CRISC IT Risk Identification Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. What risk is introduced by this IAM policy?

Accepted Answer

Excessive permissions. The IAM policy grants `s3:*` actions on all S3 resources (`"Resource": "*"`), which allows any user or service assuming this role to perform any S3 operation, including deleting buckets, modifying permissions, or accessing all objects. This violates the principle of least privilege and introduces the risk of excessive permissions, as the policy does not restrict actions or resources to only what is necessary for the intended function.

Answer

Misconfigured encryption

Answer

Lack of logging

Answer

Weak authentication

Question 2

Refer to the exhibit. What is the most likely risk indicated by this error log?

Accepted Answer

SQL injection. The error log shows a SQL query with a single quote (') in the input, which is a classic indicator of a SQL injection attempt. The query 'SELECT * FROM users WHERE username = 'admin' OR '1'='1'' is attempting to manipulate the SQL statement to bypass authentication or extract data. This directly corresponds to SQL injection (option B), as the attacker is injecting malicious SQL code through user input.

Answer

Buffer overflow

Answer

Denial of service

Answer

Cross-site scripting

Question 3

A company has implemented a new cloud-based customer relationship management (CRM) system. The IT risk manager is tasked with identifying risks related to this system. Which of the following is the MOST important risk identification technique to use initially?

Accepted Answer

Facilitating a risk workshop with IT, business, and security stakeholders. Option B is correct because a risk workshop brings together stakeholders (IT, business, security) to identify risks collaboratively, which is effective for a new system. Option A (automated scanning) is useful for known vulnerabilities but not for business process risks. Option C (penetration testing) is for security validation, not initial identification. Option D (interviewing key users) is less comprehensive than a workshop.

Answer

Conducting a series of interviews with key users of the CRM

Answer

Performing a penetration test on the CRM environment

Answer

Automated vulnerability scanning of the CRM system

Question 4

During a risk assessment for a new financial application, the risk manager identifies that the application processes sensitive customer data and is accessible from the internet. Which of the following is the MOST appropriate risk scenario to document?

Accepted Answer

An attacker could exploit weak authentication mechanisms to gain unauthorized access and exfiltrate customer data, resulting in regulatory fines and reputational damage.. Option C is the most appropriate risk scenario because it follows the standard risk scenario structure: threat (attacker), vulnerability (weak authentication), impact (unauthorized access, data exfiltration, regulatory fines, reputational damage). It directly ties the technical weakness to a business consequence, which is essential for communicating risk to stakeholders. The scenario is specific to the application's internet-facing nature and sensitive data processing, making it actionable for risk treatment.

Answer

The application has several unpatched vulnerabilities that increase the likelihood of a security incident.

Answer

The application will implement multi-factor authentication to prevent unauthorized access.

Answer

The application must comply with PCI DSS requirements for data protection.

Question 5

A multinational organization uses a third-party vendor for cloud-based identity management. The vendor recently suffered a data breach that exposed user credentials. The risk manager is now re-evaluating the associated risk. Which of the following steps should the risk manager perform FIRST to identify potential new risks?

Accepted Answer

Update the risk register to include the new threat scenario of credential compromise via the vendor.. Option D is correct because updating the risk register with the new incident information is the first step to ensure all risks are captured. Option A (contract review) is important but secondary. Option B (penetration test) may be reactive but not immediate first step. Option C (access reviews) is a control, not risk identification.

Answer

Review the contract to determine if the vendor is liable for the breach.

Answer

Immediately revoke all vendor access to internal systems.

Answer

Conduct a penetration test of the organization's own systems.

Question 6

A risk manager is identifying risks for a new mobile payment application. The application will use end-to-end encryption. Which of the following is the BEST source of risk information for identifying potential threats?

Accepted Answer

Threat intelligence feeds specific to the financial services sector. Threat intelligence feeds specific to the financial services sector provide real-time, contextualized information about emerging threats, attack patterns, and vulnerabilities targeting mobile payment systems. Since the application uses end-to-end encryption, the risk manager needs to identify threats that could bypass or undermine encryption (e.g., side-channel attacks, key interception, or man-in-the-middle attacks on the handshake), which generic or historical sources would not capture. This source is the best because it is current, sector-specific, and directly relevant to the technology stack.

Answer

Industry benchmark risk assessments from similar organizations

Answer

Previous internal audit reports on legacy applications

Answer

Vendor-provided security white papers for the encryption product

Question 7

An organization is planning to deploy an IoT solution in a manufacturing plant. The risk manager is asked to identify risks associated with the integration of IoT devices into the plant network. Which of the following techniques would be MOST effective for identifying both technical and operational risks?

Accepted Answer

Facilitate a brainstorming session with IT, operational technology (OT), and safety teams. A brainstorming session that includes IT, operational technology (OT), and safety teams is the most effective technique because IoT integration creates a convergence of traditional IT risks (e.g., network segmentation, patch management) with OT-specific risks (e.g., real-time control system integrity, safety interlocks) and physical safety hazards. This cross-functional approach surfaces technical risks like unpatched firmware vulnerabilities in programmable logic controllers (PLCs) and operational risks such as unplanned downtime due to misconfigured device-to-controller communication protocols (e.g., Modbus/TCP without authentication).

Answer

Conduct a SWOT analysis of the IoT project

Answer

Interview the plant manager about operational challenges

Answer

Send a risk questionnaire to employees

Question 8

A risk manager is reviewing the risk register and notices that several risks have been identified as 'high' but no risk owner has been assigned. Which of the following is the MOST appropriate action to ensure proper risk identification going forward?

Accepted Answer

Update the risk identification policy to mandate that risk owners be identified during the initial risk identification phase.. Option D is correct because the risk identification phase should include assigning risk owners to ensure accountability from the outset. Without a risk owner, identified risks cannot be properly managed, monitored, or escalated. Mandating owner assignment during initial identification embeds ownership into the process, preventing gaps in risk governance.

Answer

Provide training to risk owners on their responsibilities.

Answer

Assign risk owners after the risk assessment is completed.

Answer

Conduct an audit of the risk identification process.

Question 9

An organization is implementing a new data loss prevention (DLP) solution. The risk manager is identifying potential risks related to the DLP solution itself. Which of the following is a risk that should be considered?

Accepted Answer

The DLP solution may generate a high volume of false positives, causing alert fatigue and missed real incidents.. Option A is correct because a DLP solution may generate false positives, leading to alert fatigue and missed detections. Option B is a benefit, not a risk. Option C is a control. Option D is a desired outcome.

Answer

The DLP solution will reduce the risk of data exfiltration.

Answer

The DLP solution will block all unauthorized data transfers.

Answer

The DLP solution will automatically encrypt sensitive data in transit.

Question 10

A risk manager is identifying risks for an organization that uses a hybrid cloud environment. The organization stores sensitive data on-premises and in the cloud. Which of the following is the MOST effective method for identifying risks related to data residency and compliance?

Accepted Answer

Review data flow diagrams and legal requirements for each jurisdiction. Reviewing data flow diagrams alongside legal requirements for each jurisdiction is the most effective method because it directly maps where sensitive data resides, transits, and is processed across on-premises and cloud environments, enabling precise identification of residency and compliance gaps. This approach aligns with CRISC's emphasis on risk identification through understanding data lineage and regulatory obligations, rather than relying on post-deployment security tests or generic reports.

Answer

Conduct a penetration test of the cloud environment

Answer

Perform a configuration review of cloud security settings

Answer

Review the cloud provider's SOC 2 report

Question 11

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Option B is correct because interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 12

Which TWO of the following are primary sources of risk identification for IT projects?

Accepted Answer

Project documentation (e.g., scope, schedule, budget). Project documentation such as scope, schedule, and budget is a primary source of risk identification because it defines the project's boundaries, constraints, and deliverables. Analyzing these documents helps identify risks related to scope creep, unrealistic timelines, or insufficient funding that could impact IT project success.

Answer

Social media monitoring

Answer

Vendor marketing materials

Answer

Industry benchmark reports

Question 13

Which TWO of the following are valid risk scenarios that should be documented during IT risk identification?

Accepted Answer

An employee may inadvertently share confidential data via email due to lack of data classification training.. Option A is correct because it describes a specific risk scenario: an employee inadvertently sharing confidential data via email due to lack of data classification training. This is a valid risk scenario as it identifies a threat (human error), a vulnerability (insufficient training), and a potential impact (data leakage). In IT risk identification, scenarios must be concrete and actionable, not just statements of compliance or controls.

Answer

The organization must comply with GDPR requirements for data protection.

Answer

The database server has not been patched for critical vulnerabilities.

Answer

The IT department will implement multi-factor authentication to reduce the risk of unauthorized access.

Question 14

Which THREE of the following are commonly used techniques for identifying IT risks in a large enterprise?

Accepted Answer

Brainstorming sessions. Options A, C, and D are correct. SWOT analysis (A) can identify risk-related strengths, weaknesses, opportunities, threats. Brainstorming (C) is a collaborative technique. Risk questionnaires (D) gather input from many stakeholders. Option B (Delphi technique) is used for consensus, not initial identification. Option E (cost-benefit analysis) is for evaluating controls, not identifying risks.

Answer

Cost-benefit analysis

Answer

Delphi technique

Question 15

Refer to the exhibit. During a risk identification exercise for the internal network, the risk manager reviews this firewall log entry. Which of the following risks is MOST directly suggested by this log entry?

Accepted Answer

An attacker could use SMB to move laterally from a compromised workstation to the server.. The firewall log shows an inbound SMB connection (port 445) from a workstation (10.0.0.5) to a server (10.0.0.10). SMB is commonly used for file sharing and remote administration, and if the workstation is compromised, an attacker can leverage SMB to move laterally to the server, potentially gaining access to sensitive data or escalating privileges. This aligns with the risk of lateral movement, which is a primary concern in internal network segmentation.

Answer

Sensitive data is being exfiltrated via SMB.

Answer

The workstation may be accessing the internet via the server.

Answer

The organization is vulnerable to a distributed denial-of-service (DDoS) attack.

CRISC IT Risk Identification Practice Test 6 — 15 Questions

Exhibit

CRISC IT Risk Identification Practice Test 6 — 15 Questions

Exhibit