IT Risk Identification practice questions

A risk practitioner is creating a risk scenario for a ransomware attack. Which of the following is the BEST sequence to describe the scenario using the ISACA risk scenarios template?

Question 2easymultiple choice

An organization is developing its IT risk universe. Which of the following is the BEST source of information for identifying potential IT risks?

Trap 1: Industry benchmarking reports

Benchmarking provides comparative data but not comprehensive risk identification.

Trap 2: Results from the latest internal audit

Internal audits are periodic and may not cover all risks.

Trap 3: Historical loss data from the finance department

Historical data is useful but may not capture emerging risks.

A
Threat intelligence feeds from ISACs
ISACs provide timely, relevant threat intelligence for the organization's sector.
B
Industry benchmarking reports
Why wrong: Benchmarking provides comparative data but not comprehensive risk identification.
C
Results from the latest internal audit
Why wrong: Internal audits are periodic and may not cover all risks.
D
Historical loss data from the finance department
Why wrong: Historical data is useful but may not capture emerging risks.

Question 3mediummultiple choice

A company is adopting a DevSecOps approach and wants to conduct threat modeling early in the development lifecycle. Which threat modeling methodology is BEST suited for this environment due to its focus on agile and continuous integration?

Trap 1: TRIKE

TRIKE is requirements-based and more formal, less agile.

Trap 2: STRIDE

STRIDE is application-focused but not specifically designed for agile/DevSecOps.

Trap 3: PASTA

PASTA is process-driven and can be adapted but is not optimized for DevSecOps.

A
TRIKE
Why wrong: TRIKE is requirements-based and more formal, less agile.
B
VAST
VAST is Visual, Agile, and Simple, tailored for DevSecOps.
C
STRIDE
Why wrong: STRIDE is application-focused but not specifically designed for agile/DevSecOps.
D
PASTA
Why wrong: PASTA is process-driven and can be adapted but is not optimized for DevSecOps.

Question 4hardmultiple choice

During a risk identification workshop, a risk owner proposes a scenario: 'A disgruntled employee with privileged access exfiltrates customer data to a competitor.' In the context of the ISACA risk scenario template, which element is missing if the scenario only includes the actor, threat type, event, and asset?

Trap 1: Business impact

Business impact is a consequence, not a template element.

Trap 2: Consequence

Consequence is implied but not part of the template elements listed.

Trap 3: Vulnerability

Vulnerability is part of the scenario but not explicitly in the template elements.

A
Timing and detection
Timing and detection are required by the ISACA template.
B
Business impact
Why wrong: Business impact is a consequence, not a template element.
C
Consequence
Why wrong: Consequence is implied but not part of the template elements listed.
D
Vulnerability
Why wrong: Vulnerability is part of the scenario but not explicitly in the template elements.

Question 5easymultiple choice

An organization is categorizing IT risks. Which of the following risk categories would include the risk of regulatory fines due to non-compliance with data protection laws?

Trap 1: Operational risk

Operational risk includes failures in processes or systems, but regulatory fines are specifically compliance.

Trap 2: Financial risk

Financial risk involves financial losses from market changes or credit, not regulatory penalties.

Trap 3: Strategic risk

Strategic risk relates to high-level goals and business strategy.

A
Operational risk
Why wrong: Operational risk includes failures in processes or systems, but regulatory fines are specifically compliance.
B
Compliance risk
Compliance risk directly addresses regulatory and legal violations.
C
Financial risk
Why wrong: Financial risk involves financial losses from market changes or credit, not regulatory penalties.
D
Strategic risk
Why wrong: Strategic risk relates to high-level goals and business strategy.

Question 6mediummultiple choice

A risk analyst is building a risk register. After identifying a list of risks, what is the NEXT step in the risk identification process according to ISACA best practices?

Trap 1: Assign risk owners

Owners may be assigned during or after categorization, but categorization typically precedes.

Trap 2: Determine risk response

Response determination occurs after risk assessment.

Trap 3: Assess the inherent risk level

Assessment comes after categorization.

A
Assign risk owners
Why wrong: Owners may be assigned during or after categorization, but categorization typically precedes.
B
Categorize the risks
Categorization is the next logical step to organize risks.
C
Determine risk response
Why wrong: Response determination occurs after risk assessment.
D
Assess the inherent risk level
Why wrong: Assessment comes after categorization.

Question 7hardmultiple choice

A multinational corporation uses commercial threat intelligence feeds and participates in an ISAC. However, they recently missed a critical vulnerability exploited in the wild that was not in their feeds. Which additional source should they incorporate to improve vulnerability identification?

Trap 1: NVD database

NVD provides CVEs but does not prioritize exploited vulnerabilities.

Trap 2: OSINT from social media

OSINT is valuable but may be noisy and not authoritative.

Trap 3: Vendor advisories only

Vendor advisories are useful but may not highlight exploitation in the wild.

A
CISA KEV catalog
CISA KEV is a focused, authoritative source for known exploited vulnerabilities.
B
NVD database
Why wrong: NVD provides CVEs but does not prioritize exploited vulnerabilities.
C
OSINT from social media
Why wrong: OSINT is valuable but may be noisy and not authoritative.
D
Vendor advisories only
Why wrong: Vendor advisories are useful but may not highlight exploitation in the wild.

Question 8mediummultiple choice

A company is developing risk scenarios for business impact analysis. Which of the following scenario components directly links the risk event to potential financial loss?

Trap 1: Vulnerability

Vulnerability is the weakness exploited.

Trap 2: Threat actor

Threat actor identifies who causes the event.

Trap 3: Asset

Asset is what is affected.

A
Vulnerability
Why wrong: Vulnerability is the weakness exploited.
B
Threat actor
Why wrong: Threat actor identifies who causes the event.
C
Consequence
Consequence captures the impact, such as financial loss.
D
Asset
Why wrong: Asset is what is affected.

Question 9easymultiple choice

Which of the following is a key characteristic of a well-maintained risk register?

Trap 1: It is maintained solely by the IT department

Risk ownership should be across the organization.

Trap 2: It is static and reviewed annually

Annual updates may miss emerging risks.

Trap 3: It includes only high-impact risks

All identified risks should be included, not just high-impact.

A
It is maintained solely by the IT department
Why wrong: Risk ownership should be across the organization.
B
It is static and reviewed annually
Why wrong: Annual updates may miss emerging risks.
C
It is updated regularly to reflect changes
Regular updates ensure the register remains relevant.
D
It includes only high-impact risks
Why wrong: All identified risks should be included, not just high-impact.

Question 10hardmultiple choice

A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?

Trap 1: OWASP ZAP automated scanner

ZAP is a DAST tool and would produce similar volume.

Trap 2: Manual penetration testing

Manual testing is valuable but may not scale to large codebases.

Trap 3: CVE database search

CVE database provides vulnerability information but not prioritization based on business context.

A
OWASP ZAP automated scanner
Why wrong: ZAP is a DAST tool and would produce similar volume.
B
Manual penetration testing
Why wrong: Manual testing is valuable but may not scale to large codebases.
C
CVE database search
Why wrong: CVE database provides vulnerability information but not prioritization based on business context.
D
IAST (Interactive Application Security Testing)
IAST provides accurate, context-aware results with fewer false positives.

Question 11mediummultiple choice

An organization's board has set a risk appetite statement that says: 'We accept moderate levels of operational risk but will not tolerate any compliance violations.' During risk identification, which type of risk should be given the HIGHEST priority?

Trap 1: Reputational risks

Reputational risk is not explicitly addressed in the appetite statement.

Trap 2: Operational risks

Moderate acceptance means they are lower priority than compliance.

Trap 3: Strategic risks

Strategic risks are not specifically called out in the appetite statement.

A
Reputational risks
Why wrong: Reputational risk is not explicitly addressed in the appetite statement.
B
Compliance risks
Zero tolerance makes compliance risks the highest priority.
C
Operational risks
Why wrong: Moderate acceptance means they are lower priority than compliance.
D
Strategic risks
Why wrong: Strategic risks are not specifically called out in the appetite statement.

Question 12mediummultiple choice

A security team is using the STRIDE threat modeling methodology for a new web application. Which threat type under STRIDE would be MOST relevant to a SQL injection vulnerability?

Trap 1: Repudiation

Repudiation involves denying an action.

Trap 2: Information Disclosure

Information disclosure involves data exposure, but SQL injection can also lead to tampering.

Trap 3: Spoofing

Spoofing involves impersonation, not data modification.

A
Repudiation
Why wrong: Repudiation involves denying an action.
B
Information Disclosure
Why wrong: Information disclosure involves data exposure, but SQL injection can also lead to tampering.
C
Spoofing
Why wrong: Spoofing involves impersonation, not data modification.
D
Tampering
Tampering involves malicious modification of data or code.

Question 13easymultiple choice

An organization is conducting a vulnerability assessment of its IT assets. Which of the following sources is MOST authoritative for identifying known software vulnerabilities?

Trap 1: DISA STIGs

STIGs are security technical implementation guides for configuration.

Trap 2: OWASP Top 10

OWASP Top 10 is a list of common web application vulnerabilities, not a comprehensive database.

Trap 3: CIS Benchmarks

CIS Benchmarks are configuration guidelines, not vulnerability databases.

A
DISA STIGs
Why wrong: STIGs are security technical implementation guides for configuration.
B
OWASP Top 10
Why wrong: OWASP Top 10 is a list of common web application vulnerabilities, not a comprehensive database.
C
NVD (National Vulnerability Database)
NVD is the primary source for CVE data.
D
CIS Benchmarks
Why wrong: CIS Benchmarks are configuration guidelines, not vulnerability databases.

Question 14mediummulti select

A risk manager is developing risk scenarios to present to the board. Which TWO elements are essential for connecting a risk scenario to business impact?

Trap 1: Threat actor motivation

Motivation is part of the threat actor profile but not directly linked to business impact.

Trap 2: Vulnerability score

Vulnerability score indicates severity but not direct business impact.

Trap 3: Detection time

Detection time affects response but is not the impact itself.

A
Threat actor motivation
Why wrong: Motivation is part of the threat actor profile but not directly linked to business impact.
B
Vulnerability score
Why wrong: Vulnerability score indicates severity but not direct business impact.
C
Detection time
Why wrong: Detection time affects response but is not the impact itself.
D
Consequence (e.g., financial loss)
Consequence directly defines the business impact.
E
Business impact statement
Business impact statement explicitly states the effect on the organization.

Question 15hardmulti select

A company is implementing a risk identification process for third-party risks. Which THREE factors should be considered when identifying risks from a critical software vendor?

Trap 1: Number of employees at vendor

Employee count is not directly a risk factor.

Trap 2: Service level agreements (SLAs)

SLAs define performance but are not risk factors themselves.

A
Number of employees at vendor
Why wrong: Employee count is not directly a risk factor.
B
Vendor's compliance with relevant regulations
Non-compliance can result in liability for the organization.
C
Service level agreements (SLAs)
Why wrong: SLAs define performance but are not risk factors themselves.
D
Vendor's history of security incidents
Past incidents indicate potential future risk.
E
Vendor's financial stability
Financial instability can lead to service disruption.

Question 16easymulti select

An IT risk manager is categorizing risks identified during a recent assessment. Which TWO categories would include the risk of a system outage caused by a software bug?

Trap 1: Compliance risk

Compliance risk involves violations of laws/regulations.

Trap 2: Strategic risk

Strategic risk relates to business strategy, not operational failures.

Trap 3: Reputational risk

Reputational risk is possible but not the primary category.

A
Operational risk
System outages are operational failures.
B
Compliance risk
Why wrong: Compliance risk involves violations of laws/regulations.
C
Strategic risk
Why wrong: Strategic risk relates to business strategy, not operational failures.
D
Financial risk
Outages can cause financial loss, making it a financial risk.
E
Reputational risk
Why wrong: Reputational risk is possible but not the primary category.

Question 17mediummultiple choice

An organization is developing an IT risk universe. Which of the following is the PRIMARY purpose of creating a comprehensive IT risk universe?

Question 18easymultiple choice

During a risk assessment, the risk practitioner is identifying threats to an application. Which threat modeling technique is specifically designed to analyze application threats using categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Question 19hardmultiple choice

An organization has a risk appetite statement that says 'We accept up to $5 million in operational losses per year.' However, a new cloud migration project is estimated to have a potential operational loss of $8 million if a critical failure occurs. The risk capacity of the organization is $20 million. What should the risk practitioner recommend?

Question 20easymultiple choice