CRISC IT Risk Identification Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Risk of financial loss from a ransomware payment

  Why it's wrong here

  A ransomware payment is a financial-loss consequence, mapping to financial rather than operational risk. It is tempting because ransomware disrupts service delivery, yet CRISC categorises risk by the affected business objective, and monetary loss sits under financial risk.

• ✗

  Risk of non-compliance with GDPR for customer data stored in the EU

  Why it's wrong here

  GDPR non-compliance is a regulatory and legal exposure, categorised as compliance risk, not operational. It is tempting because the breach often stems from operational failures, but CRISC classifies by the obligation breached, and regulatory penalties fall under compliance.

• ✓

  Risk of production line downtime due to a server failure

  Why this is correct

  Server failure causing production line downtime is an operational IT risk because it concerns the day-to-day reliability and availability of systems supporting business processes. This satisfies the stem's operational category, which covers disruptions to service delivery and processing, rather than strategic, compliance or external risk domains.

• ✗

  Risk of reputational damage from a data breach

  Why it's wrong here

  Reputational damage is categorised as strategic or reputational risk, not operational. It is tempting because a data breach usually originates from an operational control failure, yet CRISC assigns the risk to the business objective ultimately affected, which here is reputation.