CRISC Practice Test 26 — 15 Questions

Question 1

A risk manager is designing an IT risk management program. According to COBIT 2019, which governance objective is specifically focused on ensuring that risk management is optimized?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's EDM03 (Ensure Risk Optimization) is the governance objective that directs the evaluation, direction, and monitoring of risk management to align with enterprise risk appetite.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 2

An organization is deploying a large number of Internet of Things (IoT) sensors for environmental monitoring in a remote facility. The sensors have limited processing power and cannot be patched easily. Which risk should the risk manager prioritize?

Accepted Answer

Expanded attack surface with unpatched devices. IoT devices often lack security updates, making them vulnerable to exploitation. The expanded attack surface from many devices compounds this risk.

Answer

Vendor lock-in to proprietary protocols

Answer

Insufficient bandwidth for data transmission

Answer

Data integrity issues from sensor malfunction

Question 3

A bank is considering adopting artificial intelligence for credit scoring. The risk manager identifies that the AI model might produce biased outcomes against certain demographic groups. Which AI/ML risk is most directly associated with this concern?

Accepted Answer

Model bias. Model bias occurs when training data or algorithms produce unfair or discriminatory outcomes, directly impacting fairness and regulatory compliance.

Answer

Adversarial attacks

Answer

Explainability requirements

Answer

Data privacy in AI training

Question 4

A risk practitioner is using the FAIR model to quantify cyber risk for a proposed new online payment system. Which factor must be estimated to calculate the probable financial impact of a data breach?

Accepted Answer

Loss magnitude. In FAIR, the probable financial impact is derived from the loss event frequency and the loss magnitude. Loss magnitude estimates the financial loss per incident.

Answer

Threat event frequency

Answer

Vulnerability severity score

Answer

Annualized rate of occurrence

Question 5

An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?

Accepted Answer

Implementing continuous security monitoring of network traffic. The 'Detect' function focuses on identifying cybersecurity events in a timely manner. Continuous security monitoring is a key activity to detect anomalies and incidents.

Answer

Developing an incident response plan

Answer

Conducting a business impact analysis

Answer

Establishing a patch management process

Question 6

An organization is implementing an AI/ML model for credit approval decisions subject to regulatory oversight. Which TWO of the following are the most significant risk considerations?

Accepted Answer

Model bias causing discriminatory outcomes. Regulated decisions require explainability, and model bias can lead to unfair or illegal outcomes. Both are critical risks.

Answer

Data privacy in AI training

Answer

High computational cost of model retraining

Answer

Adversarial attacks on the training data

Question 7

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Accepted Answer

Data architecture layer. Data classification and sovereignty concerns are primarily data-related, falling under the data architecture layer. The data layer defines how data is stored, classified, and managed, including sovereignty requirements.

Answer

Application architecture layer

Answer

Business architecture layer

Answer

Infrastructure/Technology architecture layer

Question 8

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Accepted Answer

Risk assessment. The Identify function includes asset management, risk assessment, and governance to understand the organization's risk posture.

Answer

Recovery planning

Answer

Response planning

Answer

Anomalies and events detection

Question 9

A risk manager is integrating risk management with IT governance. Which of the following are key elements of an IT risk management programme design? (Choose TWO.)

Accepted Answer

Risk assessment methodology. A risk register and a risk assessment methodology are core components of an IT risk management programme design.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Vendor management policy

Question 10

A risk manager is evaluating IoT device risks for a smart building project. Which TWO of the following are significant IoT security risks?

Accepted Answer

Firmware update challenges. IoT devices often have limited security capabilities, leading to expanded attack surface and difficulty in applying firmware updates. These are common IoT risks.

Answer

Data sovereignty compliance

Answer

Quantum computing threat to cryptography

Answer

Vendor lock-in

Question 11

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Accepted Answer

The application exposes sensitive customer data through APIs without proper authentication. The ARB's role includes ensuring security risks are identified before implementation. Among the options, exposure of sensitive customer data is the most critical security risk that could impact the organization's reputation and compliance.

Answer

The application does not support mobile devices

Answer

The application development timeline is aggressive

Answer

The application uses the latest JavaScript framework

Question 12

Which of the following is a key component of the NIST Cybersecurity Framework's Identify function?

Accepted Answer

Risk assessment. The Identify function includes asset management, business environment, governance, risk assessment, and risk management strategy. Risk assessment is a key component.

Answer

Response planning

Answer

Recovery plan implementation

Answer

Anomalies and events detection

Question 13

According to the FAIR model, which TWO of the following are primary components used to calculate probable financial impact of a cyber incident?

Accepted Answer

Loss Magnitude (LM). FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). These two components are multiplied to derive risk.

Answer

Threat intelligence feed

Answer

Control effectiveness score

Answer

Vulnerability severity score

Question 14

An organization is implementing COBIT 2019 and the board has requested assurance that risk management activities are aligned with business objectives. Which governance objective is primarily focused on ensuring risk optimization through evaluation, direction, and monitoring?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 (Ensure Risk Optimization) is the COBIT governance objective that specifically addresses the evaluation, direction, and monitoring of risk management to align with enterprise objectives.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Question 15

An organization is designing an IT risk management program. Which of the following should be the PRIMARY consideration when developing a risk register?

Accepted Answer

Capturing risk details, including impact, likelihood, and mitigation status. A risk register should capture and track identified risks, their assessed impact and likelihood, and planned mitigation actions to enable effective risk management.

Answer

Aligning risk categories with the COSO internal control framework

Answer

Ensuring that the register is integrated with the enterprise risk management system

Answer

Automating the risk register with real-time risk monitoring tools