CRISC Domain 1 Practice Exam

These questions are part of the practice quiz. Start practicing

• Which of the following is not typically considered part of internal governance?
• How do you identify critical data assets?
• Which tool involves constructing hypothetical situations to evaluate potential risk impacts?
• How should a CRISC practitioner approach regulatory changes during risk identification?
• Which document provides the process steps used by federal information systems for risk management?
• Why is it important to document risk sources during identification?
• What is the difference between a risk event and a threat scenario?
• What is the primary purpose of compliance management within an organization?
• Which technique helps identify possible IT risks by considering worst-case, best-case, and plausible scenarios?
• In the NIST Risk Management Framework, which activity corresponds to Step 2?
• What is the purpose of mapping project objectives to distinct risk areas such as schedule, budget, security, compliance, operations, and stakeholder impact?
• When identifying risks for data that moves across borders, what steps should you take?
• Which activity is part of risk identification?
• Why is asset criticality assessment useful in risk identification?
• What is the context of risk in risk identification, and why is it important?
• Which approach combines top-down strategic perspective with bottom-up operational insights to develop risk scenarios?
• What is the relationship between risk identification and risk assessment?
• Auditing accountability corresponds to which line of defense?
• What is a primary function of auditing in governance and risk management?
• Name two common tools or artifacts used during risk identification.
• Distinguish between a threat and a vulnerability with examples.
• How can you identify vulnerabilities without technical scanning tools?
• In the NIST Risk Management Framework, which activity corresponds to Step 6?
• Which scenario best illustrates a risk that should be captured in risk identification?
• What dictates the behavior of risk management professionals?
• Which practice helps ensure timely updating of risk identification outputs?
• How can process owners contribute to risk identification?
• How does risk appetite relate to risk identification?
• What is the primary objective of IT risk identification?
• Which artifact encompasses criteria such as organizational structure, policies, standards, technology, architecture and controls used in risk scenario development?
• Which of the following is an impact category used in CRISC risk identification?
• Which description reflects the requirements the organization must adhere to for managing both business and IT risk?
• Which two dimensions are typically used on a risk map?
• How does risk identification support risk treatment planning?
• What is described as the most effective method to assess business risk?
• In risk identification, what is the purpose of a 'risk theme'?
• Which term refers to internal governance that reflects the management philosophy, culture, and directives of senior leaders?
• Which statement best describes asset criticality assessment?
• What role do threat actors play in risk identification?
• What is the role of incident history in risk identification?
• Which of the following statements is true about risk and controls?
• The third line of defense in managing enterprise risk is typically composed of what?
• Which statement best describes a risk scenario?
• What is the purpose of risk scenarios in risk identification?
• What is the difference between 'risk' and 'control' in CRISC?
• Which item is an example of a threat?
• What is the primary role of Key Performance Indicators in management of business processes?
• Which role is responsible for the day-to-day risk management functions?
• The second line of defense is comprised of which functions and is intended to provide guidance?
• How can you assess the regulatory risk landscape during risk identification?
• Which of the following best describes incident history's role in risk identification?
• Why is alignment of IT risk with business objectives important?
• Which role is primarily responsible for the day-to-day operations of risk management activities within a business unit?
• Which term describes the overall level of risk an organization is willing to take to achieve strategic goals?
• Monitor risk and financial reporting issues is the responsibility of which line of defense?
• How do you differentiate between threat and vulnerability in risk identification?
• What is the difference between inherent risk and residual risk?
• Name four risk categories commonly used in CRISC risk identification.
• Why do risk scenarios enable the risk assessment process?
• What term describes anything of value to the organization, including physical assets, facilities, human assets, and information?
• What approach helps ensure consistent risk identification across teams?
• Which is a component of risk context in CRISC governance?
• Who is responsible for the creation of security policies and procedures?
• Which function oversees the asset lifecycle including inventory, classification, use, and disposal?
• When identifying risks, when should owners be assigned to risk scenarios?
• Which term means Just, proper, and sufficient care, or the absence of negligence?
• Which term represents the governance concept associated with laws and external regulatory bodies?
• Which practice most directly supports prioritizing risk responses?
• Which statement best explains data flow analysis in risk identification?
• How does risk appetite influence actions on identified risks?
• Which RMF step involves evaluating the effectiveness of security controls after implementation?
• When identifying risks related to emerging technologies, what should you do?
• How can you identify data sensitivity during risk identification?
• How can scenario-based thinking improve risk identification?
• What term describes detailed information on all aspects of an asset and how those aspects contribute to, mitigate, or influence risk?
• In risk scenario modeling, what term refers to an entity capable of triggering or influencing risk events?
• What is a capability map in risk identification?
• What is the difference between risk appetite and risk tolerance?
• Which describes 'risk owner accountability'?
• Laws and external bodies describe which governance dimension?
• What is the significance of governance, risk, and compliance (GRC) alignment in Domain 1?
• What is the recommended format for presenting executive risk information?
• Which type of risk do data privacy laws typically introduce?
• Define risk owner in CRISC governance.
• Which is a common risk management framework you should be aware of?
• What is residual risk?
• How should you document risk dependencies?
• Why is third-party dependency considered in IT risk identification?
• Which practice involves setting risk appetite and tolerances to guide decision making?
• Which term best describes the group that monitors risk across IT and business processes?
• Which of the following best describes a risk appetite statement?
• How should residual risks be treated in risk identification?
• Which description best defines a risk map?
• Which line of defense provides guidance for risk management and ethics within the organization?
• What is the main objective of a security management program?
• What is a primary benefit of involving business stakeholders in risk identification?
• What is a practical outcome of using scenario-based thinking in risk identification?
• Which action improves identification of critical data assets?
• Auditing processes are connected to accountability to determine if risk owners are meeting governance and risk management requirements. Which outcome best captures this linkage?
• Which of the following is an example of a risk scenario involving data privacy?
• What term describes a comprehensive view of an asset, process, or organization under review that includes its contribution to, mitigation of, or influence on risk?
• Which of the following is NOT typically used as a risk identification artifact?
• How do third-party relationships influence risk identification?
• Which factors should be used to select a risk owner for a given risk?
• What does risk tolerance mean in CRISC context?
• How should data flows help in risk identification?
• What is a typical benefit of organizing risk information by taxonomy?
• Which document maintains history of risk events and assigned owners?
• How do data privacy laws influence risk identification?
• Which statement about the RMF steps is NOT correct?
• First line of defense is composed of which function?
• What is the term for the maximum amount of risk an entity can absorb while pursuing strategy and objectives?
• What is the impact of automation on risk identification?
• What term defines how an organization feels about and deals with risk and originates from the organization's leadership and governance?
• Who owns risk?
• Which statement best describes how a risk heat map communicates risk levels?
• How can risk identification findings influence risk governance structure?
• What is the purpose of aligning risk prioritization with critical objectives and risk appetite?
• Which element includes risk appetite, tolerance strategy and various policies for an organization?
• Define risk taxonomy and its role in IT risk identification.
• In the NIST Risk Management Framework, which activity corresponds to Step 5?
• In CRISC, how is a 'risk event' defined?
• Which of the following describes a typical risk likelihood scale used in risk identification?
• What is a common deliverable of risk identification at Domain 1?
• Why are stakeholder interviews important in risk identification?
• Which statement best describes when risk identification updates should be triggered?
• What statement best describes the relationship between data classification and risk identification?
• What is a risk heat map?
• The best estimate of the likelihood of significant events affecting an enterprise is provided by which analysis?
• Who is responsible for both the day-to-day and long-term operations and success of the process?
• Which item is NOT one of the three lines of defense in managing enterprise?
• Why is maintaining an up-to-date asset inventory critical in risk management?
• Which items would you expect to originate from a formal risk identification workshop to begin prioritization?
• Which term describes the attention reasonably expected to satisfy a legal requirement or discharge an obligation?
• Which term refers to the collection of activities used to manage the inventory, classification, use, and disposal of assets?
• What deliverables would you expect from a risk identification workshop?
• How does a risk scenario differ from a risk event?
• What is the main objective of asset management within an organization?
• Which element is NOT typically part of a risk taxonomy?
• What are common sources of IT risk in Domain 1?
• Where do risk management and compliance management overlap?
• Which statement best contrasts a threat scenario and a risk event?
• How should risk identifiers be validated?
• What is the primary benefit of risk scenarios in risk assessment?
• To identify risk factors, which question helps reveal ownership of business processes?
• What is risk context mapping?
• Which body is typically responsible for approving risk management policies and risk appetite?
• What is the best approach to develop risk scenarios?
• Which term describes the tactical management activities that occur at the business unit or business process level?
• Which statement best describes how incident history informs ongoing risk identification?
• How should risk information be packaged for executives?
• Which document details the organization's overall strategy, methodology, and long-term desires for managing risk?
• In the context of risk management, auditing primarily serves to verify that risk owners have controls in place to manage risk at an acceptable level within their area. Which option best reflects this?
• What does the NIST RMF define beyond the steps?
• What is meant by 'risk taxonomy' in CRISC Domain 1?
• Why is asset identification essential in risk identification?
• What is the primary purpose of the 'Authorize Information Systems' step in the RMF?
• How is auditing connected to accountability within governance and risk management?
• Which statement best describes risk dependencies documentation?
• What drives risk tolerance and risk appetite?
• What is the difference between a risk event and a risk cause?
• Which statement best describes risk evaluation after identification?
• Which assessment focuses on identifying threats and vulnerabilities to assets?
• What is an example of a risk event in data privacy?
• Who typically reviews and approves the risk register?
• What is a risk appetite statement and how is it used in Domain 1?
• What is a risk register?
• Which statement best describes the impact of risk identification findings on governance?
• What regulatory and contractual obligations should be considered during risk identification?
• Which elements should risk summaries include for governance?
• How does change management impact risk identification?
• What distinguishes risk identification from risk assessment?
• Which approach uses risk scenarios when estimating the likelihood and impact of significant risk to the enterprise?
• What is a key consideration when identifying risks in a multinational organization?
• What is the role of KRIs in risk identification?
• How can regulatory risk be identified?
• What is the purpose of monitoring regulatory developments during risk identification?
• Which term describes the overarching framework for managing risk across an organization?
• In the NIST RMF, what is Step 1?
• Which output documents the IT risk identified, assigned owners, and initial risk ratings?
• In risk scenario development, which element most strongly influences the scenario's outcome?
• What is a risk register health check?
• What is a risk owner, and why must one be assigned during risk identification?
• How does data classification relate to risk identification?
• How should risk categories be prioritized during Domain 1 IT Risk Identification?
• Which elements are typically considered part of internal governance?
• Who typically constitutes the second line of defense in managing enterprise risk?
• Which item is commonly included in a risk identification deliverable?
• What is the importance of maintaining an auditable trail of risk identification?
• What describes the practice of identifying and managing strategic risk in an organization?
• Which of the following is NOT typically listed as an impact category in CRISC risk identification?
• How should regulatory changes be treated in risk identification?
• What term describes the amount of risk an organization is willing to accept to achieve its goals, in alignment with strategy?
• Who is ultimately accountable and responsible for how risk is treated?
• Which approach enhances risk identifier validation beyond internal inputs?
• Why is it important to involve business stakeholders in risk identification?
• What concept helps ensure consistency when identifying risk across the organization?
• Which of the following describes criteria including organizational structure, policies, standards, technology, architecture and controls?
• What is 'business impact analysis' and its relevance to Domain 1?
• Who sets risk governance for an organization?
• Which two elements are typically captured together in a risk event in the IT risk register?
• In risk scenario development, which element affects the scenario the most?
• After applying controls, the risk that remains is called?
• Which term describes the degree, amount, or volume of risk that an organization will withstand?
• What is risk scenario analysis and how is it used?
• Which item is NOT part of the three lines of defense in enterprise risk management?
• What is included in documenting the risk context?
• How is initial prioritization typically determined after risk identification?
• Which practice helps ensure risk identifiers reflect current regulatory expectations?
• Categorizing risk in Domain 1 primarily helps to accomplish which outcome?
• Who is generally responsible for defining the risk appetite and risk tolerance of an organization?
• What is the primary purpose of a risk map?
• In the NIST Risk Management Framework, which activity corresponds to Step 3?
• Which term refers to the attention reasonably expected from a person who seeks to satisfy a legal requirement or to discharge an obligation?
• Which statement best defines risk exposure?
• Which term is defined as 'Just, proper, and sufficient care, or the absence of negligence'?
• What is the purpose of a control library in IT risk identification?
• What is the primary objective of risk identification in CRISC Domain 1?
• Which activity most directly integrates governance requirements with risk and control practices?
• What is the role of incident history in risk identification?
• How should risk identification results be communicated to governance bodies?
• In the three lines of defense model, which group is typically the first line of defense in managing enterprise risks?
• Which item is most often used to track progress within the risk management process during risk treatment?
• In the NIST Risk Management Framework, which activity corresponds to Step 4?
• What is a risk gap?
• Who should monitor regulatory developments during risk identification?
• In the three lines of defense model, which function provides independent assurance that risk management and control processes are effective?
• What is the purpose of a standardized risk taxonomy in risk identification?
• Which of the following best describes the purpose of a risk taxonomy?
• Which threats should be considered when identifying risks to an organization's cloud environment?
• Who owns business processes?
• Which role is described as proactively monitoring and managing risk associated with IT support systems, security controls, and overall business processes?
• Identify a scenario where cloud computing introduces IT risk that should be captured in risk identification.
• Which statement best describes the relationship between governance and risk management?
• Which of the following would be considered a vulnerability?
• Which data sources help identify IT risks (internally and externally)?
• Which term describes an overall asset, organization, or business process under review, including details on its contribution to, mitigation of, or influence on risk?
• Which CRISC domain emphasizes documenting IT risk events and owners?
• In the NIST Risk Management Framework, which activity corresponds to Step 7?
• What best describes the relationship between risk identification and risk prioritization?