mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Is using the OCTAVE method for risk identification
An organization is using the OCTAVE method for risk identification. Which activity is typically performed FIRST?
⚠ Common exam trap
ISACA often tests the misconception that asset identification is always the first step in any risk assessment methodology, but OCTAVE specifically requires establishing risk measurement criteria first to provide a consistent evaluation framework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish risk measurement criteria
In the OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) method, the first phase is 'Build Asset-Based Threat Profiles,' which begins with establishing risk measurement criteria (e.g., impact scales, likelihood definitions) to guide subsequent asset prioritization and threat identification. This ensures that all later activities are aligned with the organization's risk appetite and tolerance levels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identify threats
Why it's wrong here
Threat identification follows criteria establishment.
- ✗
Identify critical assets
Why it's wrong here
Asset identification is part of building the profile.
- ✗
Identify vulnerabilities
Why it's wrong here
Vulnerability identification occurs after establishing criteria.
- ✓
Establish risk measurement criteria
Why this is correct
OCTAVE starts with establishing criteria to frame the assessment.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.