easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A company has implemented a new cloud-based…
A company has implemented a new cloud-based customer relationship management (CRM) system. The IT risk manager is tasked with identifying risks related to this system. Which of the following is the MOST important risk identification technique to use initially?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Facilitating a risk workshop with IT, business, and security stakeholders
Facilitating a risk workshop (option C) is the most important initial risk identification technique because it brings together IT, business, and security stakeholders to collaboratively identify a broad range of risks associated with the new CRM system. This approach is more comprehensive than alternative methods: conducting interviews (option A) may miss systemic risks, while penetration testing (option B) and vulnerability scanning (option D) are focused on technical security vulnerabilities and are more appropriate for later stages of risk assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conducting a series of interviews with key users of the CRM
Why it's wrong here
Interviews are narrower than a workshop and may miss cross-functional risks.
- ✗
Performing a penetration test on the CRM environment
Why it's wrong here
Penetration testing is a later validation step, not initial risk identification.
- ✓
Facilitating a risk workshop with IT, business, and security stakeholders
Why this is correct
A risk workshop enables comprehensive identification of risks across people, process, and technology.
- ✗
Automated vulnerability scanning of the CRM system
Why it's wrong here
Automated scanning focuses on technical vulnerabilities, not broad risk identification for a new system.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.