CRISC Domain 1 Practice Exam

These questions are part of the practice quiz. Start practicing

• How should risk identifiers be validated?
• Which threats should be considered when identifying risks to an organization's cloud environment?
• What is a key consideration when identifying risks in a multinational organization?
• What is the primary purpose of compliance management within an organization?
• Which term refers to the collection of activities used to manage the inventory, classification, use, and disposal of assets?
• When identifying risks for data that moves across borders, what steps should you take?
• Which practice most directly supports prioritizing risk responses?
• How do third-party relationships influence risk identification?
• What drives risk tolerance and risk appetite?
• Which term is defined as 'Just, proper, and sufficient care, or the absence of negligence'?
• Who is generally responsible for defining the risk appetite and risk tolerance of an organization?
• Who should monitor regulatory developments during risk identification?
• Which CRISC domain emphasizes documenting IT risk events and owners?
• Which statement best describes risk dependencies documentation?
• What is the purpose of aligning risk prioritization with critical objectives and risk appetite?
• What regulatory and contractual obligations should be considered during risk identification?
• Which of the following is an impact category used in CRISC risk identification?
• How does risk appetite influence actions on identified risks?
• Which role is responsible for the day-to-day risk management functions?
• What is the impact of automation on risk identification?
• What term describes anything of value to the organization, including physical assets, facilities, human assets, and information?
• In the NIST RMF, what is Step 1?
• Which elements are typically considered part of internal governance?
• The second line of defense is comprised of which functions and is intended to provide guidance?
• What is a risk appetite statement and how is it used in Domain 1?
• How can you identify vulnerabilities without technical scanning tools?
• What concept helps ensure consistency when identifying risk across the organization?
• What is the purpose of risk scenarios in risk identification?
• In the NIST Risk Management Framework, which activity corresponds to Step 5?
• How can regulatory risk be identified?
• Who typically constitutes the second line of defense in managing enterprise risk?
• What is residual risk?
• Which statement best describes when risk identification updates should be triggered?
• Which approach uses risk scenarios when estimating the likelihood and impact of significant risk to the enterprise?
• What is meant by 'risk taxonomy' in CRISC Domain 1?
• How is initial prioritization typically determined after risk identification?
• What is the main objective of a security management program?
• Which description reflects the requirements the organization must adhere to for managing both business and IT risk?
• Which term describes the overarching framework for managing risk across an organization?
• Which function oversees the asset lifecycle including inventory, classification, use, and disposal?
• Who typically reviews and approves the risk register?
• In risk scenario development, which element affects the scenario the most?
• What is the difference between risk appetite and risk tolerance?
• What does risk tolerance mean in CRISC context?
• Auditing accountability corresponds to which line of defense?
• Which is a common risk management framework you should be aware of?
• Define risk taxonomy and its role in IT risk identification.
• What is the term for the maximum amount of risk an entity can absorb while pursuing strategy and objectives?
• Which element includes risk appetite, tolerance strategy and various policies for an organization?
• Why is maintaining an up-to-date asset inventory critical in risk management?
• Define risk owner in CRISC governance.
• Which of the following would be considered a vulnerability?
• Which statement best describes a risk scenario?
• Which activity is part of risk identification?
• Who is responsible for the creation of security policies and procedures?
• How should risk categories be prioritized during Domain 1 IT Risk Identification?
• In CRISC, how is a 'risk event' defined?
• What is a common deliverable of risk identification at Domain 1?
• Which item is most often used to track progress within the risk management process during risk treatment?
• Which practice helps ensure timely updating of risk identification outputs?
• What is the primary objective of risk identification in CRISC Domain 1?
• Which term describes the overall level of risk an organization is willing to take to achieve strategic goals?
• In risk scenario modeling, what term refers to an entity capable of triggering or influencing risk events?
• In risk identification, what is the purpose of a 'risk theme'?
• Which describes 'risk owner accountability'?
• Which two dimensions are typically used on a risk map?
• Who owns risk?
• Why is asset identification essential in risk identification?
• Which of the following describes criteria including organizational structure, policies, standards, technology, architecture and controls?
• After applying controls, the risk that remains is called?
• Which statement best describes how a risk heat map communicates risk levels?
• Which document details the organization's overall strategy, methodology, and long-term desires for managing risk?
• Which document maintains history of risk events and assigned owners?
• What is a primary benefit of involving business stakeholders in risk identification?
• Which assessment focuses on identifying threats and vulnerabilities to assets?
• Which data sources help identify IT risks (internally and externally)?
• What is 'business impact analysis' and its relevance to Domain 1?
• What approach helps ensure consistent risk identification across teams?
• Which statement best describes asset criticality assessment?
• What is described as the most effective method to assess business risk?
• Who is ultimately accountable and responsible for how risk is treated?
• Why is asset criticality assessment useful in risk identification?
• Why is it important to involve business stakeholders in risk identification?
• What dictates the behavior of risk management professionals?
• What is the difference between a risk event and a threat scenario?
• Which is a component of risk context in CRISC governance?
• Which term refers to internal governance that reflects the management philosophy, culture, and directives of senior leaders?
• Which statement best describes the impact of risk identification findings on governance?
• What is the role of incident history in risk identification?
• How is auditing connected to accountability within governance and risk management?
• In risk scenario development, which element most strongly influences the scenario's outcome?
• Which role is described as proactively monitoring and managing risk associated with IT support systems, security controls, and overall business processes?
• Which activity most directly integrates governance requirements with risk and control practices?
• How should you document risk dependencies?
• Which artifact encompasses criteria such as organizational structure, policies, standards, technology, architecture and controls used in risk scenario development?
• Where do risk management and compliance management overlap?
• Which output documents the IT risk identified, assigned owners, and initial risk ratings?
• What term describes detailed information on all aspects of an asset and how those aspects contribute to, mitigate, or influence risk?
• Which statement best defines risk exposure?
• What is the main objective of asset management within an organization?
• Which of the following describes a typical risk likelihood scale used in risk identification?
• Which statement best contrasts a threat scenario and a risk event?
• Which approach enhances risk identifier validation beyond internal inputs?
• Which action improves identification of critical data assets?
• Which type of risk do data privacy laws typically introduce?
• What is the difference between a risk event and a risk cause?
• Which role is primarily responsible for the day-to-day operations of risk management activities within a business unit?
• What term defines how an organization feels about and deals with risk and originates from the organization's leadership and governance?
• What term describes a comprehensive view of an asset, process, or organization under review that includes its contribution to, mitigation of, or influence on risk?
• How do data privacy laws influence risk identification?
• In the NIST Risk Management Framework, which activity corresponds to Step 4?
• What is an example of a risk event in data privacy?
• In the NIST Risk Management Framework, which activity corresponds to Step 6?
• Which body is typically responsible for approving risk management policies and risk appetite?
• How does a risk scenario differ from a risk event?
• The best estimate of the likelihood of significant events affecting an enterprise is provided by which analysis?
• What is a risk register health check?
• Which of the following is not typically considered part of internal governance?
• Which of the following is an example of a risk scenario involving data privacy?
• How does risk identification support risk treatment planning?
• Which of the following best describes a risk appetite statement?
• When identifying risks, when should owners be assigned to risk scenarios?
• Which document provides the process steps used by federal information systems for risk management?
• Which description best defines a risk map?
• Which practice involves setting risk appetite and tolerances to guide decision making?
• Why is it important to document risk sources during identification?
• Why is alignment of IT risk with business objectives important?
• How can scenario-based thinking improve risk identification?
• What is the significance of governance, risk, and compliance (GRC) alignment in Domain 1?
• Distinguish between a threat and a vulnerability with examples.
• Categorizing risk in Domain 1 primarily helps to accomplish which outcome?
• How should a CRISC practitioner approach regulatory changes during risk identification?
• What is a risk heat map?
• Which two elements are typically captured together in a risk event in the IT risk register?
• What is a typical benefit of organizing risk information by taxonomy?
• Which of the following best describes the purpose of a risk taxonomy?
• What is the purpose of monitoring regulatory developments during risk identification?
• Why do risk scenarios enable the risk assessment process?
• In the three lines of defense model, which function provides independent assurance that risk management and control processes are effective?
• How should residual risks be treated in risk identification?
• First line of defense is composed of which function?
• Which line of defense provides guidance for risk management and ethics within the organization?
• Which scenario best illustrates a risk that should be captured in risk identification?
• Which of the following is NOT typically used as a risk identification artifact?
• In the NIST Risk Management Framework, which activity corresponds to Step 7?
• Which term represents the governance concept associated with laws and external regulatory bodies?
• What is the best approach to develop risk scenarios?
• What is risk scenario analysis and how is it used?
• What deliverables would you expect from a risk identification workshop?
• What is the role of incident history in risk identification?
• Which item is NOT one of the three lines of defense in managing enterprise?
• What is the primary purpose of the 'Authorize Information Systems' step in the RMF?
• What distinguishes risk identification from risk assessment?
• What is the context of risk in risk identification, and why is it important?
• Which statement about the RMF steps is NOT correct?
• Which term best describes the group that monitors risk across IT and business processes?
• How should data flows help in risk identification?
• Which items would you expect to originate from a formal risk identification workshop to begin prioritization?
• What is the primary objective of IT risk identification?
• What is the recommended format for presenting executive risk information?
• What are common sources of IT risk in Domain 1?
• What is the primary role of Key Performance Indicators in management of business processes?
• In the context of risk management, auditing primarily serves to verify that risk owners have controls in place to manage risk at an acceptable level within their area. Which option best reflects this?
• What is the relationship between risk identification and risk assessment?
• What is the difference between inherent risk and residual risk?
• What is risk context mapping?
• What is a risk register?
• Which item is an example of a threat?
• Which element is NOT typically part of a risk taxonomy?
• What is included in documenting the risk context?
• How can you identify data sensitivity during risk identification?
• What is the primary benefit of risk scenarios in risk assessment?
• Laws and external bodies describe which governance dimension?
• Who is responsible for both the day-to-day and long-term operations and success of the process?
• Which item is NOT part of the three lines of defense in enterprise risk management?
• Which practice helps ensure risk identifiers reflect current regulatory expectations?
• How does change management impact risk identification?
• What role do threat actors play in risk identification?
• What is the purpose of a standardized risk taxonomy in risk identification?
• Which term describes the attention reasonably expected to satisfy a legal requirement or discharge an obligation?
• To identify risk factors, which question helps reveal ownership of business processes?
• What is the difference between 'risk' and 'control' in CRISC?
• Monitor risk and financial reporting issues is the responsibility of which line of defense?
• Which of the following statements is true about risk and controls?
• Which RMF step involves evaluating the effectiveness of security controls after implementation?
• Which item is commonly included in a risk identification deliverable?
• Name four risk categories commonly used in CRISC risk identification.
• Which of the following best describes incident history's role in risk identification?
• What describes the practice of identifying and managing strategic risk in an organization?
• What best describes the relationship between risk identification and risk prioritization?
• What is a risk owner, and why must one be assigned during risk identification?
• Why are stakeholder interviews important in risk identification?
• Name two common tools or artifacts used during risk identification.
• Which statement best explains data flow analysis in risk identification?
• What term describes the amount of risk an organization is willing to accept to achieve its goals, in alignment with strategy?
• How should regulatory changes be treated in risk identification?
• Which factors should be used to select a risk owner for a given risk?
• Which statement best describes risk evaluation after identification?
• How does risk appetite relate to risk identification?
• How can you assess the regulatory risk landscape during risk identification?
• What statement best describes the relationship between data classification and risk identification?
• Which term means Just, proper, and sufficient care, or the absence of negligence?
• In the three lines of defense model, which group is typically the first line of defense in managing enterprise risks?
• What is the primary purpose of a risk map?
• How can process owners contribute to risk identification?
• What is the role of KRIs in risk identification?
• How should risk identification results be communicated to governance bodies?
• What is a primary function of auditing in governance and risk management?
• Which technique helps identify possible IT risks by considering worst-case, best-case, and plausible scenarios?
• What is a practical outcome of using scenario-based thinking in risk identification?
• When identifying risks related to emerging technologies, what should you do?
• Which term describes the degree, amount, or volume of risk that an organization will withstand?
• The third line of defense in managing enterprise risk is typically composed of what?
• In the NIST Risk Management Framework, which activity corresponds to Step 3?
• Auditing processes are connected to accountability to determine if risk owners are meeting governance and risk management requirements. Which outcome best captures this linkage?
• What is the purpose of a control library in IT risk identification?
• What is a capability map in risk identification?
• What is the purpose of mapping project objectives to distinct risk areas such as schedule, budget, security, compliance, operations, and stakeholder impact?
• Which statement best describes how incident history informs ongoing risk identification?
• How do you differentiate between threat and vulnerability in risk identification?
• Which term refers to the attention reasonably expected from a person who seeks to satisfy a legal requirement or to discharge an obligation?
• What is a risk gap?
• How should risk information be packaged for executives?
• Which of the following is NOT typically listed as an impact category in CRISC risk identification?
• Who owns business processes?
• Which approach combines top-down strategic perspective with bottom-up operational insights to develop risk scenarios?
• Which term describes an overall asset, organization, or business process under review, including details on its contribution to, mitigation of, or influence on risk?
• Why is third-party dependency considered in IT risk identification?
• In the NIST Risk Management Framework, which activity corresponds to Step 2?
• Which term describes the tactical management activities that occur at the business unit or business process level?
• How does data classification relate to risk identification?
• Identify a scenario where cloud computing introduces IT risk that should be captured in risk identification.
• What does the NIST RMF define beyond the steps?
• Which statement best describes the relationship between governance and risk management?
• Who sets risk governance for an organization?
• How do you identify critical data assets?
• What is the importance of maintaining an auditable trail of risk identification?
• Which elements should risk summaries include for governance?
• How can risk identification findings influence risk governance structure?
• Which tool involves constructing hypothetical situations to evaluate potential risk impacts?