I85PREP
⌘ K
PRMIA CCRM study materials
PRMIA CCRM study resources

PRMIA CCRM practice questions

One question at a time. Build your PRMIA CCRM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Risk Identification

In a cyber risk taxonomy, which term best describes a weakness in a system, process, or control that a threat could exploit?

  1. Risk appetite
  2. Threat actor
  3. Vulnerability Correct answer.
  4. Control objective

Explanation

A vulnerability is an intrinsic weakness in an asset, configuration, process, or control that a threat source can exploit to cause harm. Threat actors are the sources of harmful action, risk appetite is a tolerance statement, and control objectives are desired outcomes, so none of those describes the weakness itself.

Question 2Cyber Risk Identification

Which pair correctly distinguishes an asset from a threat in cyber risk identification?

  1. An asset is a documented control; a threat is a regulatory requirement
  2. An asset is something of value to the organization; a threat is a potential cause of harm to it Correct answer.
  3. An asset is a residual loss estimate; a threat is a realized incident
  4. An asset is a malicious actor; a threat is the data the actor targets

Explanation

Asset identification records what has value and therefore needs protection, such as data, systems, people, and processes. A threat is any potential source or event that could exploit a vulnerability and harm those assets. Confusing assets with actors, controls, or loss figures undermines the whole identification process.

Question 3Cyber Risk Identification

A risk register entry records a likelihood of 4 and an impact of 5 on a 5x5 matrix. What is the inherent risk score before any controls are considered?

  1. 1
  2. 20 Correct answer.
  3. 9
  4. 45

Explanation

On a multiplicative 5x5 matrix, inherent risk is likelihood multiplied by impact, so 4 times 5 equals 20. Adding the two values (9) is not how matrix scoring works, and 45 or 1 do not follow from the stated inputs. The score should be captured before mitigating controls so that later residual scoring is comparable.

Question 4Cyber Risk Identification

What is the primary purpose of maintaining a risk register during cyber risk identification?

  1. To provide a single traceable record of identified risks, owners, and treatment status Correct answer.
  2. To certify that the organization is compliant with a specific standard
  3. To calculate insurance premiums on behalf of the underwriter
  4. To replace the need for periodic vulnerability scanning

Explanation

A risk register is the structured inventory that records each identified risk, its assessment, its owner, and the status of treatment, giving traceability from identification through remediation. It supports but does not replace technical scanning, and it does not by itself certify compliance or price insurance. Its value lies in consistent documentation and accountability.

Question 5Cyber Risk Identification

Which statement correctly describes the relationship between a threat event and a cyber loss event?

  1. A loss event precedes the threat event that causes it
  2. A threat event is always a confirmed breach, while a loss event is only suspected
  3. A threat event is a potential occurrence; a loss event is an occurrence that actually produces harm Correct answer.
  4. A threat event and a loss event are synonyms in cyber risk terminology

Explanation

Threat events are potential occurrences that may exploit a vulnerability, whereas loss events are the realized occurrences that actually generate financial, operational, or reputational harm. Keeping these distinct lets analysts separate forward-looking likelihood estimates from historical loss data. Treating them as synonyms or reversing their order confuses the causal chain.

Question 6Cyber Risk Identification

Which element of the CIA triad is most directly compromised when an attacker alters wire-transfer instructions in transit?

  1. Non-repudiation
  2. Integrity Correct answer.
  3. Confidentiality
  4. Availability

Explanation

Altering data in transit attacks integrity, because the information is changed without authorization and can no longer be trusted. Confidentiality concerns unauthorized disclosure and availability concerns timely access, neither of which is the primary harm here. Non-repudiation is a related property but is not one of the three CIA elements.

Question 7Cyber Risk Identification

Which source of information is most characteristic of an internal, forward-looking input to cyber risk identification?

  1. Public breach notification feeds
  2. Historical industry loss databases
  3. Business unit interviews about planned process changes Correct answer.
  4. Regulator enforcement announcements

Explanation

Interviews with business units about planned changes surface emerging exposures specific to the organization before they materialize, making them a forward-looking internal input. Loss databases, breach feeds, and enforcement announcements are external and largely backward-looking sources. Combining both types improves coverage of the risk landscape.

Question 8Cyber Risk Identification

A firm discovers that a critical supplier has no tested disaster recovery plan. Into which category does this finding most directly fall?

  1. Data privacy risk
  2. Third-party or supply chain risk Correct answer.
  3. Insider threat risk
  4. Physical security risk

Explanation

Dependence on a supplier's untested recovery capability is a third-party or supply chain exposure, because the firm's continuity relies on an external party's resilience. Insider threat, physical security, and privacy risks describe different causal sources. Correct categorization directs the finding to the right owner and treatment route.

Question 9Cyber Risk Identification

During risk identification, what does the term 'risk owner' mean?

  1. The individual accountable for managing a specific identified risk Correct answer.
  2. The auditor who independently validates the risk assessment
  3. The vendor that supplies the affected technology
  4. The regulator with jurisdiction over the activity

Explanation

A risk owner is the named individual accountable for understanding, monitoring, and treating a specific identified risk. Auditors validate independently, vendors supply technology, and regulators set requirements, but none of them carries that accountability. Assigning clear owners prevents risks from being identified and then left unmanaged.

Question 10Cyber Risk Identification

An analyst classifies a risk as 'high' using the organization's matrix, but the business unit argues the estimate is inflated. Which action best supports a defensible identification and assessment outcome?

  1. Defer the rating to the technology vendor's opinion
  2. Remove the risk from the register until an incident occurs
  3. Document the likelihood and impact rationale and the evidence used for each rating Correct answer.
  4. Lower the score to preserve consensus among stakeholders

Explanation

Defensible ratings rest on documented reasoning, including the evidence and assumptions behind likelihood and impact judgments. Adjusting scores for consensus, deleting the risk, or outsourcing judgment to a vendor all remove the audit trail and bias the outcome. Transparent rationale also enables later recalibration when new data arrives.

Question 11Cyber Risk Identification

A bank wants to identify risks arising from a new cloud-based payment service before launch. Which approach provides the most complete identification?

  1. Rely solely on the vendor's security certification
  2. Run a structured workshop combining threat modeling, data-flow review, and control gap analysis Correct answer.
  3. Review only the previous year's incident log
  4. Wait for the first penetration test after go-live

Explanation

A structured pre-launch workshop that combines threat modeling, data-flow review, and control gap analysis examines architecture, data movement, and missing safeguards together, giving broad coverage. Vendor certification, post-launch testing, and historical incident logs each provide partial or delayed views. Early identification allows design changes while they are still inexpensive.

Question 12Cyber Risk Identification

Which scenario best illustrates residual risk rather than inherent risk?

  1. A database with no encryption and no access review
  2. The maximum plausible loss from a hypothetical total outage
  3. The exposure remaining after encryption and access reviews have been implemented and tested Correct answer.
  4. A regulatory requirement to encrypt data at rest

Explanation

Residual risk is what remains after mitigating controls are applied and operating effectively, so the post-control exposure is the residual figure. An unencrypted, unreviewed database describes inherent risk, a maximum plausible loss describes an impact estimate, and a regulatory requirement is an obligation. Comparing inherent and residual scores shows whether controls are actually reducing exposure.

Question 13Cyber Risk Identification

An organization maps its processes to a recognized control framework during risk identification. What is the main benefit of this mapping?

  1. It transfers legal liability to the framework publisher
  2. It eliminates the need to assign risk owners
  3. It reveals where controls are missing or duplicated relative to expected practice Correct answer.
  4. It guarantees that no cyber incident can occur

Explanation

Mapping processes to a control framework highlights gaps, overlaps, and duplicative controls against an accepted reference, which sharpens identification and prioritization. No framework prevents all incidents, transfers liability, or removes the need for accountable owners. The mapping is a diagnostic aid, not a guarantee.

Question 14Cyber Risk Identification

A risk assessment team uses a scenario-based approach. Which characteristic most distinguishes it from a pure checklist review?

  1. It requires no input from business subject matter experts
  2. It explores plausible cause-to-consequence pathways and their dependencies Correct answer.
  3. It produces a binary pass or fail result
  4. It relies only on historical incident counts

Explanation

Scenario analysis traces how a threat could exploit vulnerabilities along a pathway to specific consequences, capturing dependencies and cascading effects that checklists often miss. It is not limited to historical counts, it benefits from expert input, and it produces graded rather than binary outcomes. This makes it valuable for novel or complex exposures.

Question 15Cyber Risk Identification

Which indicator would best help an organization identify an emerging concentration risk in its third-party ecosystem?

  1. The count of phishing emails blocked per month
  2. The number of vendors with current SOC reports
  3. The proportion of critical services dependent on a single cloud provider or region Correct answer.
  4. The average age of endpoint devices

Explanation

Concentration risk arises when many critical services depend on one provider, region, or technology, so measuring that dependency share directly reveals the exposure. Vendor report currency, device age, and phishing volume are useful metrics but do not measure concentration. Identifying concentration early supports diversification and contingency planning.

Question 16Cyber Risk Identification

A firm's risk taxonomy separates strategic, operational, and compliance risks. A finding that a new regulation requires additional customer authentication belongs primarily to which category?

  1. Reputational risk
  2. Strategic risk
  3. Compliance risk Correct answer.
  4. Market risk

Explanation

A requirement imposed by a regulator that demands changed practices is a compliance risk, because failure to meet it creates legal and supervisory consequences. Strategic risk concerns business direction, market risk concerns prices and rates, and reputational risk concerns stakeholder perception. Correct classification routes the finding to the compliance function for treatment.

Question 17Cyber Risk Identification

What is the most appropriate treatment for a risk whose assessed level exceeds appetite and for which no cost-effective mitigation exists?

  1. Accept the risk without further action
  2. Delay any decision until the next annual review
  3. Avoid the activity that creates the risk or transfer it where feasible Correct answer.
  4. Reclassify the risk as low to remain within appetite

Explanation

When a risk exceeds appetite and cannot be economically mitigated, the remaining options are avoidance of the underlying activity or transfer, such as insurance or contractual allocation. Unqualified acceptance leaves the firm outside appetite, reclassification is a cosmetic manipulation, and indefinite delay leaves exposure unmanaged. The chosen treatment should be documented with rationale.

Question 18Cyber Risk Identification

An analyst combines a vulnerability scan, a threat intelligence feed, and an asset inventory to identify exposures. Why does this combination improve identification quality?

  1. It replaces the risk register with raw scan output
  2. It removes the need to validate findings with asset owners
  3. It guarantees that every finding is a true positive
  4. It correlates exploitable weaknesses with assets that matter and threats that are active Correct answer.

Explanation

Correlating vulnerability data with asset criticality and active threat intelligence focuses attention on exposures that are both exploitable and material, reducing noise from irrelevant findings. It does not eliminate validation, guarantee accuracy, or replace the register. The combination converts technical data into prioritized risk information.

Question 19Cyber Risk Identification

Which practice best supports continuous rather than point-in-time cyber risk identification?

  1. A one-off external audit at project inception
  2. A quarterly reminder email to staff
  3. Automated feeds from asset management, vulnerability scanning, and change management into the risk process Correct answer.
  4. An annual self-assessment completed once per year

Explanation

Continuous identification depends on automated data flows from asset, vulnerability, and change systems so that new exposures are surfaced as the environment changes. Annual assessments, one-off audits, and reminder emails are periodic and cannot keep pace with dynamic environments. Automation also improves consistency and reduces manual effort.

Question 20Cyber Risk Identification

A risk register shows a risk with high impact but very low likelihood, and the business proposes no action. Which reasoning is most sound for the risk committee?

  1. Ignore the risk because likelihood is low
  2. Remove the risk because it has not yet occurred
  3. Reclassify impact as low to match the likelihood rating
  4. Evaluate whether the tail impact could breach appetite or solvency and require contingency planning Correct answer.

Explanation

Low-likelihood, high-impact risks can still threaten solvency or strategic objectives, so the committee should test tail scenarios against appetite and require contingency plans even if routine mitigation is disproportionate. Ignoring or deleting the risk discards the exposure, and reclassifying impact misstates it. Tail risk warrants specific consideration rather than dismissal.

Question 21Cyber Risk Identification

Which statement best explains why risk identification should include both top-down and bottom-up perspectives?

  1. Top-down produces more accurate technical findings than bottom-up
  2. Bottom-up replaces the need for board-level oversight
  3. Top-down is used only for compliance and bottom-up only for technology
  4. Top-down captures strategic and enterprise-wide exposures, while bottom-up surfaces operational detail from process owners Correct answer.

Explanation

Top-down analysis captures enterprise-level, strategic, and cross-cutting exposures that individual teams may not see, while bottom-up input from process and asset owners reveals operational detail and ground truth. Using both reduces blind spots and improves ownership. Neither perspective alone is sufficient, and they are not confined to particular functions.

Question 22Cyber Risk Identification

An organization's risk appetite statement says it will tolerate no breaches of customer data confidentiality. How should this statement influence risk identification and treatment?

  1. It removes the need to identify confidentiality risks at all
  2. It makes any identified confidentiality exposure above appetite and requires treatment or avoidance Correct answer.
  3. It applies only to third-party vendors
  4. It allows confidentiality risks to be accepted if likelihood is low

Explanation

A zero-tolerance appetite means any credible confidentiality exposure exceeds the stated tolerance, so it must be mitigated, avoided, or escalated rather than accepted on likelihood grounds. It does not remove the need to identify such risks, and its scope covers all sources, not only vendors. Appetite statements should directly drive identification priorities and treatment decisions.

Question 23Cyber Risk Identification

A firm uses a 5x5 matrix where likelihood 3 and impact 4 yields a score of 12, classified as 'medium'. A critical payment system scores 15 and is also classified 'medium'. What is the main limitation this illustrates?

  1. Coarse bands can mask materially different exposures and should be supplemented with quantitative analysis Correct answer.
  2. Scores above 10 should be ignored
  3. Impact should always be weighted more heavily than likelihood
  4. Matrix scoring cannot incorporate likelihood at all

Explanation

Coarse matrix bands can group exposures with quite different severity, so a payment-critical system and a lesser asset may share a label despite very different loss potential. Supplementing with quantitative or scenario-based analysis, and weighting by asset criticality, restores discrimination. The limitation is about banding granularity, not about ignoring likelihood or discarding higher scores.

Question 24Cyber Risk Identification

During identification, an analyst finds that a single identity provider authenticates nearly all staff and contractors. Which risk characterization is most accurate?

  1. A purely physical security issue unrelated to cyber risk
  2. A low-severity finding because authentication is centralized and therefore efficient
  3. A compliance risk only if the provider lacks a certification
  4. A systemic concentration risk whose compromise could cascade across many dependent services Correct answer.

Explanation

Centralizing authentication in one provider creates a systemic single point of failure: compromise or outage could propagate to every dependent service, producing correlated rather than independent losses. Efficiency is real but does not reduce the severity of the correlated exposure. The finding is cyber and systemic, not merely physical or certification-driven.

Question 25Cyber Risk Identification

An analyst is asked to identify cyber risks for a merger target with incomplete documentation. Which approach best manages identification uncertainty?

  1. Apply structured interviews, technical discovery, and explicit documentation of assumptions and information gaps Correct answer.
  2. Assign a low risk rating because data is unavailable
  3. Rely solely on the target's self-reported questionnaire
  4. Assume the target's controls are adequate because no incidents are disclosed

Explanation

When documentation is incomplete, structured interviews and technical discovery generate evidence, while explicitly recording assumptions and gaps preserves transparency about uncertainty. Assuming adequacy, defaulting to low ratings, or relying only on self-reporting hides unknown exposures. Documented gaps also become conditions in deal negotiation and integration planning.

Question 26Cyber Risk Identification

In cyber risk identification, which term describes a weakness or gap in controls, processes, or configuration that a threat could exploit?

  1. Control objective
  2. Threat actor
  3. Vulnerability Correct answer.
  4. Risk appetite

Explanation

A vulnerability is an internal weakness or exposure that a threat source can act upon to cause harm. Threat actors are the agents that exploit weaknesses, while appetite and control objectives are governance concepts rather than exploitable gaps.

Question 27Cyber Risk Identification

Which pairing correctly matches a threat source with a typical motivation during cyber risk identification?

  1. Nation-state group seeking espionage and strategic advantage Correct answer.
  2. Script kiddie seeking regulatory compliance
  3. Hacktivist seeking to reduce audit findings
  4. Insider seeking to improve control coverage

Explanation

Nation-state actors are commonly associated with espionage, intellectual property theft, and strategic disruption. The other pairings assign motives such as compliance or audit improvement that do not describe adversarial threat sources.

Question 28Cyber Risk Identification

An analyst is building an inventory of the organization's information assets for risk identification. Which attribute is most important to record for each asset to support later risk analysis?

  1. Its business criticality and data classification Correct answer.
  2. Its physical color and rack position
  3. Its procurement purchase order number
  4. Its original installation date

Explanation

Risk identification depends on knowing how important an asset is to the business and how sensitive its data is, because these drive impact estimates. Physical and procurement details are useful for asset management but do not by themselves indicate risk exposure.

Question 29Cyber Risk Identification

Which document most directly defines the boundaries, scope, and context within which cyber risk identification is performed?

  1. The software development lifecycle policy
  2. The incident response playbook
  3. The vendor onboarding checklist
  4. The risk identification scope and context statement Correct answer.

Explanation

A scope and context statement sets out which systems, processes, and business units are included in the risk exercise and the assumptions behind it. Incident, development, and vendor documents are operational artifacts that may feed the exercise but do not define its boundaries.

Question 30Cyber Risk Identification

Which category of cyber risk arises primarily from the behavior or error of an employee with legitimate access?

  1. Supply chain risk
  2. Insider risk Correct answer.
  3. Environmental risk
  4. Geopolitical risk

Explanation

Insider risk covers harm caused by people within the organization, whether through negligence, error, or malicious intent. Supply chain, geopolitical, and environmental risks originate outside the individual employee's own actions.

Question 31Cyber Risk Identification

During risk identification an analyst notes that a legacy server runs an operating system that no longer receives vendor security patches. Which risk factor does this most directly represent?

  1. Technical vulnerability from unsupported technology Correct answer.
  2. Threat actor capability
  3. Regulatory obligation
  4. Business process dependency

Explanation

Unsupported software is a technical vulnerability because known flaws will not be remediated by the vendor. It is not a statement about adversary capability, process dependency, or a legal requirement.

Question 32Cyber Risk Identification

What is the primary purpose of a risk taxonomy during cyber risk identification?

  1. To provide a consistent structure for naming and grouping identified risks Correct answer.
  2. To replace the need for a risk register
  3. To calculate the monetary value of each control
  4. To certify the organization against a standard

Explanation

A taxonomy gives a shared vocabulary and hierarchy so risks are recorded and compared consistently across the organization. It does not value controls, substitute for a register, or confer certification.

Question 33Cyber Risk Identification

Which input most directly supports identification of cyber risks associated with a specific business process?

  1. The annual marketing budget
  2. The office floor plan
  3. A process map showing systems, data flows, and handoffs Correct answer.
  4. The list of board meeting attendees

Explanation

Process mapping reveals where data and systems are used, where handoffs occur, and where dependencies create exposure. Budgets, attendee lists, and floor plans do not show the technology and data relationships that generate cyber risk.

Question 34Cyber Risk Identification

An analyst is identifying risks for a new internet-facing customer portal before go-live. Which activity best fits within the identification phase rather than later treatment or monitoring?

  1. Configuring the alerting threshold in the SIEM
  2. Signing off the residual risk acceptance form
  3. Selecting the firewall vendor
  4. Documenting plausible threat scenarios and the assets each could affect Correct answer.

Explanation

Identification is about discovering and documenting what could happen and what would be affected, producing a structured set of scenarios. Vendor selection, risk acceptance, and detection tuning are treatment or monitoring activities that follow identification.

Question 35Cyber Risk Identification

A risk workshop facilitator wants to reduce anchoring bias when participants estimate the likelihood of a data breach scenario. Which technique is most appropriate?

  1. Collect independent estimates before group discussion and then reconcile them Correct answer.
  2. Use last year's single figure without discussion
  3. Ask only the most senior participant to set the number
  4. Announce the CISO's estimate first to frame the discussion

Explanation

Gathering estimates independently before discussion prevents early opinions from anchoring the group. Announcing a senior figure first, deferring to one person, or reusing a prior number all increase anchoring and reduce the quality of the estimate.

Question 36Cyber Risk Identification

Which data source is most useful for identifying cyber risks that have already begun to materialize but have not yet caused a reportable incident?

  1. The fixed asset depreciation schedule
  2. Correlated logs and anomaly alerts from security monitoring Correct answer.
  3. The employee satisfaction survey
  4. The three-year strategic plan

Explanation

Monitoring data such as correlated logs and anomaly alerts can reveal precursor activity that indicates a live exposure. Strategic plans, surveys, and depreciation schedules do not provide evidence of unfolding technical events.

Question 37Cyber Risk Identification

An organization is identifying risks related to a critical SaaS provider. Which artifact most directly reveals the provider's own control weaknesses?

  1. The provider's customer reference list
  2. The provider's share price history
  3. The provider's marketing brochure
  4. An independent assurance report covering the provider's controls Correct answer.

Explanation

An independent assurance report, such as an audit opinion on controls, describes the provider's control environment and any exceptions. Marketing material, share price, and references do not evidence control design or operating effectiveness.

Question 38Cyber Risk Identification

During identification, an analyst finds that two production systems share the same administrator account. Which risk is most directly indicated by this finding?

  1. Loss of accountability and non-repudiation for administrative actions Correct answer.
  2. Increased network latency between the systems
  3. Higher software licensing cost
  4. Reduced backup storage capacity

Explanation

Shared administrative accounts prevent attribution of actions to a specific person, undermining accountability and non-repudiation. Latency, licensing, and storage are operational concerns unrelated to the identity control weakness described.

Question 39Cyber Risk Identification

A firm wants to identify cyber risks arising from a planned acquisition of a company in another jurisdiction. Which factor is most important to include in the identification scope?

  1. The commuting distance of the target's staff
  2. Differences in data protection law and regulatory obligations between jurisdictions Correct answer.
  3. The color scheme of the target's brand
  4. The target's office furniture inventory

Explanation

Cross-border deals introduce legal and regulatory obligations, such as data transfer restrictions, that create compliance and operational cyber risk. Branding, furniture, and commuting details have no material bearing on cyber risk identification.

Question 40Cyber Risk Identification

Which practice most improves the completeness of risk identification across an organization's technology estate?

  1. Combining automated asset discovery with interviews of system owners Correct answer.
  2. Using only the findings of the most recent external audit
  3. Relying solely on the risk register inherited from the prior year
  4. Limiting input to the security team's own observations

Explanation

Automated discovery finds systems that documentation may miss, while owner interviews supply context about purpose and criticality. Relying on prior registers, a single team, or one audit source leaves blind spots.

Question 41Cyber Risk Identification

An analyst is identifying risks for an industrial control environment. Which characteristic most distinguishes operational technology risk from typical enterprise IT risk?

  1. The absence of any network connectivity
  2. The reliance on standard office productivity suites
  3. Safety and physical process consequences of disruption Correct answer.
  4. The use of cloud storage for backups

Explanation

Operational technology risk is distinguished by potential physical safety and process consequences when availability or integrity is lost. OT environments may still be networked, may use cloud services, and are not defined by office software.

Question 42Cyber Risk Identification

Which statement best describes how a threat intelligence feed should be used during cyber risk identification?

  1. It replaces the need to inventory internal assets
  2. It guarantees that a specific attack will occur
  3. It provides a certified valuation of each risk
  4. It informs which threat actors and tactics are plausible for the organization's sector and assets Correct answer.

Explanation

Threat intelligence helps prioritize which adversaries and techniques are relevant to the organization's profile, sharpening scenario selection. It does not substitute for asset inventory, predict certainty, or assign monetary risk values.

Question 43Cyber Risk Identification

A risk analyst is documenting a scenario in which a phishing campaign leads to credential theft and then to unauthorized payment release. Which element is missing if the write-up lists only the phishing email and the payment?

  1. The intermediate steps and controls that could interrupt the chain Correct answer.
  2. The name of the email filtering vendor
  3. The sender's IP geolocation
  4. The date the phishing email was received

Explanation

A well-formed scenario traces the path from initial access through intermediate steps to impact, showing where controls could break the chain. Vendor names, timestamps, and geolocation are supporting details, not the missing causal structure.

Question 44Cyber Risk Identification

Which factor should most influence how frequently an organization refreshes its cyber risk identification for a given business unit?

  1. The seniority of the unit's manager
  2. The size of the unit's travel budget
  3. The rate of change in its technology, threats, and business processes Correct answer.
  4. The number of employees in the unit

Explanation

Risk profiles change fastest where technology, threats, and processes change, so refresh frequency should track that rate of change. Headcount, travel budget, and manager seniority do not indicate how quickly the risk picture shifts.

Question 45Cyber Risk Identification

During identification, an analyst learns that a business unit stores regulated customer data in a personal cloud account outside approved systems. Which risk is most directly created by this shadow IT practice?

  1. Increased electricity consumption in the office
  2. Reduced printing costs
  3. Slower laptop boot times
  4. Unmanaged data exposure beyond the organization's control environment Correct answer.

Explanation

Shadow IT places data outside approved controls, so loss of visibility and protection is the direct risk. Power use, boot time, and printing costs are unrelated operational side effects.

Question 46Cyber Risk Identification

An organization identifies a risk that a critical third party will fail to notify it of a breach within the contractually required window. Which control gap does this most directly point to?

  1. Weak incident notification and escalation obligations in the contract Correct answer.
  2. Insufficient disk encryption on internal servers
  3. Inadequate physical access badges at headquarters
  4. Poor patch management on employee laptops

Explanation

The scenario concerns the contractual and procedural path by which a supplier reports an incident, so notification and escalation terms are the relevant gap. Encryption, badges, and patching are internal controls unrelated to supplier breach reporting.

Question 47Cyber Risk Identification

A risk team finds that a single undersea cable carries most of a region's connectivity for a key service. Which type of risk does this finding most clearly illustrate?

  1. Reputational risk from adverse media coverage
  2. Fraud risk from collusion among employees
  3. Concentration risk from a shared single point of failure Correct answer.
  4. Compliance risk from a missed filing deadline

Explanation

Concentration risk arises when many dependencies converge on one component, so its failure has outsized impact. The finding is about shared infrastructure, not media coverage, filings, or internal collusion.

Question 48Cyber Risk Identification

An analyst is identifying risks for a system that processes payments in real time and must meet a strict recovery time objective. Which identification output is most valuable for later resilience decisions?

  1. A count of the number of meetings held about the system
  2. A summary of the marketing campaign calendar
  3. A dependency map showing upstream services and their recovery capabilities Correct answer.
  4. A list of the system's user interface color standards

Explanation

For a strict recovery objective, knowing which upstream services the system depends on and how quickly each can recover reveals where resilience is constrained. Interface standards, marketing calendars, and meeting counts do not inform recovery planning.

Question 49Cyber Risk Identification

A firm identifies that a legacy application has no documented owner and no known business sponsor. Why is this finding significant for cyber risk identification?

  1. It proves the application is compliant with all standards
  2. Accountability for risk decisions and remediation is unclear, so the exposure may persist unmanaged Correct answer.
  3. It automatically means the application is free of vulnerabilities
  4. It guarantees the application will be decommissioned within a year

Explanation

Without an owner, no one is accountable for accepting, treating, or monitoring the risk, which tends to leave exposures unaddressed. The finding says nothing about vulnerability status, compliance, or a planned retirement date.

Question 50Cyber Risk Identification

During identification, an analyst observes that a supplier's software update mechanism authenticates updates only with a shared static key embedded in the product. Which risk is most directly indicated?

  1. The supplier's support staff will respond more slowly
  2. A compromise of the shared key could let an attacker distribute malicious updates to all customers Correct answer.
  3. The product will consume more memory after each update
  4. The supplier will charge higher licensing fees next year

Explanation

A shared static key means a single compromise can enable widespread distribution of malicious updates through a trusted channel. Licensing, memory use, and support responsiveness are unrelated to the update authentication weakness.