CRISC IT Risk Identification Practice Question
During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is tailored for use in agile and DevOps environments
VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It requires detailed system architecture upfront
Why it's wrong here
VAST is designed for agile teams and deliberately avoids requiring complete architecture documentation before work begins. It is tempting because formal methodologies such as architectural risk analysis do demand detailed design artefacts, so this would be the correct choice if the question asked about a heavyweight, design-first approach.
- ✗
It replaces the need for vulnerability scanning
Why it's wrong here
VAST is a lightweight threat modelling technique that complements, but never substitutes for, automated vulnerability scanning in a pipeline. It is tempting because both activities identify weaknesses in the same DevSecOps flow, and it would be correct only if the stem asked which practice provides continuous detection of known software flaws.
- ✓
It is tailored for use in agile and DevOps environments
Why this is correct
VAST's defining advantage is that it was designed specifically for Agile and DevOps delivery, scaling threat modelling across many fast-moving teams and integrating into sprint workflows. This directly satisfies the stem's constraint of aligning threats with agile development during a DevSecOps pipeline session.
- ✗
It focuses on compliance requirements only
Why it's wrong here
VAST integrates threat modelling into agile sprints and development workflows; narrowing it to compliance requirements describes a control-mapping exercise, not threat modelling. It is tempting because VAST does support regulatory alignment, and would be correct where the driver is demonstrating audit or standard conformance rather than iterative threat discovery.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.