CRISC Information Technology and Security Practice Test 10 — 15 Questions

Question 1

A risk practitioner is reviewing the organization's identity and access management (IAM) processes. The organization wants to reduce the risk of excessive access rights for employees who change roles internally. Which of the following controls is MOST effective for this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automating role-based access revocation and provisioning upon HR role changes.. The most effective control to reduce excessive access rights from internal role changes is automated role-based access revocation and provisioning triggered by HR events. This ensures immediate removal of old access and assignment of new access, directly addressing the risk. Other controls like vacation policies, periodic reviews, or database-level least privilege are either indirect or incomplete.

Answer

Enforcing least privilege at the database level only.

Answer

Implementing mandatory vacation policies for all employees.

Answer

Conducting periodic user access reviews by managers.

Question 2

A risk analyst is reviewing the organization's identity and access management (IAM) processes after a recent audit finding. The finding states that terminated employees retained active directory accounts for up to 30 days. Which control should the analyst recommend to BEST address this risk?

Accepted Answer

Implement automated deprovisioning integrated with the HR system to disable accounts immediately upon termination.. The audit finding highlights a delay between termination and account disablement, creating a window for unauthorized access. An automated deprovisioning process integrated with the HR system is the most effective preventive control because it removes human latency and ensures accounts are disabled immediately upon termination. Manual tickets and periodic reviews are detective or delayed, and password expiration does not deactivate accounts.

Answer

Require managers to submit a ticket to the IT help desk within 24 hours of an employee's termination.

Answer

Enforce mandatory password changes every 30 days for all employees, including terminated ones.

Answer

Conduct quarterly access reviews to identify and disable accounts of terminated employees.

Question 3

A risk practitioner is reviewing the organization's identity and access management (IAM) processes. The organization wants to reduce the risk of excessive access rights for employees who change roles internally. Which of the following controls is MOST effective for this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define and enforce a cryptoperiod for each key type with scheduled rotation and retirement.. Protecting keys across their lifecycle requires both a secure execution and storage environment and disciplined lifecycle governance. Hardware security modules or managed vaults keep key material confidential and enforce access, while a defined cryptoperiod with rotation and retirement limits how much data any single key protects. Email distribution of backups, shared master keys across environments, and custodian documentation do not provide these protections.

Answer

Document key custodians in the configuration management database and review the list annually.

Answer

Use the same master key across all environments to simplify key management and reduce operational cost.

Answer

Email encrypted key backups to the security team's shared mailbox for disaster recovery availability.

Question 4

A multinational manufacturer is migrating its disaster recovery capability for a core ERP system from a warm standby data center to a cloud-based recovery service. The risk practitioner is validating the recovery design. Which TWO of the following should be validated to confirm the recovery time objective can realistically be met? (Choose two.)

Accepted Answer

Verify that automated failover orchestration and DNS redirection complete within the documented recovery time objective.. Validating a recovery time objective requires measuring the steps that consume restoration time and confirming the target environment can carry production load. Failover orchestration and DNS cutover are typically the longest sequential activities, and pre-provisioned capacity determines whether the restored service can actually run. Replication lag addresses data loss, while assurance reports and retention schedules address different objectives.

Answer

Confirm the actual data replication lag and whether it stays within the recovery point objective during peak transaction periods.

Answer

Confirm the backup retention schedule aligns with the organization's data classification policy.

Answer

Review the cloud provider's SOC 2 report to confirm its availability commitments.

Question 5

A financial services firm is deploying a new customer portal on a public cloud. The security team proposes using digital certificates to authenticate the portal to clients and sign sensitive transaction data. The risk manager must evaluate the residual risk after certificate deployment. Which of the following is the MOST significant residual risk related to the certificate lifecycle?

Accepted Answer

The certificate authority's root certificate might be compromised, allowing attackers to forge certificates.. A root certificate authority compromise is the most significant residual risk because it can invalidate the trust model for all certificates issued under that CA. Unlike internal control gaps or operational issues, this risk is external and can have widespread impact, including forged certificates for the organization's portal. Risk managers must consider third-party dependencies and the potential for cascading effects when evaluating residual risk.

Answer

The certificate's private key might be stored in a hardware security module (HSM) with weak access controls.

Answer

The certificate's public key algorithm might be deprecated, requiring reissuance.

Answer

Certificate revocation lists (CRLs) might become too large to distribute efficiently.

Question 6

A risk practitioner at a healthcare payer is reviewing the organization's disaster recovery (DR) strategy for its core claims adjudication system. The business owner has stated that the maximum tolerable downtime is 4 hours, but the current DR plan relies on restoring from nightly tape backups, which would take at least 30 hours. Which of the following is the MOST appropriate action for the risk practitioner to take FIRST?

Accepted Answer

Document the gap between the recovery time objective and the achievable recovery time, and escalate it to the business owner and IT leadership for a risk decision.. The core issue is a mismatch between the business-required recovery time objective and what the current DR strategy can deliver. The risk practitioner must first document and escalate this gap so the business owner can make an informed risk decision. Directly purchasing technology or rewriting the objective without approval would circumvent governance.

Answer

Perform a full business impact analysis to determine whether the 4-hour maximum tolerable downtime is still valid.

Answer

Update the DR plan to state that the recovery time objective is 30 hours, because that is what the current infrastructure can achieve.

Answer

Immediately purchase a real-time replication solution to meet the 4-hour requirement and inform the business owner after implementation.

Question 7

A financial services firm is migrating its customer relationship management (CRM) system to a SaaS provider. The risk practitioner must assess the provider's security posture. Which of the following is the MOST reliable source of assurance?

Accepted Answer

A SOC 2 Type II report covering the relevant trust services criteria.. For a SaaS provider handling customer data, the most reliable assurance comes from an independent audit of controls over time. A SOC 2 Type II report provides exactly that, covering relevant trust services criteria. Other sources are either self-reported, point-in-time, or not designed for comprehensive risk assessment.

Answer

The provider's marketing materials and security whitepaper.

Answer

The provider's completed self-assessment questionnaire.

Answer

A penetration test report the provider commissioned last year.

Question 8

A risk analyst is assessing the risk of a legacy application that stores customer data in plaintext. The application is scheduled for decommissioning in 18 months, but until then it must remain operational. Which of the following is the BEST risk response?

Accepted Answer

Implement database encryption at rest and in transit for the legacy application as a compensating control until decommissioning.. Implementing encryption at rest and in transit is the best risk response because it directly mitigates the risk of plaintext data exposure. It acts as a compensating control that can be applied without major changes to the legacy application, protecting sensitive data until decommissioning. This approach balances risk reduction with operational continuity, unlike acceptance, transfer, or avoidance which either leave the risk or disrupt business.

Answer

Accept the risk because the application will be decommissioned soon and the cost of encryption is not justified.

Answer

Transfer the risk by purchasing cyber insurance to cover potential data breach costs.

Answer

Avoid the risk by immediately shutting down the legacy application, even if it disrupts business operations.

Question 9

A risk manager is evaluating the security of a new API gateway that will expose internal microservices to external partners. The gateway will handle authentication, rate limiting, and request routing. Which risk is MOST critical to address before go-live?

Accepted Answer

Weak authentication and authorization mechanisms that could allow partners to access unauthorized microservices.. The API gateway is the security boundary for external partners. Weak authentication and authorization could allow unauthorized access to internal microservices, directly threatening data confidentiality and integrity. While logging, rate limiting, and internal TLS are important, they are secondary to ensuring that only authorized entities can reach the appropriate services. Addressing authentication and authorization first prevents the most severe impact.

Answer

Insufficient logging of API requests, which could hinder forensic investigations.

Answer

Inadequate rate limiting that could allow denial-of-service attacks.

Answer

Lack of TLS encryption for internal traffic between the gateway and microservices.

Question 10

An organization is designing its identity and access management architecture. The risk practitioner wants to reduce the risk of credential theft leading to unauthorized access to critical systems. Which of the following is the MOST effective control to address this risk?

Accepted Answer

Deploy phishing-resistant multi-factor authentication using FIDO2 security keys for access to critical systems.. Credential theft defeats knowledge-based authentication regardless of password strength, so the strongest mitigation changes the authentication factor itself. Phishing-resistant FIDO2 authentication uses origin-bound public-key cryptography, meaning stolen passwords or relayed phishing sessions cannot authenticate. Complexity rules, lockout, and awareness training are useful supporting controls but do not break the theft-to-access path.

Answer

Enforce a password complexity policy requiring 14 characters with mixed character classes and 60-day expiration.

Answer

Require users to complete annual security awareness training covering password hygiene and social engineering.

Answer

Implement account lockout after five failed attempts and alert the service desk when lockouts occur.

Question 11

A healthcare organization is migrating its electronic health records (EHR) to a SaaS provider. The provider offers a standard contract with a 99.9% uptime SLA but no right to audit. The risk manager is concerned about data integrity and availability. Which of the following is the BEST risk response to address the lack of audit rights?

Accepted Answer

Negotiate a contract amendment to include audit rights or obtain independent third-party attestations such as SOC 2 Type II reports.. The best response is to obtain assurance through contractual audit rights or independent attestations like SOC 2 Type II. This directly addresses the lack of visibility into the provider's controls, which is critical for data integrity and compliance. Other options either accept the risk without assurance, implement costly redundancies that do not solve the problem, or transfer financial risk without addressing the control gap.

Answer

Transfer the risk by purchasing cyber insurance that covers data breaches at the SaaS provider.

Answer

Implement a redundant on-premises EHR system to mitigate the risk of provider failure.

Answer

Accept the risk because the SLA guarantees uptime and the provider is reputable.

Question 12

A software company allows developers to push code directly to production using a CI/CD pipeline. A recent post-incident review found that a developer's compromised credentials were used to deploy malicious code that exfiltrated customer data. Which control would MOST effectively reduce the risk of this specific attack path recurring?

Accepted Answer

Require multi-factor authentication for all developer accounts and enforce short-lived deployment tokens scoped to individual pipelines.. The incident path was a stolen credential granting deployment rights. Strengthening authentication with multi-factor authentication and constraining deployment tokens to short-lived, pipeline-scoped values removes both the sufficiency of a password and the blast radius of a captured token. Scanning, logging and training are valuable controls but do not close the authentication and authorization gap that enabled this specific attack.

Answer

Increase logging and alerting on production deployments and review alerts weekly.

Answer

Require developers to complete annual secure coding training and sign an acceptable use policy.

Answer

Implement static application security testing in the pipeline to scan code before deployment.

Question 13

A risk manager at a multinational bank is assessing the risk of a new third-party SaaS provider that will process customer transaction data. The provider stores data in a country with different data protection laws. Which of the following is the MOST critical risk factor to evaluate FIRST?

Accepted Answer

The legal and regulatory requirements for cross-border data transfers and the provider's compliance with them.. Cross-border data transfers introduce legal and regulatory risks that can override operational and financial considerations. The bank must first determine whether the transfer is lawful under applicable data protection laws and whether the provider meets those requirements. Technical controls and SLAs are important but secondary to the fundamental question of legality.

Answer

The provider's financial stability and ability to remain in business for the contract duration.

Answer

The provider's service level agreements and uptime guarantees for transaction processing.

Answer

The technical security controls implemented by the provider, such as encryption and access management.

Question 14

A risk practitioner is assessing the security of an organization's use of public cloud infrastructure. The organization stores sensitive data in object storage buckets. Which TWO of the following are the MOST significant risks related to misconfigured cloud storage? (Choose two.)

Accepted Answer

Insufficient logging and monitoring of access to bucket objects.. Misconfigured cloud storage most often results in data exposure through overly permissive access policies and goes unnoticed due to insufficient logging and monitoring. These two risks directly affect confidentiality and the ability to detect and respond to incidents. Other options are either less directly related to misconfiguration or are not security risks in the same sense.

Answer

Use of a single cloud region for data residency.

Answer

Inability to export data due to vendor lock-in.

Answer

Lack of encryption at rest for stored objects.

Question 15

An organization is migrating its customer relationship management (CRM) system to a SaaS provider. The vendor's audit report shows a SOC 2 Type II opinion with no exceptions, but the report's period ended eight months ago. The risk practitioner must assess whether the residual risk is acceptable. Which action BEST addresses the gap in assurance?

Accepted Answer

Request a bridge letter or gap letter covering the period since the report ended and review the vendor's remediation of any changes.. SOC 2 Type II reports are point-in-time documents that cover only the stated audit period. When the report is stale, the risk practitioner needs evidence of controls during the gap. A bridge or gap letter is the standard mechanism for that period, supplemented by review of changes and incidents, allowing an informed residual risk determination.

Answer

Perform a penetration test against the SaaS provider's production environment to validate its controls directly.

Answer

Require the vendor to purchase cyber insurance and name the organization as an additional insured as a compensating control.

Answer

Accept the SOC 2 Type II report as sufficient evidence because it was issued by an independent CPA firm.