ISACA Certified in Risk and Information Systems Control Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose ABD1

  risk identification then risk scenario development answer c goes to risk identification

• Chose BCD1

  A & C are basically the same answer, except that C is the better of them.

• Chose ACD2

  When creating risk scenarios, the correct requirements are: ✅ A. Determination of cause and effect ✅ C. Potential threats and vulnerabilities that could cause loss ✅ D. Determination of the value of an asset ⸻ Explanation: • A risk scenario needs to establish cause and effect so that the relationship between the risk event, its source, and the resulting business impact is clear. • It must identify threats and vulnerabilities that could trigger the risk and result in a loss. • It also requires knowing the value of the asset at risk to quantify potential impact. Option B (“Determination of the value of business process at risk”) is too broad and not part of the standard risk scenario creation steps—focus is on assets, threats, vulnerabilities, and cause-effect. 👉 Correct answers: A, C, D