CRISC IT Risk Identification Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Incomplete destruction of sensitive data on decommissioned storage media, leading to unauthorized disclosure.

  Why this is correct

  When decommissioning a data center, ensuring that all sensitive data is securely wiped or destroyed from storage media is critical. If not properly handled, residual data could be recovered by unauthorized parties, leading to a data breach. This is a well-known risk in decommissioning projects and must be included in the risk register. It addresses confidentiality and compliance requirements.

• ✗

  Failure to update the IT service continuity plan to reflect the new cloud architecture.

  Why it's wrong here

  Updating the IT service continuity plan is important, but it is a control or mitigation activity rather than a risk itself. The risk would be that the continuity plan is not updated, leading to ineffective response during a disaster. However, the scenario asks for risks associated with decommissioning. While this could be a risk, it is more of a project management oversight. The two most significant risks are knowledge loss and data remnants, which directly impact the decommissioning outcome.

• ✗

  Inability to meet new regulatory requirements for data residency in the cloud environment.

  Why it's wrong here

  While data residency is a valid cloud risk, it is not specifically tied to the decommissioning of a legacy data center. The scenario focuses on the decommissioning project, and data residency would be a risk of the cloud migration itself, which may already be covered. The most significant risks for decommissioning are those directly related to the shutdown and transition, such as knowledge loss and data remnants. This option is less directly relevant to the decommissioning phase.

• ✗

  Increased cloud subscription costs due to unexpected usage spikes after migration.

  Why it's wrong here

  Cost overruns in the cloud are a financial risk, but they are not directly caused by the decommissioning of the legacy data center. The decommissioning project's primary risks are related to the shutdown process, data security, and knowledge transfer. Cloud cost management is a separate operational risk that should be addressed in the cloud migration plan. This option is less significant for the decommissioning risk register.

• ✓

  Loss of institutional knowledge about legacy application dependencies as experienced staff leave or retire.

  Why this is correct

  During decommissioning, the departure of staff who understand legacy systems can lead to undocumented dependencies and integration points being overlooked. This can cause migration failures or outages. This is a significant risk because it directly affects the ability to migrate applications successfully and maintain business continuity. It should be captured in the risk register to ensure knowledge transfer and documentation are prioritized.

Go deeper

Related to this question