mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Implementing a new cloud-based customer…
A company is implementing a new cloud-based customer relationship management (CRM) system. The IT risk manager needs to assess the risk of data exfiltration by a malicious insider at the cloud provider. Which risk assessment approach is most appropriate for this scenario?
⚠ Common exam trap
Watch out — candidates often choose quantitative risk assessment (A) because it seems more rigorous, but they fail to recognize that insider threats at a cloud provider lack the historical data needed for ALE/SLE calculations, making scenario analysis the practical and most appropriate approach per CRISC best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scenario analysis with a focus on likelihood and impact
Scenario analysis is most appropriate because the risk of data exfiltration by a malicious insider at the cloud provider is a complex, low-frequency, high-impact threat that is difficult to quantify with historical data. This approach allows the risk manager to systematically evaluate specific attack paths (e.g., an insider with database access copying customer records) by focusing on likelihood and impact, which aligns with the qualitative nature of insider threat assessment in a cloud environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Quantitative risk assessment using ALE and SLE
Why it's wrong here
Quantitative assessment requires reliable numerical data, which may be unavailable for insider threats.
- ✗
Application of the COSO ERM framework
Why it's wrong here
COSO ERM is an enterprise risk management framework, not specific to IT risk assessment.
- ✓
Scenario analysis with a focus on likelihood and impact
Why this is correct
Scenario analysis effectively evaluates specific threat scenarios like insider data exfiltration.
- ✗
Control self-assessment (CSA) against ISO 27001
Why it's wrong here
CSA is a control evaluation, not a risk assessment technique.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.