Accepted Answer

The CRM system lacks encryption for data at rest.. Vulnerabilities are weaknesses that can be exploited by threats. The lack of encryption for data at rest is a technical vulnerability that could lead to data leakage. The data center's location in a hurricane-prone region is an environmental vulnerability that could lead to service unavailability. The other options are threats, governance statements, or contractual issues, not vulnerabilities.

Answer

A hacktivist group has announced intentions to target cloud providers.

Answer

The organization's risk appetite statement allows for moderate downtime.

Answer

The cloud provider's service level agreement (SLA) does not include penalties for data breaches.

Question 9

A risk practitioner is analyzing the threat landscape for a hospital's connected medical devices. The devices run legacy operating systems that cannot be patched and are accessible from the clinical network. Which factor MOST increases the likelihood of exploitation?

Accepted Answer

The devices are connected to the clinical network and run unpatched legacy operating systems.. Likelihood of exploitation increases when a vulnerable asset is also reachable by a threat actor. The legacy, unpatched operating systems provide known exploitable weaknesses, and connectivity from the clinical network provides the path to reach them. Together they create a direct, low-friction attack opportunity. The other factors affect response readiness, coordination, or unrelated vectors and do not create the same immediate exposure.

Answer

The devices are manufactured by multiple vendors with varying support lifecycles.

Answer

The hospital's incident response plan has not been tested in the last twelve months.

Answer

Clinical staff have not received security awareness training on phishing emails.

Question 10

A retail bank's risk practitioner is building a risk scenario for its online banking platform. He needs to estimate how frequently an attacker could realistically succeed in exploiting the platform's unpatched web tier. Which of the following provides the MOST quantitative basis for this estimate?

Accepted Answer

Historical loss-event data from the bank's own incident and fraud systems for comparable attack types. Frequency estimation in a risk scenario should be grounded in data that reflects how often the event actually occurs in the organization's own environment. Internal loss-event and incident data capture real attack attempts that succeeded despite existing controls. CVSS scores, industry vulnerability publication rates, and remediation timeliness describe severity or process performance rather than the expected rate of successful exploitation.

Answer

The Common Vulnerability Scoring System (CVSS) base score of each unpatched vulnerability on the web tier

Answer

The mean time to remediate critical vulnerabilities reported by the bank's vulnerability management team

Answer

The annualized rate of new vulnerabilities published in the National Vulnerability Database (NVD) for web servers

Question 11

A risk practitioner is estimating the likelihood of a ransomware event affecting a manufacturing firm's operational technology environment. Historical incident data is sparse, so the practitioner convenes plant engineers, security staff, and the insurance broker to elicit calibrated estimates and combine them into a reasoned likelihood. Which technique is being used?

Accepted Answer

Delphi technique with structured expert elicitation.. When incident data is too sparse to support statistical estimation, structured expert elicitation such as the Delphi technique is the appropriate way to generate calibrated likelihood estimates. It pools diverse expertise, uses anonymity and iteration to reduce bias, and converges on a defensible consensus. The resulting estimate can later feed quantitative models if data improves, keeping the analysis honest about its uncertainty.

Answer

Bayesian updating of the prior incident frequency.

Answer

Monte Carlo simulation of the plant's loss distribution.

Answer

Fault tree analysis of the ransomware attack path.

Question 12

A risk practitioner is identifying risks for an organization that has adopted a bring-your-own-device policy for remote workers. The practitioner wants to document vulnerabilities that increase the likelihood of a data loss event. Which TWO of the following are MOST appropriately classified as vulnerabilities in this scenario? (Choose two.)

Accepted Answer

Employees store corporate documents in unmanaged personal cloud storage accounts.. Vulnerabilities are internal weaknesses or control gaps that a threat can exploit to cause harm. Storing corporate documents in unmanaged personal cloud accounts and running personal devices without encryption or management enrollment are both such weaknesses, and each directly raises the likelihood of data loss. The other statements describe a threat actor, a business impact, and an insurance condition, which belong to different components of the risk equation.

Answer

A nation-state group is targeting the organization's industry sector.

Answer

The organization's cyber insurance policy excludes unencrypted device losses.

Answer

A remote worker's lost laptop could cost the organization regulatory fines.

Question 13

A global retailer is identifying IT risks related to a new cloud-based point-of-sale (POS) system. The risk practitioner wants to use a top-down approach. Which of the following is the MOST appropriate starting point for this approach?

Accepted Answer

Mapping the POS system to the retailer's strategic objectives and critical business processes.. A top-down risk identification approach starts with the organization's strategic objectives and critical business processes, then identifies IT risks that could affect them. Mapping the POS system to these objectives ensures that risk identification is business-driven and prioritizes risks with the greatest potential impact on the retailer's goals. This approach contrasts with bottom-up methods that begin with assets or vulnerabilities.

Answer

Reviewing the service level agreement with the cloud provider.

Answer

Cataloging all cloud infrastructure components used by the POS system.

Answer

Conducting a vulnerability scan of the cloud POS environment.

Question 14

A risk practitioner at a healthcare insurance company is building the risk register entry for ransomware affecting its claims-processing platform. The practitioner must document the loss event type, the asset at risk, and the expected loss magnitude in the organization's risk taxonomy. Which of the following BEST describes the risk component that represents the expected loss magnitude?

Accepted Answer

The business impact, expressed in financial terms, if the ransomware event actually occurs and disrupts claims processing.. Expected loss magnitude is captured as business impact expressed in financial terms, answering how much the organization would lose if the ransomware event disrupted claims processing. Likelihood, inherent risk, and control effectiveness are distinct components that feed into risk analysis but do not themselves quantify the consequence. Documenting financial impact enables meaningful comparison against risk appetite and supports prioritization of treatment options.

Answer

The likelihood that a ransomware actor will attempt to compromise the claims-processing platform within the next twelve months.

Answer

The inherent risk level assigned to the claims-processing platform before any controls are applied.

Answer

The control effectiveness rating of the endpoint detection and backup controls protecting the claims-processing platform.

Question 15

A risk practitioner is performing a risk assessment on an organization's use of a cloud-based payroll platform. The practitioner is identifying the inherent risk factors that exist before any controls are considered. Which TWO of the following are inherent risk factors for this scenario? (Choose two.)

Accepted Answer

Payroll processing depends on a single third-party provider with no in-house fallback process.. Inherent risk factors describe the exposure that exists by virtue of the assets, data, and dependencies involved, before any protective measures are applied. Sensitive employee data and dependence on a single provider without fallback both raise potential impact and likelihood regardless of controls. Audit reports, multifactor authentication, and penetration testing are control evidence that belongs in the residual risk analysis, not the inherent assessment.

Answer

The vendor performs quarterly penetration testing of its external infrastructure.

Answer

The vendor's most recent SOC 2 Type II report shows no exceptions in its change management controls.

Answer

The organization enforces multifactor authentication for all administrator access to the payroll platform.