IT Risk Identification Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 IT Risk Identification flashcards as text
Which CRISC domain is primarily responsible for identifying IT risk scenarios that could affect business objectives?
Answer: IT Risk Identification
The IT Risk Identification domain focuses on recognizing IT risk scenarios linked to business objectives and stakeholder requirements.
What is a risk scenario in the context of CRISC?
Answer: A documented description of a threat that could negatively impact business objectives
A risk scenario describes a threat event, its cause, and its potential impact on IT and business objectives.
Which of the following best describes a threat actor in IT risk identification?
Answer: Any entity that could exploit a vulnerability to cause harm
A threat actor is any person, group, or system that could exploit vulnerabilities to negatively affect the organization.
During IT risk identification, which asset classification approach is most useful?
Answer: Categorizing assets by their criticality and sensitivity to business operations
Classifying assets by criticality and sensitivity helps prioritize which assets require the most rigorous risk identification.
What is the primary purpose of maintaining a risk register?
Answer: To document identified risks, their attributes, and status for tracking and communication
A risk register is the central repository for recording all identified risks along with their likelihood, impact, owner, and response status.
Which technique involves reviewing process flows to identify where IT risks could emerge?
Answer: Business process analysis
Business process analysis examines workflows step-by-step to pinpoint where threats or vulnerabilities could affect IT and business outcomes.