CRISC IT Risk Identification — Timed 50 Questions

Question 1

A risk practitioner is creating a risk scenario for a ransomware attack. Which of the following is the BEST sequence to describe the scenario using the ISACA risk scenarios template?

Accepted Answer

Threat actor, threat type, event, asset/resource, timing, detection, response. The ISACA risk scenarios template for a ransomware attack should begin with the asset or resource at risk (critical data), followed by the event (ransomware infection), threat actor (disgruntled employee or external hacker), timing, detection, response, and finally threat type. Option A follows this logical sequence, making it the best choice.

Answer

Asset/resource, event, threat actor, timing, detection, response, threat type

Answer

Threat type, event, asset/resource, threat actor, timing, detection, response

Answer

Event, threat actor, asset/resource, timing, detection, response, threat type

Question 2

An organization is developing its IT risk universe. Which of the following is the BEST source of information for identifying potential IT risks?

Accepted Answer

Threat intelligence feeds from ISACs. The IT risk universe should encompass all potential IT risks. Threat intelligence feeds provide current information on emerging threats, helping to identify risks that may not be captured by historical data or internal assessments alone.

Answer

Industry benchmarking reports

Answer

Results from the latest internal audit

Answer

Historical loss data from the finance department

Question 3

A company is adopting a DevSecOps approach and wants to conduct threat modeling early in the development lifecycle. Which threat modeling methodology is BEST suited for this environment due to its focus on agile and continuous integration?

Accepted Answer

VAST. VAST is designed for DevSecOps as it integrates with agile development and provides visual, actionable threat models that can be continuously updated.

Answer

TRIKE

Answer

STRIDE

Answer

PASTA

Question 4

During a risk identification workshop, a risk owner proposes a scenario: 'A disgruntled employee with privileged access exfiltrates customer data to a competitor.' In the context of the ISACA risk scenario template, which element is missing if the scenario only includes the actor, threat type, event, and asset?

Accepted Answer

Timing and detection. A complete risk scenario includes actor, threat type, event, asset/resource, timing, detection, and response. The scenario lacks timing (when the event might occur) and detection/response elements.

Answer

Business impact

Answer

Consequence

Answer

Vulnerability

Question 5

An organization is categorizing IT risks. Which of the following risk categories would include the risk of regulatory fines due to non-compliance with data protection laws?

Accepted Answer

Compliance risk. Compliance risks involve violations of laws, regulations, or contractual obligations. Regulatory fines for data protection non-compliance fall under the compliance category.

Answer

Operational risk

Answer

Financial risk

Answer

Strategic risk

Question 6

A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?

Accepted Answer

Categorize the risks. After identification, risks should be categorized to enable proper analysis and response. Categorization helps in understanding the nature of each risk and assigning ownership.

Answer

Assign risk owners

Answer

Determine risk response

Answer

Assess the inherent risk level

Question 7

A multinational corporation uses commercial threat intelligence feeds and participates in an ISAC. However, they recently missed a critical vulnerability exploited in the wild that was not in their feeds. Which additional source should they incorporate to improve vulnerability identification?

Accepted Answer

CISA KEV catalog. CISA's Known Exploited Vulnerabilities (KEV) catalog is a government advisory that lists vulnerabilities actively exploited. It provides timely, actionable data that commercial feeds may not include immediately.

Answer

NVD database

Answer

OSINT from social media

Answer

Vendor advisories only

Question 8

A company is developing risk scenarios for business impact analysis. Which of the following scenario components directly links the risk event to potential financial loss?

Accepted Answer

Consequence. The consequence describes the outcome of the risk event, which includes financial loss. Other components describe the cause or context but not the impact.

Answer

Vulnerability

Answer

Threat actor

Answer

Asset

Question 9

Which of the following is a key characteristic of a well-maintained risk register?

Accepted Answer

It is updated regularly to reflect changes. A risk register must be dynamic and updated as new risks emerge or existing risks change. Regular review and updates are essential for its effectiveness.

Answer

It is maintained solely by the IT department

Answer

It is static and reviewed annually

Answer

It includes only high-impact risks

Question 10

A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?

Accepted Answer

IAST (Interactive Application Security Testing). IAST combines SAST and DAST with runtime analysis to pinpoint vulnerabilities that are actually exploitable in the running application, reducing false positives and focusing on business-critical issues.

Answer

OWASP ZAP automated scanner

Answer

Manual penetration testing

Answer

CVE database search

Question 11

An organization's board has set a risk appetite statement that says: 'We accept moderate levels of operational risk but will not tolerate any compliance violations.' During risk identification, which type of risk should be given the HIGHEST priority?

Accepted Answer

Compliance risks. Given the zero-tolerance for compliance violations, compliance risks must be prioritized to ensure they are identified and managed accordingly.

Answer

Reputational risks

Answer

Operational risks

Answer

Strategic risks

Question 12

A security team is using the STRIDE threat modeling methodology for a new web application. Which threat type under STRIDE would be MOST relevant to a SQL injection vulnerability?

Accepted Answer

Tampering. SQL injection allows an attacker to tamper with data, violating integrity. STRIDE includes Tampering as the threat that involves unauthorized modification of data.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing

Question 13

An organization is conducting a vulnerability assessment of its IT assets. Which of the following sources is MOST authoritative for identifying known software vulnerabilities?

Accepted Answer

NVD (National Vulnerability Database). The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data, including CVEs, making it the most authoritative source.

Answer

DISA STIGs

Answer

OWASP Top 10

Answer

CIS Benchmarks

Question 14

A risk manager is developing risk scenarios to present to the board. Which TWO elements are essential for connecting a risk scenario to business impact?

Accepted Answer

Consequence (e.g., financial loss). Consequence describes the impact, and business impact is the direct result. These two elements directly link the scenario to business outcomes.

Answer

Threat actor motivation

Answer

Vulnerability score

Answer

Detection time

Question 15

A company is implementing a risk identification process for third-party risks. Which THREE factors should be considered when identifying risks from a critical software vendor?

Accepted Answer

Vendor's compliance with relevant regulations. Financial health affects vendor stability, regulatory compliance affects legal risk, and security incidents affect operational risk. Service level agreements are contractual, not risk factors per se.

Answer

Number of employees at vendor

Answer

Service level agreements (SLAs)

Question 16

An IT risk manager is categorizing risks identified during a recent assessment. Which TWO categories would include the risk of a system outage caused by a software bug?

Accepted Answer

Operational risk. A system outage due to a software bug is an operational risk (failure in IT operations) and can also be considered a financial risk if it leads to revenue loss or penalties.

Answer

Compliance risk

Answer

Strategic risk

Answer

Reputational risk

Question 17

An organization is developing an IT risk universe. Which of the following is the PRIMARY purpose of creating a comprehensive IT risk universe?

Accepted Answer

To ensure all potential IT risks are considered and documented. The IT risk universe captures all potential IT-related risks across the enterprise, ensuring that no significant risk area is overlooked during the risk identification process.

Answer

To prioritize risks based on their financial impact

Answer

To assign risk owners to each identified risk

Answer

To calculate the aggregated risk exposure for the organization

Question 18

During a risk assessment, the risk practitioner is identifying threats to an application. Which threat modeling technique is specifically designed to analyze application threats using categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Accepted Answer

STRIDE. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a threat modeling technique developed by Microsoft for identifying application security threats.

Answer

VAST

Answer

TRIKE

Answer

PASTA

Question 19

An organization has a risk appetite statement that says 'We accept up to $5 million in operational losses per year.' However, a new cloud migration project is estimated to have a potential operational loss of $8 million if a critical failure occurs. The risk capacity of the organization is $20 million. What should the risk practitioner recommend?

Accepted Answer

Implement risk treatment measures to reduce the potential loss to below $5 million. The risk tolerance threshold ($5 million) is exceeded by the potential loss ($8 million). The risk appetite is the amount of risk the organization is willing to accept, and this scenario exceeds it. While the risk capacity is higher, the appetite is not met, so risk treatment is needed to bring the residual risk within the tolerance.

Answer

Reject the project because the risk exceeds the risk appetite

Answer

Increase the risk appetite to $8 million to align with the project

Answer

Accept the risk because the risk capacity is $20 million

Question 20

Which of the following is a threat intelligence source that provides information about known exploited vulnerabilities, maintained by a government agency?

Accepted Answer

CISA KEV. CISA KEV (Known Exploited Vulnerabilities catalog) is maintained by the U.S. Cybersecurity and Infrastructure Security Agency and provides a list of vulnerabilities that have been exploited in the wild.

Answer

OSINT

Answer

NVD

Answer

ISACs