easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A risk practitioner is facilitating a workshop to…
A risk practitioner is facilitating a workshop to identify IT risks for a new product launch. Which technique BEST encourages participants to think about risks from different perspectives?
⚠ Common exam trap
ISACA often tests the misconception that unstructured brainstorming (Option D) is the most creative approach, but the trap is that without a framework, participants miss systematic threat categories and the workshop fails to identify risks like elevation of privilege or repudiation that require structured prompting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a structured framework such as STRIDE or OCTAVE.
A structured framework like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) or OCTAVE provides predefined threat categories that force participants to systematically consider risks from multiple angles—such as security, operational, and compliance perspectives—rather than relying on ad hoc thinking. This ensures comprehensive coverage of the attack surface for the new product launch, including often-overlooked areas like repudiation or elevation of privilege in cloud-based microservices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Using a structured framework such as STRIDE or OCTAVE.
Why this is correct
Structured frameworks guide thinking across risk categories.
- ✗
Asking each participant to write risks individually.
Why it's wrong here
Individual writing lacks collaborative synergy.
- ✗
Using a checklist of common IT risks.
Why it's wrong here
Checklists can be too restrictive and overlook novel risks.
- ✗
Brainstorming without any predefined categories.
Why it's wrong here
Unstructured brainstorming may miss systematic risks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.