mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Wants to identify risks related to third-party…
An organization wants to identify risks related to third-party vendors. Which approach best supports continuous risk identification?
⚠ Common exam trap
Many candidates choose periodic assessments (A, B, or D) because they seem thorough, but CRISC emphasizes continuous risk identification over point-in-time reviews, and automated monitoring is the only option that provides real-time, ongoing visibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automated monitoring of vendor security controls via a third-party risk platform
Automated monitoring via a third-party risk platform enables continuous, real-time visibility into vendor security controls, such as firewall rule changes, vulnerability scan results, and compliance posture. This approach aligns with the CRISC principle of ongoing risk identification, as it detects changes in risk exposure between formal assessment cycles without relying on periodic snapshots.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Contractual clauses requiring self-assessment
Why it's wrong here
Self-assessments are subjective and lack independent verification.
- ✗
On-site audits every two years
Why it's wrong here
Audits are infrequent and costly, not suitable for continuous identification.
- ✓
Automated monitoring of vendor security controls via a third-party risk platform
Why this is correct
Automated monitoring provides continuous insight into vendor security posture.
- ✗
Annual vendor risk assessments
Why it's wrong here
Annual assessments are point-in-time and may not detect emerging risks.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.