easyMultiple ChoiceObjective-mapped
CRISC Practice Question: An IT manager is identifying risks for a new…
An IT manager is identifying risks for a new cloud application. Which of the following is the BEST source for identifying specific threats relevant to cloud services?
⚠ Common exam trap
Test-takers frequently choose internal audit findings (Option B) thinking they are authoritative, but they fail to recognize that internal audits are retrospective and limited to existing controls, whereas industry threat reports provide forward-looking, external threat intelligence essential for identifying emerging cloud-specific risks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Industry threat reports
Industry threat reports (Option D) are the BEST source because they aggregate real-world threat intelligence specific to cloud environments, such as data from the Cloud Security Alliance (CSA) or Verizon DBIR, detailing attack vectors like misconfigured APIs, insecure interfaces, and shared technology vulnerabilities. Unlike internal or vendor sources, these reports provide empirical, up-to-date data on threats actively targeting cloud services, enabling a risk assessment grounded in actual incident patterns rather than assumptions or marketing claims.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employee suggestions
Why it's wrong here
Employee suggestions lack systematic threat identification.
- ✗
Internal audit findings
Why it's wrong here
Internal audits may not cover cloud-specific threats.
- ✗
Vendor marketing materials
Why it's wrong here
Marketing materials are not objective threat sources.
- ✓
Industry threat reports
Why this is correct
Industry reports provide relevant and current threat data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.