easyMultiple Choice
CRISC Practice Question: An IT manager is identifying risks for a new…
An IT manager is identifying risks for a new cloud application. Which of the following is the BEST source for identifying specific threats relevant to cloud services?
⚠ Common exam trap
Test-takers frequently choose internal audit findings (Option B) thinking they are authoritative, but they fail to recognize that internal audits are retrospective and limited to existing controls, whereas industry threat reports provide forward-looking, external threat intelligence essential for identifying emerging cloud-specific risks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Industry threat reports
Industry threat reports (Option D) are the BEST source because they aggregate real-world threat intelligence specific to cloud environments, such as data from the Cloud Security Alliance (CSA) or Verizon DBIR, detailing attack vectors like misconfigured APIs, insecure interfaces, and shared technology vulnerabilities. Unlike internal or vendor sources, these reports provide empirical, up-to-date data on threats actively targeting cloud services, enabling a risk assessment grounded in actual incident patterns rather than assumptions or marketing claims.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employee suggestions
Why it's wrong here
Employee suggestions are anecdotal and unevenly informed, so they cannot reliably enumerate the specific cloud threat landscape the risk register requires. It is tempting because staff know internal pain points, and it would be correct for surfacing operational issues during a lessons-learned review, not for threat identification.
- ✗
Internal audit findings
Why it's wrong here
Internal audit findings report control weaknesses already identified inside the organisation, not the external threat landscape specific to cloud services. They are tempting because they surface real, evidenced risk, and would be the right source when assessing whether existing controls mitigate known gaps.
- ✗
Vendor marketing materials
Why it's wrong here
Vendor marketing material promotes service benefits and rarely documents concrete threat vectors, so it cannot supply the specific cloud threat detail risk identification demands. It is tempting because vendors publish security whitepapers, and it would be correct for understanding offered controls, not for enumerating threats.
- ✓
Industry threat reports
Why this is correct
Industry threat reports aggregate observed attacker tactics, vulnerabilities, and campaigns specific to cloud providers and services, giving the IT manager concrete, current threat intelligence rather than generic internal logs or hypothetical scenarios. This directly satisfies the need to identify specific cloud-relevant threats for the new application.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.