CRISC IT Risk Identification — Timed 10 Questions

Question 1

A risk practitioner is creating a risk scenario for a ransomware attack. Which of the following is the BEST sequence to describe the scenario using the ISACA risk scenarios template?

Accepted Answer

Threat actor, threat type, event, asset/resource, timing, detection, response. The ISACA risk scenarios template for a ransomware attack should begin with the asset or resource at risk (critical data), followed by the event (ransomware infection), threat actor (disgruntled employee or external hacker), timing, detection, response, and finally threat type. Option A follows this logical sequence, making it the best choice.

Answer

Asset/resource, event, threat actor, timing, detection, response, threat type

Answer

Threat type, event, asset/resource, threat actor, timing, detection, response

Answer

Event, threat actor, asset/resource, timing, detection, response, threat type

Question 2

An organization is developing its IT risk universe. Which of the following is the BEST source of information for identifying potential IT risks?

Accepted Answer

Threat intelligence feeds from ISACs. The IT risk universe should encompass all potential IT risks. Threat intelligence feeds provide current information on emerging threats, helping to identify risks that may not be captured by historical data or internal assessments alone.

Answer

Industry benchmarking reports

Answer

Results from the latest internal audit

Answer

Historical loss data from the finance department

Question 3

A company is adopting a DevSecOps approach and wants to conduct threat modeling early in the development lifecycle. Which threat modeling methodology is BEST suited for this environment due to its focus on agile and continuous integration?

Accepted Answer

VAST. VAST is designed for DevSecOps as it integrates with agile development and provides visual, actionable threat models that can be continuously updated.

Answer

TRIKE

Answer

STRIDE

Answer

PASTA

Question 4

During a risk identification workshop, a risk owner proposes a scenario: 'A disgruntled employee with privileged access exfiltrates customer data to a competitor.' In the context of the ISACA risk scenario template, which element is missing if the scenario only includes the actor, threat type, event, and asset?

Accepted Answer

Timing and detection. A complete risk scenario includes actor, threat type, event, asset/resource, timing, detection, and response. The scenario lacks timing (when the event might occur) and detection/response elements.

Answer

Business impact

Answer

Consequence

Answer

Vulnerability

Question 5

An organization is categorizing IT risks. Which of the following risk categories would include the risk of regulatory fines due to non-compliance with data protection laws?

Accepted Answer

Compliance risk. Compliance risks involve violations of laws, regulations, or contractual obligations. Regulatory fines for data protection non-compliance fall under the compliance category.

Answer

Operational risk

Answer

Financial risk

Answer

Strategic risk

Question 6

A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?

Accepted Answer

Categorize the risks. After identification, risks should be categorized to enable proper analysis and response. Categorization helps in understanding the nature of each risk and assigning ownership.

Answer

Assign risk owners

Answer

Determine risk response

Answer

Assess the inherent risk level

Question 7

A multinational corporation uses commercial threat intelligence feeds and participates in an ISAC. However, they recently missed a critical vulnerability exploited in the wild that was not in their feeds. Which additional source should they incorporate to improve vulnerability identification?

Accepted Answer

CISA KEV catalog. CISA's Known Exploited Vulnerabilities (KEV) catalog is a government advisory that lists vulnerabilities actively exploited. It provides timely, actionable data that commercial feeds may not include immediately.

Answer

NVD database

Answer

OSINT from social media

Answer

Vendor advisories only

Question 8

A company is developing risk scenarios for business impact analysis. Which of the following scenario components directly links the risk event to potential financial loss?

Accepted Answer

Consequence. The consequence describes the outcome of the risk event, which includes financial loss. Other components describe the cause or context but not the impact.

Answer

Vulnerability

Answer

Threat actor

Answer

Asset

Question 9

Which of the following is a key characteristic of a well-maintained risk register?

Accepted Answer

It is updated regularly to reflect changes. A risk register must be dynamic and updated as new risks emerge or existing risks change. Regular review and updates are essential for its effectiveness.

Answer

It is maintained solely by the IT department

Answer

It is static and reviewed annually

Answer

It includes only high-impact risks

Question 10

A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?

Accepted Answer

IAST (Interactive Application Security Testing). IAST combines SAST and DAST with runtime analysis to pinpoint vulnerabilities that are actually exploitable in the running application, reducing false positives and focusing on business-critical issues.

Answer

OWASP ZAP automated scanner

Answer

Manual penetration testing

Answer

CVE database search