CRISC Information Technology and Security — All Questions With Answers

Question 1mediummultiple choice

Read the full Information Technology and Security explanation →

A large retail company is implementing a new cloud-based inventory management system. The system will store sensitive customer data and integrate with existing on-premises ERP. The risk manager is asked to identify the most critical risk to address in the shared responsibility model. Which risk is MOST likely to be overlooked?

Question 2hardmultiple choice

Read the full Information Technology and Security explanation →

An energy company is integrating its IT network with OT systems for real-time monitoring. The risk manager is assessing the expanded attack surface. Which risk should be given the HIGHEST priority due to its potential for physical consequences?

Question 3easymultiple choice

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management programme. Which document should be created FIRST to guide the overall approach to risk management?

Question 4mediummultiple choice

Read the full Information Technology and Security explanation →

A financial institution is adopting AI for credit scoring. The model is currently a black box and requires explainability for regulatory compliance. Which risk is MOST critical to address?

Question 5mediummultiple choice

Read the full Information Technology and Security explanation →

During a solution architecture review, the Architecture Review Board (ARB) identifies that a new application communicates with a legacy system using plain text over a public network. Which risk treatment option is MOST appropriate?

Question 6hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is calculating the probable financial impact of a ransomware attack using the FAIR model. Which factor is MOST critical to estimate the annual loss exposure?

Question 7easymultiple choice

Read the full Information Technology and Security explanation →

Which COBIT 2019 domain objective focuses on ensuring that risk is optimized through evaluation, direction, and monitoring?

Question 8mediummultiple choice

Read the full Information Technology and Security explanation →

A hospital is deploying IoT medical devices that connect to the network. Which risk is MOST concerning from a cybersecurity perspective?

Question 9hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Question 10mediummultiple choice

Read the full Information Technology and Security explanation →

A company is migrating critical applications to the cloud. The risk manager is assessing the shared responsibility model. Which risk is the customer typically responsible for?

Question 11easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of an IT risk management programme that documents identified risks, their likelihood, and impact?

Question 12mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is considering cyber insurance to transfer residual risk. Which factor would MOST significantly influence the premium?

Question 13mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is integrating the NIST Cybersecurity Framework with the organization's risk management processes. Which TWO functions of the NIST CSF directly support risk assessment?

Question 14hardmulti select

Read the full Information Technology and Security explanation →

A manufacturing company is evaluating the risks of connecting its OT network to the IT network. Which THREE risks are MOST significant due to IT/OT convergence?

Question 15mediummulti select

Read the full Information Technology and Security explanation →

An organization is planning to adopt post-quantum cryptography. Which TWO considerations are MOST important for migration planning?

Question 16easymultiple choice

Read the full Information Technology and Security explanation →

Which COBIT 2019 governance objective focuses on ensuring that the enterprise's risk appetite and tolerance are understood, articulated, and communicated, and that risk is managed appropriately?

Question 17mediummultiple choice

Read the full Information Technology and Security explanation →

A risk practitioner is designing an IT risk management programme. Which of the following is the BEST sequence of components to establish?

Question 18hardmultiple choice

Read the full Information Technology and Security explanation →

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Question 19mediummultiple choice

Read the full Information Technology and Security explanation →

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Question 20easymultiple choice

Read the full Information Technology and Security explanation →

When assessing cloud computing risk, which of the following is a key concern related to data sovereignty?

Question 21mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is adopting machine learning for credit scoring decisions. Which of the following risks is MOST critical from a regulatory compliance perspective?

Question 22hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is evaluating the risk of quantum computing for the organization's encryption. The organization uses RSA-2048 for data encryption. What is the PRIMARY consideration in planning for post-quantum cryptography migration?

Question 23mediummultiple choice

Read the full Information Technology and Security explanation →

According to the NIST Cybersecurity Framework, which function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Question 24hardmultiple choice

Read the full Information Technology and Security explanation →

An organization uses the FAIR (Factor Analysis of Information Risk) model to quantify cyber risk. Which of the following is the correct definition of 'Loss Magnitude' in the FAIR model?

Question 25easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a common exclusion in cyber insurance policies that a risk manager should be aware of?

Question 26mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. Which of the following is the PRIMARY risk introduced by this IT/OT convergence?

Question 27mediummultiple choice

Read the full Information Technology and Security explanation →

Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?

Question 28mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is evaluating the risks associated with using a public cloud provider. Which TWO of the following are key considerations for multi-tenancy isolation? (Select TWO.)

Question 29hardmulti select

Read the full Information Technology and Security explanation →

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Question 30easymulti select

Read the full Information Technology and Security explanation →

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Question 31mediummultiple choice

Read the full Information Technology and Security explanation →

A company is implementing COBIT 2019 and wants to ensure that risk management activities are aligned with business objectives. Which governance objective is primarily responsible for evaluating, directing, and monitoring risk management?

Question 32mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is designing an IT risk management programme. Which of the following is the most critical component to ensure consistent identification and assessment of risks across the enterprise?

Question 33hardmultiple choice

Read the full Information Technology and Security explanation →

A financial institution is adopting a cloud-based analytics platform. The data includes sensitive customer information subject to multiple jurisdictions' data residency laws. Which of the following poses the greatest compliance risk?

Question 34easymultiple choice

Read the full Information Technology and Security explanation →

In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Question 35mediummultiple choice

Read the full Information Technology and Security explanation →

An architecture review board (ARB) is evaluating a new solution architecture that processes sensitive data. Which of the following should the ARB review to ensure security risks are addressed before implementation?

Question 36mediummultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. What is the most significant risk arising from this IT/OT convergence?

Question 37hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?

Question 38easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a primary concern when using AI/ML models for decisions subject to regulatory oversight?

Question 39mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is evaluating cyber insurance to mitigate financial risk from potential data breaches. Which factor would most likely increase the insurance premium?

Question 40hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility must comply with NERC CIP standards. Which of the following is a key requirement under these standards?

Question 41easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a characteristic of IoT devices that increases cybersecurity risk?

Question 42mediummultiple choice

Read the full Information Technology and Security explanation →

A company is planning to migrate to post-quantum cryptography. What is the primary risk that quantum computing poses to current cryptographic systems?

Question 43mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is integrating risk management with IT governance. Which of the following are key elements of an IT risk management programme design? (Choose TWO.)

Question 44hardmulti select

Read the full Information Technology and Security explanation →

An organization is deploying IoT devices in a smart building. Which of the following are significant security risks associated with IoT? (Choose THREE.)

Question 45easymulti select

Read the full Information Technology and Security explanation →

An organization is considering adopting the NIST Cybersecurity Framework to manage cybersecurity risk. Which of the following are core functions of the framework? (Choose TWO.)

Question 46easymultiple choice

Read the full Information Technology and Security explanation →

In the context of IT governance, which COBIT 2019 process is specifically focused on ensuring risk optimization?

Question 47mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is designing an IT risk management program. Which of the following should be the PRIMARY consideration when developing a risk register?

Question 48hardmultiple choice

Read the full Information Technology and Security explanation →

A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?

Question 49mediummultiple choice

Read the full Information Technology and Security explanation →

An organization's architecture review board (ARB) is evaluating a new solution architecture. What is the PRIMARY risk management role of the ARB in this context?

Question 50hardmultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?

Question 51easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Question 52mediummultiple choice

Read the full Information Technology and Security explanation →

A risk manager is using the FAIR model to quantify cyber risk. Which of the following inputs is MOST directly used to calculate probable financial loss?

Question 53hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility subject to NERC CIP standards is planning to deploy a new SCADA system. Which of the following requirements is MOST likely mandated by NERC CIP?

Question 54mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is evaluating cyber insurance options. Which of the following factors is MOST likely to influence the insurance premium?

Question 55easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a primary goal of the 'Protect' function in the NIST Cybersecurity Framework?

Question 56mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Question 57hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is assessing the potential impact of quantum computing on the organization's cryptographic infrastructure. What is the MOST immediate action the organization should take?

Question 58mediummulti select

Read the full Information Technology and Security explanation →

An organization is implementing an AI/ML model for credit approval decisions subject to regulatory oversight. Which TWO of the following are the most significant risk considerations?

Question 59hardmulti select

Read the full Information Technology and Security explanation →

A global company is moving its critical applications to a public cloud. Which THREE of the following are key risk considerations in the shared responsibility model?

Question 60mediummulti select

Read the full Information Technology and Security explanation →

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Question 61mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is implementing COBIT 2019 and the board has requested assurance that risk management activities are aligned with business objectives. Which governance objective is primarily focused on ensuring risk optimization through evaluation, direction, and monitoring?

Question 62easymultiple choice

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management program. Which document should serve as the primary source for defining the organization's approach to risk assessment, treatment, and reporting?

Question 63hardmultiple choice

Read the full Information Technology and Security explanation →

A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?

Question 64mediummultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?

Question 65easymultiple choice

Read the full Information Technology and Security explanation →

Which component of the NIST Cybersecurity Framework is primarily concerned with developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Question 66mediummultiple choice

Read the full Information Technology and Security explanation →

A risk practitioner is using the FAIR model to quantify cyber risk for a proposed new online payment system. Which factor must be estimated to calculate the probable financial impact of a data breach?

Question 67hardmultiple choice

Read the full Information Technology and Security explanation →

An organization is evaluating cyber insurance to cover potential losses from ransomware attacks. The insurer requires that the organization have multi-factor authentication (MFA) on all remote access systems. This requirement is an example of which factor influencing insurance premiums?

Question 68mediummultiple choice

Read the full Information Technology and Security explanation →

A bank is considering adopting artificial intelligence for credit scoring. The risk manager identifies that the AI model might produce biased outcomes against certain demographic groups. Which AI/ML risk is most directly associated with this concern?

Question 69mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is deploying a large number of Internet of Things (IoT) sensors for environmental monitoring in a remote facility. The sensors have limited processing power and cannot be patched easily. Which risk should the risk manager prioritize?

Question 70hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is assessing the impact of quantum computing on the organization's cryptographic infrastructure. The timeline for quantum advantage is estimated to be 10 years. What is the most appropriate immediate action to address this risk?

Question 71easymultiple choice

Read the full Information Technology and Security explanation →

Which enterprise architecture layer is most directly responsible for managing the storage and processing of data, and for which data classification and encryption controls are critical?

Question 72mediummultiple choice

Read the full Information Technology and Security explanation →

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Question 73mediummulti select

Read the full Information Technology and Security explanation →

An organization is reviewing its IT risk management program and identifies that the risk register is not being updated after project changes. Which TWO components of the risk management program are most likely deficient?

Question 74hardmulti select

Read the full Information Technology and Security explanation →

A financial services firm is migrating critical applications to a public cloud. The architecture review board (ARB) is evaluating the solution architecture. Which THREE risks should the ARB prioritize for review?

Question 75mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is evaluating the application of IEC 62443 for industrial control systems. Which THREE of the following are key security requirements addressed by this standard?

Question 76mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is developing a new cloud-based application that will process personal data of EU citizens. The risk manager is assessing the shared responsibility model with the cloud service provider (CSP). Which of the following is the MOST critical risk to address in the risk assessment?

Question 77mediummultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is integrating its operational technology (OT) network with the corporate IT network to enable real-time data analytics. Which of the following risks should be prioritized during the risk assessment?

Question 78hardmultiple choice

Read the full Information Technology and Security explanation →

The risk committee is reviewing a cyber risk quantification report that uses the FAIR model. The report estimates the annualized loss expectancy (ALE) for a ransomware attack as $2.5 million. The committee asks the risk manager to explain the key components used to derive this figure. Which of the following is the MOST important factor in the FAIR model for calculating ALE?

Question 79easymultiple choice

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management program. According to COBIT 2019, which governance objective is specifically focused on ensuring that risk management is optimized?

Question 80mediummultiple choice

Read the full Information Technology and Security explanation →

A financial institution is considering adopting a new AI/ML model for credit scoring. The model uses customer demographic data and transaction history. Which of the following risks is MOST likely to cause regulatory penalties if not addressed?

Question 81mediummultiple choice

Read the full Information Technology and Security explanation →

During the solution architecture review, the Architecture Review Board (ARB) identifies a security risk in a proposed cloud migration project. The solution relies on a single cloud region with no disaster recovery plan. Which of the following is the BEST recommendation to mitigate this risk?

Question 82hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Question 83easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is the PRIMARY purpose of a risk register in an IT risk management program?

Question 84mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?

Question 85hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is evaluating the potential impact of quantum computing on the organization's encryption infrastructure. The organization uses RSA-2048 for key exchanges and digital signatures. According to current quantum computing projections, what is the MOST urgent risk management action to take?

Question 86mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is deploying a large number of IoT sensors in a smart building project. The sensors are from multiple vendors and some have limited firmware update capabilities. Which of the following risks should be the PRIMARY concern for the risk manager?

Question 87easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of an IT risk management programme design?

Question 88mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is assessing the risks of an IT/OT convergence project in a chemical plant. Which TWO of the following are the most significant security risks? (Select two.)

Question 89mediummulti select

Read the full Information Technology and Security explanation →

Which THREE of the following are key considerations when evaluating cyber insurance coverage? (Select three.)

Question 90hardmulti select

Read the full Information Technology and Security explanation →

An organization is implementing IEC 62443 for its industrial control systems. Which THREE of the following are key requirements of IEC 62443? (Select three.)

Question 91mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is implementing a new cloud-based CRM system. The risk manager is reviewing the solution architecture for security risks. Which architectural layer should be evaluated to ensure data encryption at rest and in transit?

Question 92hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Question 93easymultiple choice

Read the full Information Technology and Security explanation →

According to COBIT 2019, which governance objective is primarily concerned with evaluating, directing, and monitoring the management of IT risk?

Question 94mediummultiple choice

Read the full Information Technology and Security explanation →

A financial institution is evaluating cyber insurance to cover potential losses from a ransomware attack. Which factor is most likely to increase the insurance premium?

Question 95hardmultiple choice

Read the full Information Technology and Security explanation →

An organization uses AI/ML for credit scoring decisions. The risk manager is concerned about regulatory compliance if the model cannot explain its decisions. Which AI risk is most directly addressed by requiring explainability?

Question 96mediummultiple choice

Read the full Information Technology and Security explanation →

A company's risk management policy requires a risk register to be maintained. Which of the following is the primary purpose of a risk register?

Question 97easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of the NIST Cybersecurity Framework's Identify function?

Question 98mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is evaluating IoT device risks for a smart building project. Which TWO of the following are significant IoT security risks?

Question 99mediummulti select

Read the full Information Technology and Security explanation →

According to the FAIR model, which TWO of the following are primary components used to calculate probable financial impact of a cyber incident?

Question 100mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management programme. Which THREE of the following are essential components of a risk management policy?

Question 101hardmulti select

Read the full Information Technology and Security explanation →

An enterprise is migrating to a public cloud environment. Which THREE of the following are critical cloud-specific risk considerations?

Question 102hardmulti select

Read the full Information Technology and Security explanation →

A risk manager is assessing IT/OT convergence risks at a manufacturing plant. Which TWO of the following are primary risks introduced by connecting industrial control systems to the corporate network?

Question 103easymulti select

Read the full Information Technology and Security explanation →

Which TWO of the following are key functions of an Architecture Review Board (ARB) in managing risk?

Question 104mediummulti select

Read the full Information Technology and Security explanation →

Which THREE of the following are typical exclusions in a cyber insurance policy?

Question 105hardmulti select

Read the full Information Technology and Security explanation →

An organization is planning for post-quantum cryptography migration. Which THREE of the following are key considerations for this migration?

Question 1mediummultiple choice

Read the full Information Technology and Security explanation →

A large retail company is implementing a new cloud-based inventory management system. The system will store sensitive customer data and integrate with existing on-premises ERP. The risk manager is asked to identify the most critical risk to address in the shared responsibility model. Which risk is MOST likely to be overlooked?

Question 2hardmultiple choice

Read the full Information Technology and Security explanation →

An energy company is integrating its IT network with OT systems for real-time monitoring. The risk manager is assessing the expanded attack surface. Which risk should be given the HIGHEST priority due to its potential for physical consequences?

Question 3easymultiple choice

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management programme. Which document should be created FIRST to guide the overall approach to risk management?

Question 4mediummultiple choice

Read the full Information Technology and Security explanation →

A financial institution is adopting AI for credit scoring. The model is currently a black box and requires explainability for regulatory compliance. Which risk is MOST critical to address?

Question 5mediummultiple choice

Read the full Information Technology and Security explanation →

During a solution architecture review, the Architecture Review Board (ARB) identifies that a new application communicates with a legacy system using plain text over a public network. Which risk treatment option is MOST appropriate?

Question 6hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is calculating the probable financial impact of a ransomware attack using the FAIR model. Which factor is MOST critical to estimate the annual loss exposure?

Question 7easymultiple choice

Read the full Information Technology and Security explanation →

Which COBIT 2019 domain objective focuses on ensuring that risk is optimized through evaluation, direction, and monitoring?

Question 8mediummultiple choice

Read the full Information Technology and Security explanation →

A hospital is deploying IoT medical devices that connect to the network. Which risk is MOST concerning from a cybersecurity perspective?

Question 9hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Question 10mediummultiple choice

Read the full Information Technology and Security explanation →

A company is migrating critical applications to the cloud. The risk manager is assessing the shared responsibility model. Which risk is the customer typically responsible for?

Question 11easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of an IT risk management programme that documents identified risks, their likelihood, and impact?

Question 12mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is considering cyber insurance to transfer residual risk. Which factor would MOST significantly influence the premium?

Question 13mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is integrating the NIST Cybersecurity Framework with the organization's risk management processes. Which TWO functions of the NIST CSF directly support risk assessment?

Question 14hardmulti select

Read the full Information Technology and Security explanation →

A manufacturing company is evaluating the risks of connecting its OT network to the IT network. Which THREE risks are MOST significant due to IT/OT convergence?

Question 15mediummulti select

Read the full Information Technology and Security explanation →

An organization is planning to adopt post-quantum cryptography. Which TWO considerations are MOST important for migration planning?

Question 16easymultiple choice

Read the full Information Technology and Security explanation →

Which COBIT 2019 governance objective focuses on ensuring that the enterprise's risk appetite and tolerance are understood, articulated, and communicated, and that risk is managed appropriately?

Question 17mediummultiple choice

Read the full Information Technology and Security explanation →

A risk practitioner is designing an IT risk management programme. Which of the following is the BEST sequence of components to establish?

Question 18hardmultiple choice

Read the full Information Technology and Security explanation →

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Question 19mediummultiple choice

Read the full Information Technology and Security explanation →

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Question 20easymultiple choice

Read the full Information Technology and Security explanation →

When assessing cloud computing risk, which of the following is a key concern related to data sovereignty?

Question 21mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is adopting machine learning for credit scoring decisions. Which of the following risks is MOST critical from a regulatory compliance perspective?

Question 22hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is evaluating the risk of quantum computing for the organization's encryption. The organization uses RSA-2048 for data encryption. What is the PRIMARY consideration in planning for post-quantum cryptography migration?

Question 23mediummultiple choice

Read the full Information Technology and Security explanation →

According to the NIST Cybersecurity Framework, which function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Question 24hardmultiple choice

Read the full Information Technology and Security explanation →

An organization uses the FAIR (Factor Analysis of Information Risk) model to quantify cyber risk. Which of the following is the correct definition of 'Loss Magnitude' in the FAIR model?

Question 25easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a common exclusion in cyber insurance policies that a risk manager should be aware of?

Question 26mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. Which of the following is the PRIMARY risk introduced by this IT/OT convergence?

Question 27mediummultiple choice

Read the full Information Technology and Security explanation →

Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?

Question 28mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is evaluating the risks associated with using a public cloud provider. Which TWO of the following are key considerations for multi-tenancy isolation? (Select TWO.)

Question 29hardmulti select

Read the full Information Technology and Security explanation →

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Question 30easymulti select

Read the full Information Technology and Security explanation →

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Question 31mediummultiple choice

Read the full Information Technology and Security explanation →

A company is implementing COBIT 2019 and wants to ensure that risk management activities are aligned with business objectives. Which governance objective is primarily responsible for evaluating, directing, and monitoring risk management?

Question 32mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is designing an IT risk management programme. Which of the following is the most critical component to ensure consistent identification and assessment of risks across the enterprise?

Question 33hardmultiple choice

Read the full Information Technology and Security explanation →

A financial institution is adopting a cloud-based analytics platform. The data includes sensitive customer information subject to multiple jurisdictions' data residency laws. Which of the following poses the greatest compliance risk?

Question 34easymultiple choice

Read the full Information Technology and Security explanation →

In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Question 35mediummultiple choice

Read the full Information Technology and Security explanation →

An architecture review board (ARB) is evaluating a new solution architecture that processes sensitive data. Which of the following should the ARB review to ensure security risks are addressed before implementation?

Question 36mediummultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. What is the most significant risk arising from this IT/OT convergence?

Question 37hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?

Question 38easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a primary concern when using AI/ML models for decisions subject to regulatory oversight?

Question 39mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is evaluating cyber insurance to mitigate financial risk from potential data breaches. Which factor would most likely increase the insurance premium?

Question 40hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility must comply with NERC CIP standards. Which of the following is a key requirement under these standards?

Question 41easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a characteristic of IoT devices that increases cybersecurity risk?

Question 42mediummultiple choice

Read the full Information Technology and Security explanation →

A company is planning to migrate to post-quantum cryptography. What is the primary risk that quantum computing poses to current cryptographic systems?

Question 43mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is integrating risk management with IT governance. Which of the following are key elements of an IT risk management programme design? (Choose TWO.)

Question 44hardmulti select

Read the full Information Technology and Security explanation →

An organization is deploying IoT devices in a smart building. Which of the following are significant security risks associated with IoT? (Choose THREE.)

Question 45easymulti select

Read the full Information Technology and Security explanation →

An organization is considering adopting the NIST Cybersecurity Framework to manage cybersecurity risk. Which of the following are core functions of the framework? (Choose TWO.)

Question 46easymultiple choice

Read the full Information Technology and Security explanation →

In the context of IT governance, which COBIT 2019 process is specifically focused on ensuring risk optimization?

Question 47mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is designing an IT risk management program. Which of the following should be the PRIMARY consideration when developing a risk register?

Question 48hardmultiple choice

Read the full Information Technology and Security explanation →

A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?

Question 49mediummultiple choice

Read the full Information Technology and Security explanation →

An organization's architecture review board (ARB) is evaluating a new solution architecture. What is the PRIMARY risk management role of the ARB in this context?

Question 50hardmultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?

Question 51easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Question 52mediummultiple choice

Read the full Information Technology and Security explanation →

A risk manager is using the FAIR model to quantify cyber risk. Which of the following inputs is MOST directly used to calculate probable financial loss?

Question 53hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility subject to NERC CIP standards is planning to deploy a new SCADA system. Which of the following requirements is MOST likely mandated by NERC CIP?

Question 54mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is evaluating cyber insurance options. Which of the following factors is MOST likely to influence the insurance premium?

Question 55easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a primary goal of the 'Protect' function in the NIST Cybersecurity Framework?

Question 56mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Question 57hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is assessing the potential impact of quantum computing on the organization's cryptographic infrastructure. What is the MOST immediate action the organization should take?

Question 58mediummulti select

Read the full Information Technology and Security explanation →

An organization is implementing an AI/ML model for credit approval decisions subject to regulatory oversight. Which TWO of the following are the most significant risk considerations?

Question 59hardmulti select

Read the full Information Technology and Security explanation →

A global company is moving its critical applications to a public cloud. Which THREE of the following are key risk considerations in the shared responsibility model?

Question 60mediummulti select

Read the full Information Technology and Security explanation →

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Question 61mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is implementing COBIT 2019 and the board has requested assurance that risk management activities are aligned with business objectives. Which governance objective is primarily focused on ensuring risk optimization through evaluation, direction, and monitoring?

Question 62easymultiple choice

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management program. Which document should serve as the primary source for defining the organization's approach to risk assessment, treatment, and reporting?

Question 63hardmultiple choice

Read the full Information Technology and Security explanation →

A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?

Question 64mediummultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?

Question 65easymultiple choice

Read the full Information Technology and Security explanation →

Which component of the NIST Cybersecurity Framework is primarily concerned with developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Question 66mediummultiple choice

Read the full Information Technology and Security explanation →

A risk practitioner is using the FAIR model to quantify cyber risk for a proposed new online payment system. Which factor must be estimated to calculate the probable financial impact of a data breach?

Question 67hardmultiple choice

Read the full Information Technology and Security explanation →

An organization is evaluating cyber insurance to cover potential losses from ransomware attacks. The insurer requires that the organization have multi-factor authentication (MFA) on all remote access systems. This requirement is an example of which factor influencing insurance premiums?

Question 68mediummultiple choice

Read the full Information Technology and Security explanation →

A bank is considering adopting artificial intelligence for credit scoring. The risk manager identifies that the AI model might produce biased outcomes against certain demographic groups. Which AI/ML risk is most directly associated with this concern?

Question 69mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is deploying a large number of Internet of Things (IoT) sensors for environmental monitoring in a remote facility. The sensors have limited processing power and cannot be patched easily. Which risk should the risk manager prioritize?

Question 70hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is assessing the impact of quantum computing on the organization's cryptographic infrastructure. The timeline for quantum advantage is estimated to be 10 years. What is the most appropriate immediate action to address this risk?

Question 71easymultiple choice

Read the full Information Technology and Security explanation →

Which enterprise architecture layer is most directly responsible for managing the storage and processing of data, and for which data classification and encryption controls are critical?

Question 72mediummultiple choice

Read the full Information Technology and Security explanation →

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Question 73mediummulti select

Read the full Information Technology and Security explanation →

An organization is reviewing its IT risk management program and identifies that the risk register is not being updated after project changes. Which TWO components of the risk management program are most likely deficient?

Question 74hardmulti select

Read the full Information Technology and Security explanation →

A financial services firm is migrating critical applications to a public cloud. The architecture review board (ARB) is evaluating the solution architecture. Which THREE risks should the ARB prioritize for review?

Question 75mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is evaluating the application of IEC 62443 for industrial control systems. Which THREE of the following are key security requirements addressed by this standard?

Question 76mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is developing a new cloud-based application that will process personal data of EU citizens. The risk manager is assessing the shared responsibility model with the cloud service provider (CSP). Which of the following is the MOST critical risk to address in the risk assessment?

Question 77mediummultiple choice

Read the full Information Technology and Security explanation →

A manufacturing company is integrating its operational technology (OT) network with the corporate IT network to enable real-time data analytics. Which of the following risks should be prioritized during the risk assessment?

Question 78hardmultiple choice

Read the full Information Technology and Security explanation →

The risk committee is reviewing a cyber risk quantification report that uses the FAIR model. The report estimates the annualized loss expectancy (ALE) for a ransomware attack as $2.5 million. The committee asks the risk manager to explain the key components used to derive this figure. Which of the following is the MOST important factor in the FAIR model for calculating ALE?

Question 79easymultiple choice

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management program. According to COBIT 2019, which governance objective is specifically focused on ensuring that risk management is optimized?

Question 80mediummultiple choice

Read the full Information Technology and Security explanation →

A financial institution is considering adopting a new AI/ML model for credit scoring. The model uses customer demographic data and transaction history. Which of the following risks is MOST likely to cause regulatory penalties if not addressed?

Question 81mediummultiple choice

Read the full Information Technology and Security explanation →

During the solution architecture review, the Architecture Review Board (ARB) identifies a security risk in a proposed cloud migration project. The solution relies on a single cloud region with no disaster recovery plan. Which of the following is the BEST recommendation to mitigate this risk?

Question 82hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Question 83easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is the PRIMARY purpose of a risk register in an IT risk management program?

Question 84mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?

Question 85hardmultiple choice

Read the full Information Technology and Security explanation →

A risk manager is evaluating the potential impact of quantum computing on the organization's encryption infrastructure. The organization uses RSA-2048 for key exchanges and digital signatures. According to current quantum computing projections, what is the MOST urgent risk management action to take?

Question 86mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is deploying a large number of IoT sensors in a smart building project. The sensors are from multiple vendors and some have limited firmware update capabilities. Which of the following risks should be the PRIMARY concern for the risk manager?

Question 87easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of an IT risk management programme design?

Question 88mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is assessing the risks of an IT/OT convergence project in a chemical plant. Which TWO of the following are the most significant security risks? (Select two.)

Question 89mediummulti select

Read the full Information Technology and Security explanation →

Which THREE of the following are key considerations when evaluating cyber insurance coverage? (Select three.)

Question 90hardmulti select

Read the full Information Technology and Security explanation →

An organization is implementing IEC 62443 for its industrial control systems. Which THREE of the following are key requirements of IEC 62443? (Select three.)

Question 91mediummultiple choice

Read the full Information Technology and Security explanation →

An organization is implementing a new cloud-based CRM system. The risk manager is reviewing the solution architecture for security risks. Which architectural layer should be evaluated to ensure data encryption at rest and in transit?

Question 92hardmultiple choice

Read the full Information Technology and Security explanation →

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Question 93easymultiple choice

Read the full Information Technology and Security explanation →

According to COBIT 2019, which governance objective is primarily concerned with evaluating, directing, and monitoring the management of IT risk?

Question 94mediummultiple choice

Read the full Information Technology and Security explanation →

A financial institution is evaluating cyber insurance to cover potential losses from a ransomware attack. Which factor is most likely to increase the insurance premium?

Question 95hardmultiple choice

Read the full Information Technology and Security explanation →

An organization uses AI/ML for credit scoring decisions. The risk manager is concerned about regulatory compliance if the model cannot explain its decisions. Which AI risk is most directly addressed by requiring explainability?

Question 96mediummultiple choice

Read the full Information Technology and Security explanation →

A company's risk management policy requires a risk register to be maintained. Which of the following is the primary purpose of a risk register?

Question 97easymultiple choice

Read the full Information Technology and Security explanation →

Which of the following is a key component of the NIST Cybersecurity Framework's Identify function?

Question 98mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is evaluating IoT device risks for a smart building project. Which TWO of the following are significant IoT security risks?

Question 99mediummulti select

Read the full Information Technology and Security explanation →

According to the FAIR model, which TWO of the following are primary components used to calculate probable financial impact of a cyber incident?

Question 100mediummulti select

Read the full Information Technology and Security explanation →

A risk manager is designing an IT risk management programme. Which THREE of the following are essential components of a risk management policy?

Question 101hardmulti select

Read the full Information Technology and Security explanation →

An enterprise is migrating to a public cloud environment. Which THREE of the following are critical cloud-specific risk considerations?

Question 102hardmulti select

Read the full Information Technology and Security explanation →

A risk manager is assessing IT/OT convergence risks at a manufacturing plant. Which TWO of the following are primary risks introduced by connecting industrial control systems to the corporate network?

Question 103easymulti select

Read the full Information Technology and Security explanation →

Which TWO of the following are key functions of an Architecture Review Board (ARB) in managing risk?

Question 104mediummulti select

Read the full Information Technology and Security explanation →

Which THREE of the following are typical exclusions in a cyber insurance policy?

Question 105hardmulti select

Read the full Information Technology and Security explanation →