CRISC IT Risk Identification Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, what risk is indicated by the IAM policy?

Accepted Answer

External auditor can access sensitive data from any location. Option B is correct. The second statement allows the external-auditor user to download objects from the corporate-data bucket without an IP restriction, meaning the auditor can access data from anywhere, not just the internal network. Option A is incorrect because the condition restricts the first statement, but the second lacks restrictions. Option C is incorrect because there is no encryption requirement. Option D is incorrect because the policy allows GetObject, not list (ListBucket), so listing is not directly indicated, but risk is about access from anywhere.

Answer

Unrestricted public access to the S3 bucket

Answer

Bucket is configured to allow list operations

Answer

Data in transit is unencrypted

Question 2

Based on the exhibit, what risk does this database error MOST directly indicate?

Accepted Answer

Risk of data inconsistency due to concurrency issues. The database error indicates a concurrency control failure, such as a deadlock or serialization anomaly, which directly leads to data inconsistency when multiple transactions execute simultaneously without proper isolation. This is a classic risk in multi-user database environments where ACID properties are violated, resulting in lost updates or dirty reads.

Answer

SQL injection vulnerability

Answer

Unauthorized access to employee records

Answer

Insufficient disk space for transactions

Question 3

A company is identifying risks associated with a new cloud-based CRM. Which of the following is the MOST effective method for identifying potential threats?

Accepted Answer

Threat modeling workshops with stakeholders. Threat modeling workshops with stakeholders are the most effective method because they leverage diverse expertise to systematically identify threats specific to the cloud-based CRM architecture, including misconfigurations in IAM roles, API vulnerabilities, and data residency issues. This collaborative approach aligns with the CRISC focus on proactive risk identification by considering business context, technical constraints, and regulatory requirements early in the lifecycle.

Answer

Reviewing industry standards only

Answer

Conducting penetration testing alone

Answer

Analyzing historical security incidents from similar organizations

Question 4

An organization wants to identify risks related to third-party vendors. Which approach best supports continuous risk identification?

Accepted Answer

Automated monitoring of vendor security controls via a third-party risk platform. Automated monitoring via a third-party risk platform enables continuous, real-time visibility into vendor security controls, such as firewall rule changes, vulnerability scan results, and compliance posture. This approach aligns with the CRISC principle of ongoing risk identification, as it detects changes in risk exposure between formal assessment cycles without relying on periodic snapshots.

Answer

Contractual clauses requiring self-assessment

Answer

On-site audits every two years

Answer

Annual vendor risk assessments

Question 5

During a risk identification workshop, the team identifies a potential data leakage from a legacy system. What is the FIRST step the risk owner should take?

Accepted Answer

Document the risk and its source. The first step for the risk owner is to formally document the risk and its source. This ensures that the identified data leakage from the legacy system is captured in the risk register, establishing a baseline for analysis and treatment. Without documentation, subsequent steps like risk scoring, control implementation, or escalation cannot be properly justified or tracked.

Answer

Implement encryption immediately

Answer

Assign a risk score

Answer

Report to senior management

Question 6

Which risk identification technique relies on analyzing past incidents to predict future risks?

Accepted Answer

Loss event data analysis. Loss event data analysis (B) is the correct risk identification technique because it systematically examines historical incident records, such as security logs, breach reports, and audit findings, to identify patterns and trends that can predict future risks. This empirical approach leverages past loss events to quantify likelihood and impact, making it distinct from generative or qualitative methods.

Answer

Brainstorming

Answer

SWOT analysis

Answer

Delphi technique

Question 7

A retail company is identifying risks in its supply chain. Which approach is most effective for identifying previously unknown risks?

Accepted Answer

Scenario analysis with supply chain partners. Scenario analysis with supply chain partners is most effective for identifying previously unknown risks because it leverages collaborative brainstorming and 'what-if' thinking to uncover emergent threats that are not captured by historical data or static checklists. This approach is particularly valuable in supply chain contexts where interdependencies, third-party vulnerabilities, and novel disruptions (e.g., a new cyberattack vector targeting a logistics provider) can surface only through joint exploration of hypothetical events. It aligns with the CRISC emphasis on proactive risk identification beyond known patterns.

Answer

Employee surveys

Answer

Financial audit reports

Answer

Review of standard risk checklists

Question 8

A company is conducting a Risk Identification for a new payment processing system. The team discovers that the system does not have encryption at rest. This is an example of:

Accepted Answer

Vulnerability. The absence of encryption at rest in a payment processing system is a weakness or flaw that can be exploited, making it a vulnerability. In risk identification, a vulnerability is a condition or weakness in an asset (e.g., database, storage volume) that, if exploited by a threat, could lead to a risk event. Here, the missing encryption at rest (e.g., AES-256 for stored cardholder data) is a specific security gap, not the threat itself or the resulting risk.

Answer

Control

Answer

Threat

Answer

Risk

Question 9

Which of the following is the PRIMARY purpose of a risk register in the risk identification phase?

Accepted Answer

Document identified risks and their characteristics. The primary purpose of a risk register during the risk identification phase is to systematically document each identified risk along with its key characteristics, such as the risk description, cause, impact, and potential triggers. This foundational record ensures that all risks are captured before any subsequent analysis or response planning occurs, aligning with the CRISC domain of IT Risk Identification.

Answer

Assign risk owners

Answer

Calculate risk scores

Answer

Track remediation progress

Question 10

An organization is using the OCTAVE method for risk identification. Which activity is typically performed FIRST?

Accepted Answer

Establish risk measurement criteria. In the OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) method, the first phase is 'Build Asset-Based Threat Profiles,' which begins with establishing risk measurement criteria (e.g., impact scales, likelihood definitions) to guide subsequent asset prioritization and threat identification. This ensures that all later activities are aligned with the organization's risk appetite and tolerance levels.

Answer

Identify threats

Answer

Identify critical assets

Answer

Identify vulnerabilities

Question 11

A multinational corporation is identifying risks associated with cross-border data transfers. Which regulation's risk identification requirements are most relevant?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the most relevant regulation for risk identification in cross-border data transfers because it explicitly governs the transfer of personal data from the European Economic Area (EEA) to third countries. GDPR requires organizations to identify and assess risks related to adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), and potential data localization conflicts. This regulation directly addresses the legal and technical risks of moving data across borders, such as exposure to differing privacy laws and surveillance regimes.

Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Question 12

Refer to the exhibit. What is the MOST immediate risk identification action?

Accepted Answer

Check if the patch has been deployed. The exhibit (not shown) likely presents a vulnerability scan result or a security advisory. The most immediate risk identification action is to verify whether the identified vulnerability has already been mitigated by deploying the vendor-supplied patch. This confirms the current exposure status before any further risk assessment or documentation steps are taken.

Answer

Document the vulnerability in the risk register

Answer

Update asset inventory

Answer

Validate the vulnerability manually

Question 13

Refer to the exhibit. What is the PRIMARY risk identified from this policy?

Accepted Answer

Unrestricted public read access to confidential data. The policy statement 'All S3 buckets must be private by default' directly addresses the risk of public read access to confidential data. If a bucket is misconfigured as public, anyone on the internet can read its objects without authentication, leading to a data breach. This is the primary risk because the policy explicitly targets preventing unauthorized public exposure.

Answer

Inadequate logging

Answer

Lack of encryption for data at rest

Answer

Missing versioning

Question 14

Refer to the exhibit. Which risk is MOST directly identified?

Accepted Answer

Unauthorized remote access to a critical server. The exhibit (not shown) likely depicts a network diagram or access control list (ACL) configuration that allows inbound traffic from the internet to a critical server on a restricted port (e.g., RDP on TCP 3389 or SSH on TCP 22). This directly identifies the risk of unauthorized remote access, as an attacker could exploit this exposed management interface to gain control of the server. The other options are not directly indicated by such a configuration.

Answer

Denial of service vulnerability

Answer

Malware propagation across subnets

Answer

Weak password policy

Question 15

Which TWO are primary objectives of IT risk identification?

Accepted Answer

Identify threats and vulnerabilities. Option C is correct because IT risk identification primarily involves cataloging threats (e.g., malware, insider misuse) and vulnerabilities (e.g., unpatched CVEs, misconfigured firewalls) that could exploit weaknesses in assets. This step is foundational to building a risk register and precedes any analysis or treatment. Without identifying specific threats and vulnerabilities, subsequent risk assessment and mitigation efforts would lack a factual basis.

Answer

Assign risk owners

Answer

Determine risk appetite

Answer

Implement controls

CRISC IT Risk Identification Practice Test 4 — 15 Questions

Exhibit

CRISC IT Risk Identification Practice Test 4 — 15 Questions

Exhibit