hardMultiple ChoiceObjective-mapped
CRISC Practice Question: A multinational organization uses a third-party…
A multinational organization uses a third-party vendor for cloud-based identity management. The vendor recently suffered a data breach that exposed user credentials. The risk manager is now re-evaluating the associated risk. Which of the following steps should the risk manager perform FIRST to identify potential new risks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the risk register to include the new threat scenario of credential compromise via the vendor.
After a vendor data breach, the risk manager's first step in risk identification is to update the risk register with the newly realized threat scenario—credential compromise via the vendor. This ensures that the organization formally captures and assesses the risk, enabling subsequent analysis and response. Option A (contract review) is a response step, not identification. Option C (revoking access) is a reactive control. Option D (penetration test) is a later step for validating controls, not the first identification action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Review the contract to determine if the vendor is liable for the breach.
Why it's wrong here
Contract review is important but should follow identification and assessment of new risks.
- ✓
Update the risk register to include the new threat scenario of credential compromise via the vendor.
Why this is correct
Updating the risk register is the first step in risk identification after a new event.
- ✗
Immediately revoke all vendor access to internal systems.
Why it's wrong here
Revoking access may be a reactive control, not a risk identification step.
- ✗
Conduct a penetration test of the organization's own systems.
Why it's wrong here
This focuses internally, but the risk is from the vendor, so testing vendor systems is not under the organization's control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.