CRISC IT Risk Identification Practice Test 3 — 15 Questions

Question 1

Match each control type to its example.

Question 2

Match each compliance framework to its primary focus.

Question 3

A company is migrating its customer database to a public cloud provider. During the planning phase, which of the following is the MOST effective approach to identify risks specific to this migration?

Accepted Answer

Conduct a threat modeling exercise focusing on the cloud architecture. Conducting a threat modeling exercise (D) is the most effective approach because it systematically identifies threats, vulnerabilities, and attack vectors specific to the cloud architecture, data flow, and trust boundaries of the migration. Unlike generic reviews, threat modeling (e.g., using STRIDE or PASTA) directly addresses the unique risks of moving a customer database to a public cloud, such as misconfigured access controls, insecure APIs, or data exposure during transit.

Answer

Review industry risk reports for similar migrations

Answer

Rely on the cloud provider's published risk documentation

Answer

Perform a compliance checklist review

Question 4

During a merger and acquisition (M&A) due diligence, the acquiring company's IT risk manager is tasked with identifying risks in the target's IT environment. Which of the following would be the MOST effective technique to uncover hidden risks?

Accepted Answer

Perform an on-site technical assessment and interview key IT staff. Option D is correct because an on-site technical assessment and interviews allow the risk manager to observe actual controls, uncover undocumented systems, and assess security culture. Option A is incorrect because reviewing only high-level policies may miss operational gaps. Option B is incorrect because a vulnerability scan does not cover process or governance risks. Option C is incorrect because the target's own risk register may be incomplete or biased.

Answer

Analyze the target's existing risk register

Answer

Review the target's IT policies and procedures

Answer

Conduct a network vulnerability scan

Question 5

A software development team is adopting Agile methodology and wants to integrate risk identification into their sprints. Which approach BEST aligns with Agile principles while ensuring effective risk identification?

Accepted Answer

Incorporate a risk identification task in each sprint backlog and review risks during sprint retrospectives. Option D is correct because Agile emphasizes iterative, continuous improvement, and integrating risk identification into each sprint backlog ensures risks are identified and addressed as the project evolves. Reviewing risks during sprint retrospectives aligns with the Agile principle of inspecting and adapting, making risk management a recurring, team-driven activity rather than a one-time event. This approach is effective because it captures risks that emerge from changing requirements, technical debt, or integration issues during development.

Answer

Conduct a risk workshop at the start of the project only

Answer

Assign risk identification solely to the product owner

Answer

Perform an annual risk assessment

Question 6

An organization uses a third-party SaaS provider for payroll processing. Which of the following is the BEST technique to identify risks associated with this vendor?

Accepted Answer

Review the vendor's SOC 2 Type II report and conduct an on-site assessment. The SOC 2 Type II report provides an independent auditor's assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time, which is critical for identifying risks in a payroll SaaS processing sensitive employee data. An on-site assessment allows the organization to verify physical and logical controls, observe operations, and discuss specific risk scenarios directly with vendor personnel, offering a deeper risk identification than any single document or review.

Answer

Request a penetration test report from the vendor

Answer

Check online user reviews and ratings

Answer

Read the vendor's marketing materials and case studies

Question 7

An internal audit report identifies that the IT department did not patch a critical vulnerability in a database server for 90 days. The risk manager wants to identify the root cause risk. Which approach should be used?

Accepted Answer

Perform a root cause analysis on the patching process. Option D is correct because the risk manager needs to identify the root cause risk, which requires understanding why the patching process failed to apply a critical security update within the required timeframe. A root cause analysis (RCA) on the patching process systematically examines procedural breakdowns, such as missed scanning cycles, lack of change management approval, or insufficient prioritization of database-specific patches (e.g., Oracle Critical Patch Updates). This approach directly addresses the underlying process deficiency rather than merely documenting or re-verifying the vulnerability.

Answer

Interview the database system owner

Answer

Conduct a new vulnerability scan

Answer

Update the risk register with the finding

Question 8

A financial institution is implementing a new real-time payment system that will process high-value transactions. To identify emerging risks, which method would be MOST effective during the development phase?

Accepted Answer

Embed automated security testing and threat modeling into the CI/CD pipeline. Embedding automated security testing and threat modeling into the CI/CD pipeline enables continuous risk identification as code is developed, which is critical for a real-time high-value payment system where vulnerabilities introduced early could lead to financial loss or fraud. This approach aligns with the CRISC focus on proactive risk identification during the development phase, rather than relying on later-stage reviews.

Answer

Wait for a post-implementation penetration test

Answer

Conduct a security review of the completed system before deployment

Answer

Develop a straw man architecture and perform a threat model

Question 9

An IT risk manager is facilitating a workshop to identify risks for a new mobile banking application. Which technique is MOST appropriate for generating a comprehensive list of risks?

Accepted Answer

Conduct a brainstorming session with cross-functional team members. Brainstorming with a cross-functional team (option C) is the most appropriate technique for generating a comprehensive list of risks for a new mobile banking application because it leverages diverse perspectives from development, security, compliance, and business units. This collaborative approach helps uncover unknown or emergent risks specific to the application's architecture, such as API vulnerabilities, session management flaws, or regulatory gaps, which might not be captured by historical data or structured questionnaires.

Answer

Review risk registers from similar projects

Answer

Perform a SWOT analysis

Answer

Distribute a risk questionnaire to project stakeholders

Question 10

A business continuity manager wants to identify risks that could disrupt critical business processes. Which source of information would be MOST valuable for identifying such risks?

Accepted Answer

Business impact analysis (BIA) documentation. The Business Impact Analysis (BIA) documentation is the most valuable source because it systematically identifies critical business processes, their dependencies (e.g., specific servers, databases, network links), and the maximum tolerable downtime (MTD) for each. This directly pinpoints which risks would cause unacceptable disruption, making it the foundational input for risk identification in continuity planning.

Answer

Organizational charts

Answer

Industry benchmarks on downtime

Answer

Historical incident reports

Question 11

A security operations center (SOC) analyst notices multiple failed login attempts from an internal IP address followed by a successful login from an unusual geographic location. Which risk identification technique should the risk manager use to assess this as a potential risk?

Accepted Answer

Perform user and entity behavior analytics (UEBA) on the user account. Option A is correct because analyzing user behavior analytics (UBA) can identify anomalous patterns indicative of account compromise, turning an event into a risk. Option B is incorrect because a vulnerability scan does not detect behavioral anomalies. Option C is incorrect because a phishing simulation tests user awareness, not specific events. Option D is incorrect because log review alone may not contextualize the event as a risk without behavioral analysis.

Answer

Run a phishing simulation for the user

Answer

Review the logs manually for other indicators

Answer

Conduct a vulnerability scan on the workstation

Question 12

Which TWO of the following are recognized techniques for identifying IT risks? (Select exactly 2.)

Accepted Answer

Brainstorming sessions. Brainstorming sessions (B) are a recognized technique for IT risk identification because they leverage the collective expertise of stakeholders to surface potential threats, vulnerabilities, and risk scenarios in a structured or unstructured group setting. This method is specifically cited in ISACA's CRISC Review Manual as a qualitative risk identification approach, often used during the early stages of risk assessment to generate a comprehensive list of risks without requiring quantitative data.

Answer

ROI calculation

Answer

Benchmarking against industry peers

Answer

SWOT analysis

Question 13

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register is a foundational artifact in IT risk management, and during the identification phase, its essential components are the risk description (to uniquely identify the risk), the risk owner (to assign accountability), and the root cause (to understand the underlying source). These three elements are documented before any quantitative analysis or mitigation planning occurs, as they form the basis for subsequent risk assessment and response.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 14

A SIEM generates alerts for the following events. Which TWO events should be considered potential emerging risks? (Select exactly 2.)

Accepted Answer

High number of failed authentication attempts from a single IP. A high number of failed authentication attempts from a single IP (C) is a classic indicator of a brute-force or password-spraying attack. This represents an emerging risk because it signals active reconnaissance or attempted unauthorized access, which could lead to account compromise or lateral movement if successful.

Answer

Scheduled backup completed successfully

Answer

Software update installed on server

Answer

Low disk space alert on a file server

Question 15

Based on the exhibit, which of the following risks is MOST indicated by the policy configuration?

Accepted Answer

Exposure of web server to untrusted networks without encryption. The policy configuration shows a rule allowing inbound HTTP/HTTPS traffic from the internet to a web server without any associated encryption requirement (e.g., no TLS enforcement or VPN). This directly exposes the web server to untrusted networks, making it vulnerable to man-in-the-middle attacks and data interception, which is the most significant risk indicated.

Answer

Data exfiltration via MySQL from the internet

Answer

Unauthorized SSH access to the internal network

Answer

Policy misconfiguration causing low hits on rule 3