mediumMultiple SelectObjective-mapped
CRISC Practice Question: Which TWO of the following are key risk…
Which TWO of the following are key risk identification techniques used to identify threats and vulnerabilities in IT systems? (Select exactly 2.)
⚠ Common exam trap
It's easy for candidates to confuse risk identification techniques (like scanning and modeling) with risk response strategies (like mitigation, transfer, or control implementation), leading candidates to select options that are actually post-identification actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability scanning
Vulnerability scanning is a key risk identification technique that systematically probes IT systems for known vulnerabilities, such as unpatched software or misconfigurations, using tools like Nessus or OpenVAS. It directly identifies weaknesses that could be exploited by threats, making it essential for the risk identification phase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk mitigation
Why it's wrong here
Risk mitigation is a treatment, not identification.
- ✓
Vulnerability scanning
Why this is correct
Vulnerability scanning identifies known vulnerabilities.
- ✗
Risk transfer
Why it's wrong here
Risk transfer is a response strategy, not identification.
- ✓
Threat modeling
Why this is correct
Threat modeling identifies potential threats to a system.
- ✗
Access control implementation
Why it's wrong here
Access control is a control, not an identification technique.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.