mediumMultiple Select
Risk Identification Techniques: Brainstorming & Threat Modeling
Which TWO of the following are key risk identification techniques used to identify threats and vulnerabilities in IT systems? (Select exactly 2.)
⚠ Common exam trap
It's easy for candidates to confuse risk identification techniques (like scanning and modeling) with risk response strategies (like mitigation, transfer, or control implementation), leading candidates to select options that are actually post-identification actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability scanning
Vulnerability scanning (B) is a key risk identification technique because it actively probes systems, networks, and applications with tools like Nessus, Qualys, or OpenVAS to enumerate known CVEs, missing patches, and misconfigurations, producing concrete evidence of existing vulnerabilities. Threat modeling (D) is also a key risk identification technique because it systematically analyzes a system's architecture, data flows, and trust boundaries (e.g., via STRIDE or DREAD) to enumerate potential threats and weaknesses before or during design. By contrast, risk mitigation (A) and risk transfer (C) are risk response/treatment strategies (alongside avoidance and acceptance), not identification methods, and access control implementation (E) is a preventive security control rather than a technique for discovering threats and vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk mitigation
Why it's wrong here
Mitigation reduces identified risk through controls; it does not discover threats or vulnerabilities. It is tempting because it dominates risk response planning, and would be correct when selecting how to treat a risk already logged, not when populating the register through techniques such as threat modelling or vulnerability scanning.
- ✓
Vulnerability scanning
Why this is correct
Vulnerability scanning directly satisfies the stem's requirement to identify threats and vulnerabilities in IT systems. It probes hosts and applications against known signature databases, enumerating missing patches, misconfigurations and exposed services. This produces concrete, system-level weakness evidence rather than speculative risk scenarios, making it a core risk identification technique.
- ✗
Risk transfer
Why it's wrong here
Transfer shifts financial consequence to a third party, typically via insurance or contract; it uncovers no threats or vulnerabilities. It is tempting because it appears in the same risk-response taxonomy, and would be correct when deciding how to handle an accepted risk, not when identifying what risks exist.
- ✓
Threat modeling
Why this is correct
Threat modelling systematically examines system design to identify threats and vulnerabilities before exploitation, satisfying the stem's risk identification requirement. It maps attack paths against architecture, complementing scanning by exposing design-level weaknesses rather than only known signatures.
- ✗
Access control implementation
Why it's wrong here
Access control implementation enforces authorisation after risks are known; it identifies nothing. It is tempting because weak access control is itself a vulnerability, and implementing controls would be correct when remediating an access finding, not when performing identification techniques such as interviews or vulnerability assessment.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.