The answer is to document the vulnerability and assess the associated risk in the risk register. This is correct because the CRISC framework mandates that risk identification must be followed immediately by risk assessment; without formally documenting and evaluating the vulnerability’s likelihood and impact, you cannot make an informed, risk-based decision on remediation. On the Certified in Risk and Information Systems Control exam, this tests your understanding that technical controls like patching are secondary to the risk management process—a common trap is jumping to “implement compensating controls” before the risk is formally assessed. The first step after risk identification is always to capture the finding in the risk register and perform a qualitative or quantitative analysis to determine whether the residual risk is acceptable. Memory tip: “Register before Remediate”—always log and assess the risk before choosing a response.
CRISC IT Risk Identification Practice Question
This CRISC practice question tests your understanding of it risk identification. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the vulnerability and assess the associated risk in the risk register
The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Document the vulnerability and assess the associated risk in the risk register
Why this is correct
Proper risk identification and documentation precede treatment decisions.
Clue confirmation
The clue words "first", "immediately / without restart" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Apply a virtual patch via an intrusion prevention system
Why it's wrong here
This is a temporary technical control but should follow risk documentation.
✗
Isolate the application from the network
Why it's wrong here
Isolation is a compensating control that should be based on documented risk decisions.
✗
Notify the application owner and request an emergency patch
Why it's wrong here
Patch may not be available; risk documentation is needed first.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often jump to a technical control (like applying a virtual patch or isolating the application) because it seems immediate and effective, but the CRISC exam consistently tests that risk assessment and documentation must come first before any control implementation.
Detailed technical explanation
How to think about this question
Under the hood, vulnerability scanning tools like Nessus or Qualys report CVSS scores and exploitability metrics, but these raw scores do not account for business context, compensating controls, or threat likelihood in the specific environment. The risk register serves as the authoritative record for risk treatment decisions, capturing asset criticality, threat vectors, and control effectiveness per ISO 31000 and NIST SP 800-30. In a real-world scenario, a legacy application with a critical vulnerability might be running on an isolated VLAN with strict firewall rules, which could reduce the inherent risk to an acceptable level without patching.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
IT Risk Identification — This question tests IT Risk Identification — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Document the vulnerability and assess the associated risk in the risk register — The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first", "immediately / without restart". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a risk identification workshop, the team identifies a potential data leakage from a legacy system. What is the FIRST step the risk owner should take?
hard
A.Implement encryption immediately
✓ B.Document the risk and its source
C.Assign a risk score
D.Report to senior management
Why B: The first step for the risk owner is to formally document the risk and its source. This ensures that the identified data leakage from the legacy system is captured in the risk register, establishing a baseline for analysis and treatment. Without documentation, subsequent steps like risk scoring, control implementation, or escalation cannot be properly justified or tracked.
Variation 2. During a review of third-party vendor risks, the risk team identifies that a cloud service provider's data center is located in a country with unstable political conditions. What should the risk practitioner do FIRST?
medium
✓ A.Document the risk and assess its potential impact.
B.Accept the risk based on the vendor's SLA.
C.Request the vendor to move data to another region.
D.Terminate the contract immediately.
Why A: The risk practitioner's first step should be to document the identified risk and assess its potential impact on the organization. This aligns with the CRISC framework's emphasis on risk identification and assessment before any treatment decisions are made. Without a thorough impact assessment, the organization cannot determine whether the risk is acceptable, requires mitigation, or warrants contract termination.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.