CRISC IT Risk Identification Practice Question
A risk practitioner is estimating the likelihood of a ransomware event affecting a manufacturing firm's operational technology environment. Historical incident data is sparse, so the practitioner convenes plant engineers, security staff, and the insurance broker to elicit calibrated estimates and combine them into a reasoned likelihood. Which technique is being used?
⚠ Common exam trap
The trap here is reaching for a quantitative model like Monte Carlo or Bayesian updating when the real problem is that no data exists yet to parameterize those models.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Delphi technique with structured expert elicitation.
When incident data is too sparse to support statistical estimation, structured expert elicitation such as the Delphi technique is the appropriate way to generate calibrated likelihood estimates. It pools diverse expertise, uses anonymity and iteration to reduce bias, and converges on a defensible consensus. The resulting estimate can later feed quantitative models if data improves, keeping the analysis honest about its uncertainty.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Delphi technique with structured expert elicitation.
Why this is correct
The Delphi technique gathers anonymous, iterative expert judgments and converges them toward a calibrated consensus, which fits sparse-data situations perfectly. By combining engineers, security, and the broker, the practitioner draws on operational, technical, and actuarial perspectives. Structured elicitation reduces anchoring and groupthink, producing a reasoned likelihood estimate where historical incident data alone cannot support one.
- ✗
Bayesian updating of the prior incident frequency.
Why it's wrong here
Bayesian updating combines a prior belief with new evidence to produce a posterior distribution. It is powerful when new observations arrive, but here the problem is the absence of data, and the practitioner is gathering expert judgment rather than updating a prior with observed events. The described activity is elicitation, not statistical revision of an existing frequency.
- ✗
Monte Carlo simulation of the plant's loss distribution.
Why it's wrong here
Monte Carlo simulation models uncertainty by running many iterations over input distributions, but it still requires those inputs. With sparse historical data, the practitioner must first elicit or derive the distributions to feed the model. Simulation is a downstream analytical step, not the elicitation technique being applied here when experts are convened to produce the underlying likelihood estimates.
- ✗
Fault tree analysis of the ransomware attack path.
Why it's wrong here
Fault tree analysis decomposes a top event into contributing failure paths using Boolean logic. It is a deductive reliability technique that maps how failures combine, not a method for eliciting calibrated likelihood estimates from a panel of experts. The practitioner here is seeking a probability judgment, so fault tree analysis addresses a different analytical question.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.