CCNA Crisc Risk Identification Questions

Recording the risk event, its impact and the response taken captures what occurred, the consequence and the mitigation, enabling accurate risk register updates and future comparison. This satisfies the stem's need for the most important entry content after a third-party incident.

Regulatory fines for breaching data protection laws arise from failing to meet legal and regulatory obligations, which is precisely the scope of compliance risk. Other categories such as operational or strategic risk do not centre on statutory penalties for non-compliance.

Scenario analysis workshops bring together diverse perspectives to construct plausible future events that may not appear in incident history. For an e-commerce company, this could surface risks such as payment provider outages, new privacy regulations, or generative AI abuse in customer service. The technique is forward-looking and structured, making it effective for emerging risk identification. Outputs can be added to the risk register with likelihood and impact estimates for treatment decisions.

Organized criminal activity that monetizes stolen card data is a direct external driver of the probability that the retail chain will be attacked. It reflects adversary capability and intent in the specific ecosystem where card data has resale value, so it belongs in the likelihood assessment for payment card compromise. Excluding it would leave the analysis anchored only in internal conditions and blind to the demand side of the threat.

The IT risk universe is the structured catalogue of every plausible IT risk that could affect the organisation, forming the scope from which individual risks are later identified, assessed and prioritised. It ensures risk identification is comprehensive rather than ad hoc.

Server failure causing production line downtime is an operational IT risk because it concerns the day-to-day reliability and availability of systems supporting business processes. This satisfies the stem's operational category, which covers disruptions to service delivery and processing, rather than strategic, compliance or external risk domains.

Shared credentials without multi-factor authentication create a low-effort, persistent entry point that attackers commonly exploit in supply chain ransomware incidents. Because this path bypasses the firm's endpoint and segmentation controls, it materially raises the probability that an attacker can establish a foothold and escalate. The finding is a direct likelihood driver, so the estimate should rise to reflect the expanded attack surface.

The threat actor is the party who could exploit a vulnerability or trigger the event. Naming a specific actor — insider, criminal group, nation-state — grounds the scenario in a realistic capability and intent, which is essential for estimating likelihood within the ISACA risk scenario template.

Organized criminal groups are external threats motivated by financial gain. They often target e-commerce platforms to steal credit card data. This is a classic external threat that must be included in risk identification for a payment-processing platform. Their high capability and resources make them a significant risk factor.

Unchanged default administrative passwords on network devices constitute a configuration vulnerability because the weakness arises from how the device was set up, not from a software defect. This satisfies the stem's requirement by exposing an exploitable misconfiguration that vulnerability assessment should identify, since attackers routinely scan for vendor-default credentials.

Misconfiguration exposing customer PII breaches data-protection obligations, so it sits squarely in the low-tolerance compliance category rather than the moderate operational risk the company accepts. That mismatch with the stated risk appetite triggers immediate escalation to senior management, since regulatory penalties and notification duties cannot be absorbed within the accepted operational threshold.

A GDPR fine arises from failing to meet legal and regulatory obligations, so it belongs in the compliance risk category. Compliance risk covers breaches of laws, regulations and standards, distinct from operational, strategic or technology risk categories.

Hardware component failure that disrupts transaction processing is an IT operational risk because it arises from the day-to-day running of technology infrastructure rather than from a strategic, compliance, or external event. Classifying it here lets the bank aggregate similar availability risks, apply preventive maintenance controls, and measure the residual exposure after those controls, which is exactly what the risk register entry requires.

Likelihood is a function of threat capability, motivation, and the effectiveness of controls. For a mobile payment app, controls like encryption and authentication reduce exploitability. Assessing both the threat's ability to bypass controls and control strength provides a realistic likelihood estimate, making this the most critical factor in this scenario.

GDPR and SOX obligations are statutory and regulatory requirements, and the axis distinguishing compliance risk is exposure to legal or regulatory sanction. Grouping these register entries here reflects their shared driver: failure to meet mandated external obligations.

ISACs collect and distribute threat intelligence specific to a sector, letting members benefit from incidents and indicators observed by peers. This sector-specific sharing satisfies the primary benefit constraint, delivering contextual, relevant intelligence beyond generic feeds.

A threat is any potential cause of harm; here, the DDoS attack is the threat. A vulnerability is a weakness that can be exploited; the lack of redundancy in a single data center is the vulnerability. Risk is the combination of the probability of an event and its impact; the potential service outage is the risk. This mapping is correct and aligns with ISACA definitions.

Unsegmented networks allow ransomware to spread laterally from IoMT devices to critical systems. Legacy devices that cannot be patched are vulnerable, and without segmentation, they become entry points for attackers. This significantly increases the likelihood and impact of a ransomware attack, making it the most significant risk factor in this scenario.

A complete risk scenario pairs a threat event with the asset or process it affects and the resulting business impact. The statement describes only the threat and vulnerability; without naming the affected asset, such as the customer deposit process or the image processing service, and the impact, such as fraudulent deposits or regulatory exposure, the scenario cannot be evaluated or prioritized.

A threat attractiveness rating expresses how desirable the organization is as a target by combining factors such as industry sector, the value of the intellectual property it holds, and its geopolitical profile. This directly captures the adversary's motivation to select this manufacturer over other targets, which is the appropriate likelihood input for a deliberate, actor-driven threat, and it remains stable enough to track as the risk landscape evolves.

The board's statement explicitly declares zero tolerance for compliance violations, making this the binding constraint. Unlike operational risk, where moderate exposure is accepted, any compliance breach exceeds the stated appetite, so compliance risks demand the highest prioritisation during identification.

Reviewing a recurring dashboard against predefined thresholds is a continuous monitoring activity that detects control degradation or anomalous conditions as they emerge. Because it operates on a defined cadence with escalation criteria, it provides timely evidence that authentication controls continue to function and allows corrective action before losses accumulate. This is characteristic of monitoring rather than a point-in-time audit or assessment performed once and then shelved.

Tampering covers unauthorised modification of data or systems, including data altered in transit between web server and database. The threat's defining characteristic is integrity violation through modification, not interception or disclosure, which would fall under Information Disclosure.

This is a vulnerability because it creates an uncontrolled data repository outside the organization's visibility and protection, directly increasing the likelihood that sensitive information is exposed or lost. It reflects a weakness in data handling practices and control coverage rather than an external threat or a business impact. Documenting it as a vulnerability supports targeted controls such as data loss prevention and acceptable use enforcement.

Hacktivists pursue ideological or political ends, attacking targets to publicise a cause. Organised crime actors pursue financial gain, typically through ransomware, fraud or data theft. The axis of difference is motivation, which shapes target selection, persistence and monetisation, making this the best description.

The ISACA risk scenario structure combines a threat source, an event, an asset or resource affected, and the resulting consequence. The current entries capture only consequence, so adding the threat source, the event itself, and the affected asset completes the scenario. This makes the register entry testable and lets the practitioner assess likelihood and impact consistently across entries.

DAST tests a running application from the outside, sending crafted inputs and observing responses, so it detects SQL injection through runtime behaviour. It satisfies the scenario by identifying the exploitable injection flaw in the deployed web application, matching the OWASP Top 10 entry.

Expressing impact as financial loss, regulatory penalty and operational disruption links the technical scenario to business consequences using the standard impact categories, satisfying the stem's requirement to connect technical risk to business impact. This translation lets leadership compare and prioritise risks using consistent, decision-ready terms.

Inherent risk is the raw risk exposure before controls are considered. For the SQL injection vulnerability, this means the potential impact and likelihood assuming no compensating controls exist. This baseline helps the risk practitioner prioritize and later measure the effectiveness of controls. The scenario specifically asks for inherent risk, making this the correct characterization.

Data residency obligations cross legal, technology, and strategic boundaries, so the risk belongs in the enterprise register with clear linkage to the expansion objective and shared ownership. This framing lets leadership compare the cost of compliant local hosting and controls against the value of the new market, and ensures treatment decisions are made at the right level. It also supports consistent reporting to the board alongside other expansion risks.

Tampering with API parameters to circumvent transaction limits is an intentional compromise of confidentiality, integrity, or authorized use, which is the definition of security risk. Recording it as a security risk links it to threat modeling, secure code review, and authorization testing, and it aligns with how CRISC expects practitioners to separate deliberate adversarial events from accidental operational failures or compliance gaps.

Consequence describes the resulting impact of a risk event materialising, quantified in financial, operational or regulatory terms. It satisfies the scenario component that directly links the event to potential financial loss, unlike cause, threat source or event description.

Threat analysis is the PASTA stage that enumerates threat agents, their capabilities, motivations and objectives, mapping them against the application's assets and attack surface. This directly satisfies the stem's requirement to identify threat agents and capabilities, distinguishing it from decomposition, attack modelling and risk/impact analysis stages.

Capacity reflects the outer boundary of risk the organization can absorb before objectives or solvency are threatened, while appetite is the deliberate, lower level of risk it chooses to take. Setting appetite inside capacity leaves a buffer for unexpected events and keeps strategic risk-taking sustainable. This relationship is the foundation for deriving risk tolerances and limits that the committee can monitor.

When decommissioning a data center, ensuring that all sensitive data is securely wiped or destroyed from storage media is critical. If not properly handled, residual data could be recovered by unauthorized parties, leading to a data breach. This is a well-known risk in decommissioning projects and must be included in the risk register. It addresses confidentiality and compliance requirements.

The Delphi technique gathers anonymous, iterative expert judgments and converges them toward a calibrated consensus, which fits sparse-data situations perfectly. By combining engineers, security, and the broker, the practitioner draws on operational, technical, and actuarial perspectives. Structured elicitation reduces anchoring and groupthink, producing a reasoned likelihood estimate where historical incident data alone cannot support one.

The CISA Known Exploited Vulnerabilities catalogue is maintained by the US Cybersecurity and Infrastructure Security Agency and lists vulnerabilities with confirmed in-the-wild exploitation, satisfying the stem's government-maintained, known-exploited requirement. Other sources, such as vendor advisories or commercial feeds, lack that specific provenance.

Nation-state advanced persistent threats combine government funding, elite technical capability and geopolitical objectives, enabling prolonged intrusion campaigns that outmatch criminal or insider actors. This matches the stem's significant resources, advanced skills and state-sponsored objectives precisely.

The provider's incident history is an external factor outside the insurer's direct control that directly affects breach likelihood for the portal. Documenting it supports third-party risk assessment and helps the practitioner set monitoring and contractual expectations. It belongs in the external factor category because it describes the vendor's environment rather than an internal control or process.

The National Vulnerability Database provides a systematic, authoritative feed of known vulnerabilities, each mapped to CVE identifiers and enriched with CVSS severity scores. This structured, continuously updated catalogue satisfies the stem's requirement for a primary, repeatable source, unlike vendor advisories or ad hoc threat feeds.

The CISA Known Exploited Vulnerabilities catalog lists vulnerabilities confirmed as exploited in the wild, including those absent from commercial feeds and ISAC sharing. Incorporating it closes the gap that let the exploited vulnerability go unidentified, directly addressing the missed in-the-wild exploitation described in the stem.

CVE is a publicly maintained catalog of known vulnerabilities in commercial and open-source software, each with a unique identifier. Because the telehealth platform relies on commercial components, searching CVE entries for those products surfaces specific, documented weaknesses that can feed the risk register. It directly addresses vulnerability identification for known software, which is exactly the task described.

A vulnerability assessment scans the EHR system for known technical weaknesses (e.g., missing patches, misconfigurations), while threat modeling systematically identifies how threats could exploit those weaknesses to cause unauthorized disclosure. Together they provide a structured, evidence-based inventory of threats and vulnerabilities. This is the primary approach for identifying relevant risks in a new system handling sensitive data.

Observed attacks against comparable organizations in the same seasonal window indicate an active, capable threat community targeting this sector. That external threat activity directly raises the probability that the retailer's checkout service will be attacked during the upcoming peak. Threat intelligence and peer incident data are core inputs to likelihood estimation in a risk assessment.

CVE assigns each publicly disclosed vulnerability a unique identifier (CVE-YYYY-NNNN). NVD enriches those CVE records with analysis, including CVSS severity scores, CWE classification and affected product data, so the two are complementary rather than duplicates.

Likelihood expresses how probable the ransomware event is over a defined period, and impact expresses the resulting loss in financial or operational terms. Together they form the two core dimensions used to score a risk register entry. For the EHR scenario, likelihood might be annualized probability and impact could be quantified as recovery cost plus downtime revenue loss.

A complete ISACA risk scenario names the actor, threat type, event and affected asset, timing, detection, and consequence. This option supplies all six elements, describing an external attacker using SQL injection to exfiltrate customer records, with detection delay and resulting regulatory and reputational impact.

Consequence quantifies what happens to the organisation if the risk eventuates — financial loss, regulatory penalty or service disruption. It is the causal link translating a risk scenario into measurable business impact, giving the board a basis for comparing scenarios against risk appetite.

Scenario analysis systematically combines plausible threat sources with the assets and business processes they could affect, producing a structured set of risk statements that spans internal weaknesses and external actors. This disciplined pairing keeps the list focused on credible combinations rather than an exhaustive inventory, and it aligns directly with the risk scenario structure used in ISACA guidance, making the outputs suitable for subsequent assessment and treatment.

Data residency and privacy laws are external, environmental factors outside the firm's control that can create compliance and operational risk. They influence where data may be stored and processed, affecting architecture and vendor choices. Capturing them during identification ensures the expansion plan accounts for legal constraints before systems are deployed, rather than discovering violations after the fact.

Threat intelligence feeds provide current, relevant information about threat actors, tactics, techniques, and procedures (TTPs) targeting mobile payment systems. This is the most appropriate source because it is specific to the technology and industry, enabling the practitioner to identify threats such as credential stuffing, mobile malware, and API abuse. It directly supports the identification of threats for this application.

Elevated access privileges directly increase the opportunity for a developer to exfiltrate source code. Even if motivation exists, without access the threat cannot be realized. In insider threat analysis, opportunity is a key likelihood factor, and privileged access is a common enabler. This makes it the most direct factor increasing likelihood in this scenario.

A comprehensive IT risk universe ensures no material risk is omitted from scoping, so every potential IT risk is identified and documented before assessment. This completeness underpins later risk evaluation, appetite setting and treatment, preventing blind spots that would otherwise distort the organisation's overall IT risk profile.

The Delphi method involves iterative rounds where experts receive anonymized feedback, such as the median and interquartile range, and then revise their estimates. This controlled feedback helps converge toward consensus without direct confrontation. In this scenario, the divergent first-round estimates should be summarized and returned to the experts for a second round. This is the standard next step in the Delphi process.

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. The single loss expectancy is $4,000,000 times 30%, or $1,200,000 per disruptive incident. Multiplying by two incidents per year yields $2,400,000. This figure gives leadership a defensible annual expected loss that can be compared directly against the annual cost of proposed controls when prioritizing risk treatment decisions.

An inadequate access control review process is an operational vulnerability: a weakness in the ongoing procedures that govern how access rights are checked and recertified. It satisfies the stem's requirement for operational identification, since it arises from day-to-day process execution rather than project or architectural design.

Threat modeling examines a system's architecture and data flows to identify where threats could exploit weaknesses. By tracing data between the mobile client, API gateway, and backend database, the practitioner is building the data-flow view that threat modeling uses to find exposure points such as unvalidated input or weak authentication between tiers. This makes it the technique being applied.

Advanced metering infrastructure depends on internal billing and outage processes, communications vendors, field operations, and regulatory reporting, so identifying risks across these interactions exposes exposures that a technology-only view misses. This scope supports end-to-end risk scenarios, lets the practitioner trace cascading effects from a meter compromise through to customer billing, and aligns the identification exercise with how the utility actually delivers service.

A risk appetite statement quantifies how much risk the organization is willing to accept for a specific risk category or system. By stating maximum tolerable downtime and data loss, the hospital creates a measurable threshold that guides decisions on controls, insurance, and response planning. This directly supports IT risk identification by defining the boundary between acceptable and unacceptable risk.

Third-party risk is a primary IT risk category because vendors and partners introduce exposure through shared data, integrated systems and outsourced processes. Including it in the risk universe ensures supplier dependencies are assessed alongside internal threats.

VAST's defining advantage is that it was designed specifically for Agile and DevOps delivery, scaling threat modelling across many fast-moving teams and integrating into sprint workflows. This directly satisfies the stem's constraint of aligning threats with agile development during a DevSecOps pipeline session.

Risk identification begins with understanding the context: what assets exist, how data moves, who touches it, and what legal or contractual requirements apply. For a telehealth platform handling protected health information, this establishes the scope against which threats, vulnerabilities, and impacts can be assessed. Without this foundation, subsequent activities such as vendor review, testing, or control selection lack a reliable basis and may miss critical exposures.

A flat network that permits engineering workstations to directly reach production PLCs is an architectural weakness. It increases the likelihood that a compromised workstation can pivot to control systems. This is a vulnerability because it is a condition of the environment that can be remediated through segmentation, firewalls, and access controls. It is a classic ICS risk finding, and its identification supports design changes that reduce the blast radius of an incident.

Historical internal loss-event data reflects how often comparable attacks actually succeeded against this bank's environment, including its existing controls and threat exposure. This makes it the most defensible quantitative input for frequency estimation in the risk scenario, since it is grounded in observed events rather than theoretical severity or generic external statistics.

Government advisories such as the CISA KEV catalog are authoritative, vetted sources listing vulnerabilities known to be actively exploited. They provide reliable, actionable intelligence for risk identification, satisfying the requirement for legitimate threat intelligence sources rather than unverified or vendor-marketing material.

A well-formed risk statement pairs a cause (unpatched server) with an event (ransomware-driven EHR outage) and a business consequence (delayed care, reporting failure). This structure lets the practitioner assess likelihood and impact, assign inherent and residual ratings, and choose treatment. It also aligns the register entry with ISACA guidance that risks be expressed in business-relevant terms so leadership can compare and fund responses.

The core components of a risk scenario are the asset at risk, the threat that could affect it, the vulnerability that could be exploited, and the potential impact. These elements enable the practitioner to assess likelihood and impact, and to determine appropriate risk treatment. Without them, the scenario is incomplete and cannot be effectively analyzed or managed.

The risk register is the central repository capturing each identified risk, its owner, likelihood, impact and agreed treatment, enabling ongoing tracking and review. This satisfies the stem's requirement to update the register with identified risks and their treatment.

The risk manager assumed low impact based on failover, but that assumption must be validated. Failover may not work under a DDoS attack if the backup data center is also targeted or if failover triggers are not met. Validating the control ensures the impact assessment is accurate and the risk is properly understood.

CIS Benchmarks provide prescriptive, platform-specific secure configuration baselines for operating systems, mapping directly to configuration weaknesses. They satisfy the stem's configuration focus by detailing exact settings, registry values and service states to compare against, unlike vulnerability scanners that detect missing patches or generic threat feeds lacking hardening guidance.

The NVD enriches CVE identifiers with severity scoring, affected product mappings, and references, making it a structured and timely source for prioritizing newly disclosed weaknesses. It allows the practitioner to filter and rank vulnerabilities relevant to the cloud products in scope. Because it is maintained as a public reference with consistent data fields, it directly supports emerging-risk identification and comparison across many software components.

Hacktivists are driven by political, ideological or social agendas, and they frequently deface or disrupt government, military and activist-related systems to publicise their cause. Unlike financially motivated cybercriminals or state-sponsored actors, their primary motivation is ideological, matching the stem's political-ideology and government-target criteria.

A former employee who still holds valid access is an internal threat source because the actor has or had trusted access to bank systems. Insider threats include malicious, negligent, and compromised insiders, and the terminated employee with a live credential fits the malicious or negligent insider category. This directly affects the likelihood assessment for unauthorized access scenarios.

Malicious insiders act with deliberate intent to steal data, sabotage systems or abuse privileged access for gain. This satisfies the stem's requirement for an insider threat type, contrasting premeditated action with accidental or coerced behaviour.

Risk identification requires evaluating threat sources in terms of capability, intent, and opportunity relative to the organization's own assets. The CERT report establishes general activity, but relevance to the bank depends on whether the group can realistically reach and exploit the mobile payment APIs. This asset-centric assessment determines if the threat is material and warrants entry into the risk register.