How do threat modeling outputs feed into the risk assessment process?

They provide a final risk mitigation plan.

They provide a list of potential threats that can be used to identify risks and analyze their likelihood and impact.

They replace the need for risk analysis.

They automatically calculate the financial value of assets.

A threat modeling exercise has identified a critical vulnerability in a legacy system that is scheduled for decommissioning in six months. The risk team needs to decide how to handle this risk. The system is still in use and a breach could have significant impact. What is the most appropriate action based on the threat modeling output?

Document the risk and implement temporary mitigations to reduce the likelihood of exploitation

Immediately decommission the system to eliminate the risk

Ignore the risk because the system will be decommissioned soon

Spend a large budget on a full system overhaul

Which of the following is an example of an external source of threat intelligence?

The organization's vulnerability scan results

Internal security incident logs

Employee security awareness training records

Industry-specific threat reports

Which of the following is a key component of the threat landscape that risk professionals should analyze?

Threat actor motivations and capabilities

The color scheme of the organization's website

The number of employees in the organization

The organization's marketing budget

Certified in Risk and Information Systems Control

Domain 2Objective 2

Threat Modeling and Threat Landscape CRISC Practice Questions (Page 2)

Part of the Domain 2: Risk Assessment domain, which accounts for 22% of the CRISC exam.

28questions here

6free pages

6concepts

22%of the exam

Questions 6–10

6foundation · easy
How do threat modeling outputs feed into the risk assessment process?
Select an answer first
7foundation · easy
Which threat modeling methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
Select an answer first
8application · medium
A threat modeling exercise has identified a critical vulnerability in a legacy system that is scheduled for decommissioning in six months. The risk team needs to decide how to handle this risk. The system is still in use and a breach could have significant impact. What is the most appropriate action based on the threat modeling output?
Select an answer first
9foundation · easy
Which of the following is an example of an external source of threat intelligence?
Select an answer first
10foundation · easy
Which of the following is a key component of the threat landscape that risk professionals should analyze?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.

Threat Modeling and Threat Landscape CRISC Practice Questions (Page 2)

Questions 6–10

How do threat modeling outputs feed into the risk assessment process?

Which threat modeling methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Which of the following is an example of an external source of threat intelligence?

Which of the following is a key component of the threat landscape that risk professionals should analyze?

Keep studying — Domain 2: Risk Assessment