mediumMultiple SelectObjective-mapped
CRISC Practice Question: An IT risk manager is performing a risk…
An IT risk manager is performing a risk assessment for a new cloud service. Which TWO of the following are key inputs to the risk identification process? (Select TWO.)
⚠ Common exam trap
Watch out — candidates often confuse risk identification inputs with outputs from later phases, such as control testing results (C) or residual risk levels (D), because they are familiar terms in the overall risk management process but are not used at the start of identification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat intelligence feeds
Threat intelligence feeds (B) provide current information about emerging threats, attack vectors, and adversary tactics, which are essential for identifying relevant risks to the cloud service. An asset inventory (E) is a foundational input because it lists all assets (e.g., data, VMs, APIs) that could be affected, enabling the risk manager to map threats to specific resources. Both are direct inputs to the risk identification phase, as defined by the CRISC framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk appetite statement
Why it's wrong here
Risk appetite is used during risk evaluation, not identification.
- ✓
Threat intelligence feeds
Why this is correct
Threat intelligence helps identify potential threats.
- ✗
Control testing results
Why it's wrong here
Control testing results are used to assess control effectiveness, not initial identification.
- ✗
Residual risk levels
Why it's wrong here
Residual risk is an output, not an input to identification.
- ✓
Asset inventory
Why this is correct
Asset inventory helps identify what needs to be protected.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.