CRISC IT Risk Identification Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. A risk manager is reviewing IAM policies for an S3 bucket used for sensitive data. This policy allows which of the following?

Accepted Answer

Users from the internal network (10.0.0.0/8) to write (PutObject) to the bucket. Option C is correct because the policy statement includes a condition that restricts the s3:PutObject action to requests originating from the 10.0.0.0/8 IP range, and the principal is set to '*' (any authenticated user), meaning only authenticated users from the internal network can write to the bucket. The policy does not grant GetObject permissions, so reads are not allowed.

Answer

Any user to read (GetObject) from the bucket

Answer

Any user to write (PutObject) to the bucket from any IP address

Answer

Users from the internal network to read (GetObject) from the bucket

Question 2

Refer to the exhibit. During a risk identification review, the risk manager sees this IDS alert. What risk does this alert MOST directly indicate?

Accepted Answer

An internal SQL server is exposed to the internet and may be probed for vulnerabilities.. The IDS alert indicates an inbound connection attempt to TCP port 1433 (Microsoft SQL Server) from an external IP address. This directly suggests that an internal SQL server is exposed to the internet, which is a security misconfiguration that allows external entities to probe for vulnerabilities, such as weak credentials or unpatched flaws. While data exfiltration or malware could be subsequent outcomes, the alert itself most immediately signals the exposure and probing risk.

Answer

Sensitive data is being exfiltrated from the SQL server.

Answer

A malware infection is spreading across the network.

Answer

The organization is under a distributed denial-of-service (DDoS) attack.

Question 3

During a cloud migration project, the IT risk manager is identifying risks associated with data residency. Which of the following is the MOST effective method to identify applicable regulatory requirements?

Accepted Answer

Implementing a data classification policy that maps to regulatory frameworks. Implementing a data classification policy that maps to regulatory frameworks is the most effective method because it systematically identifies which data types are subject to specific regulations (e.g., GDPR, HIPAA, LGPD) based on content and jurisdiction. This proactive approach ensures that all applicable legal and contractual requirements are considered before engaging with cloud providers, rather than relying on post-hoc interviews or scans.

Answer

Interviewing cloud service providers about compliance

Answer

Conducting a vulnerability scan of the cloud environment

Answer

Reviewing past audit findings

Question 4

A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?

Accepted Answer

Document the vulnerability and assess the associated risk in the risk register. The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

Answer

Apply a virtual patch via an intrusion prevention system

Answer

Isolate the application from the network

Answer

Notify the application owner and request an emergency patch

Question 5

An organization is evaluating threat intelligence feeds to improve IT risk identification. Which of the following criteria should be given the HIGHEST priority when selecting a feed?

Accepted Answer

Relevance to the organization's industry and technology stack. Relevance to the organization's industry and technology stack is the highest priority because threat intelligence that does not align with the specific attack surface, software versions, and threat actors targeting that industry will generate excessive false positives and irrelevant alerts. For example, a healthcare organization using Epic EHR would prioritize feeds covering healthcare-specific ransomware (e.g., Ryuk) and medical device vulnerabilities over generic indicators, ensuring risk identification is actionable and contextually accurate.

Answer

Ease of integration with existing security tools

Answer

The feed's update frequency

Answer

The number of indicators provided per day

Question 6

A company is conducting a risk assessment of a critical third-party service provider. Which of the following is the BEST source of information to identify risks associated with the provider's sub-processors?

Accepted Answer

The provider's documented vendor risk management program and audit reports of sub-processors. The provider's documented vendor risk management program and audit reports of sub-processors are the best source because they directly detail the controls, security posture, and compliance status of the sub-processors. This information is specific to the sub-processors' operations, unlike general reports or contracts that may not cover their unique risks. It enables the company to assess third-party and fourth-party risks as part of a comprehensive IT risk identification process.

Answer

Service level agreements in the contract

Answer

SOC 2 Type II reports of the primary provider

Answer

Public announcements of data breaches involving the provider

Question 7

An organization is updating its asset inventory to improve IT risk identification. Which of the following asset attributes is MOST critical for assessing cybersecurity risk?

Accepted Answer

Criticality rating based on business impact. For assessing cybersecurity risk, the most critical attribute is the criticality rating based on business impact because it directly quantifies the potential harm from a security incident. Without knowing which assets are most vital to business operations, risk prioritization becomes arbitrary, leading to misallocated security controls. This aligns with the CRISC focus on risk-based decision-making, where impact drives the urgency of mitigation.

Answer

IP address and location

Answer

Asset owner contact information

Answer

Software vendor name

Question 8

A risk practitioner is analyzing the results of a phishing simulation. The simulation had a 15% click rate on a test email targeting finance department staff. Which of the following conclusions is MOST valid regarding IT risk identification?

Accepted Answer

There is an increased risk of successful targeted phishing attacks against finance staff. A 15% click rate on a targeted phishing simulation indicates that a significant portion of finance staff are susceptible to social engineering, which directly increases the risk of a successful targeted phishing attack. This finding is a key input for IT risk identification because it reveals a control weakness (user awareness) that could be exploited by attackers to gain unauthorized access or initiate fraudulent transactions. The click rate itself is a risk indicator, not a definitive measure of control effectiveness like email filtering.

Answer

The email filtering system is ineffective

Answer

This is an effective red team exercise

Answer

The organization has a low risk of credential theft

Question 9

During a risk identification workshop, the business process owner states that a key system has no documented dependencies. What is the BEST next step for the risk practitioner?

Accepted Answer

Document the missing dependency information as a risk in the risk register. Option D is correct because undocumented dependencies represent an unknown risk that must be captured in the risk register to ensure visibility and subsequent analysis. By documenting the missing dependency information as a risk, the risk practitioner formally acknowledges the gap, enabling further investigation into potential single points of failure, cascading failures, or unmonitored interconnections that could impact system availability or integrity.

Answer

Ask the system administrator to provide a list after the workshop

Answer

Postpone the workshop until dependencies are mapped

Answer

Assume the system has no dependencies

Question 10

An organization is implementing a data classification scheme. Which of the following classification categories would be MOST effective for identifying risks related to intellectual property theft?

Accepted Answer

Confidential. Confidential data is the classification category specifically designed to protect sensitive information that, if disclosed, could cause significant harm to the organization, including intellectual property theft. In a data classification scheme, 'Confidential' typically applies to trade secrets, source code, and proprietary designs, making it the most effective category for identifying and mitigating risks related to IP theft.

Answer

Restricted

Answer

Internal

Answer

Public

Question 11

A risk practitioner is reviewing system logs and notices multiple failed login attempts from a foreign IP address. This observation is an example of which type of risk identification activity?

Accepted Answer

Incident and event monitoring. The observation of multiple failed login attempts from a foreign IP address is a direct result of reviewing system logs, which is a core component of incident and event monitoring. This activity involves the continuous surveillance of security events to detect anomalies, such as brute-force attacks, and is a reactive risk identification technique that identifies risks based on actual occurrences.

Answer

Control self-assessment

Answer

Threat intelligence gathering

Answer

Vulnerability scanning

Question 12

Which TWO of the following are primary techniques for identifying IT risks in an organization? (Choose two.)

Accepted Answer

Brainstorming workshops with process owners. Correct: A and C. Brainstorming workshops (A) and reviewing audit findings (C) are direct risk identification methods. Vulnerability scanning (B) identifies technical issues, not risk per se. BIA (D) focuses on impact. Control testing (E) tests controls, not identify risks.

Answer

Vulnerability scanning

Answer

Business impact analysis (BIA)

Answer

Control self-assessments

Question 13

Which THREE of the following are key indicators that a risk identification process is effective? (Choose three.)

Accepted Answer

The process covers all critical business processes. Option B is correct because an effective risk identification process must cover all critical business processes to ensure that risks are identified across the entire value chain. Without this coverage, significant risks in core operations could be missed, leading to incomplete risk assessments and potential business disruptions. This aligns with the CRISC focus on aligning IT risk management with business objectives.

Answer

The process identifies all known vulnerabilities

Answer

The process is completed within budget

Question 14

Which TWO of the following are examples of external risk identification sources? (Choose two.)

Accepted Answer

Regulatory bulletins from government agencies. Regulatory bulletins from government agencies (Option B) are external risk identification sources because they originate outside the organization and provide authoritative information on compliance requirements, legal changes, and mandated controls. Threat intelligence feeds from industry sources (Option D) are also external, as they aggregate data on emerging threats, vulnerabilities, and attack patterns from third-party vendors or open-source communities, helping organizations proactively adjust defenses.

Answer

Incident response reports from the security operations center

Answer

Internal vulnerability scan reports

Answer

Industry benchmarking reports

Question 15

Based on the firewall log exhibit, which of the following conclusions is MOST appropriate for risk identification?

Accepted Answer

There is evidence of a potential reverse shell or malware beaconing from host 10.0.1.15. Option D is correct because the firewall log shows an outbound connection from internal host 10.0.1.15 to external server 203.0.113.50 on a high ephemeral port (e.g., 4444), which is commonly associated with reverse shell payloads or malware command-and-control (C2) beaconing. This pattern indicates that the internal host may have been compromised and is establishing an outbound channel to an external attacker, bypassing typical inbound firewall rules. Such behavior is a critical risk indicator for IT risk identification, as it suggests active malicious activity within the network.

Answer

External server 198.51.100.20 is attempting to exploit host 10.0.1.10

Answer

Host 10.0.1.15 is successfully communicating with external server 203.0.113.50

Answer

The firewall is functioning correctly with no security incidents

CRISC IT Risk Identification Practice Test 7 — 15 Questions

Exhibit

CRISC IT Risk Identification Practice Test 7 — 15 Questions

Exhibit