CRISC IT Risk Identification Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Multiple risk categories for a single risk

  Why this is correct

  A single data breach event is being recorded against two distinct risk taxonomies simultaneously: regulatory compliance under GDPR and reputational damage. That dual tagging demonstrates one risk mapping to multiple categories, not separate risks or a single classification.

• ✗

  Risk aggregation

  Why it's wrong here

  Aggregation combines multiple individual risks into a single higher-level view for reporting or capital purposes. The stem describes one event assigned two category labels, not several risks summed together. Aggregation would be correct when consolidating, say, many application risks into a portfolio-level risk register entry.

• ✗

  Improper risk classification

  Why it's wrong here

  Categorising one breach under both compliance and reputational headings is valid multi-category classification, not an error. Improper classification would mean assigning a risk to a category that does not apply, or omitting an applicable one. GDPR breach consequences genuinely span both categories, so no misclassification occurs here.

• ✗

  Risk scenario overlap

  Why it's wrong here

  A single breach event legitimately maps to multiple risk categories; that is inherent to the event, not an overlap of separate scenarios. Risk scenario overlap describes distinct scenarios sharing a common cause or asset, which is not what the stem describes. The stem illustrates one event with multiple consequence categories.