CRISC Information Technology and Security Practice Test 11 — 15 Questions

Question 1

A risk manager is assessing the security posture of a containerized application deployment in a public cloud. The organization uses Kubernetes for orchestration. Which TWO of the following are the MOST significant risks specific to this environment? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Container images may contain vulnerable dependencies that are not patched regularly.. The most significant risks are vulnerable container images and unencrypted Kubernetes secrets in etcd. Vulnerable images can introduce exploitable flaws, while unencrypted secrets can be read by attackers with etcd access. Both are specific to containerized Kubernetes environments and require proactive controls such as image scanning and etcd encryption. The other options describe misconceptions or false assumptions that do not represent the primary risks.

Answer

Container orchestration platforms automatically enforce network segmentation, eliminating the risk of lateral movement.

Answer

The cloud provider's shared responsibility model means the organization is not responsible for the security of the underlying nodes.

Answer

Kubernetes RBAC is enabled by default and cannot be misconfigured, so access control risks are minimal.

Question 2

A bank is adopting a third-party API gateway to expose account balance services to fintech partners. The risk practitioner must ensure that a partner's excessive or unusual API consumption cannot degrade service for other partners or core banking systems. Which control is MOST appropriate to address this risk?

Accepted Answer

Implement per-partner rate limiting and quotas at the API gateway, with circuit breakers to shed load before core systems are affected.. The risk is availability degradation caused by disproportionate consumption from one partner. Enforcing per-partner rate limits and quotas at the gateway constrains each consumer, and circuit breakers prevent overload from propagating into core banking. Contractual caps, mutual TLS and response encryption address expectations, authentication and confidentiality respectively, none of which stop a single partner from exhausting shared capacity.

Answer

Encrypt account balance responses with a format-preserving encryption scheme before returning them.

Answer

Require all partners to sign a service level agreement specifying maximum transaction volumes.

Answer

Enforce mutual TLS between partners and the API gateway for all balance requests.

Question 3

A risk practitioner at a healthcare insurer is mapping the organization's IT risk register to the NIST Cybersecurity Framework (CSF) 2.0. Executive leadership wants assurance that the organization understands which assets and business processes depend on which systems before any risk treatment decisions are made. Which CSF 2.0 function and category BEST addresses this requirement?

Accepted Answer

IDENTIFY (ID) — Asset Management (ID.AM). The insurer needs to know which systems support which business processes before deciding on treatment, and that dependency mapping is the core purpose of the IDENTIFY function's Asset Management category. Governance sets direction, PROTECT enforces controls, and DETECT finds events, but none of those produces the asset-to-process inventory that leadership explicitly requested.

Answer

DETECT (DE) — Continuous Monitoring (DE.CM)

Answer

GOVERN (GV) — Risk Management Strategy (GV.RM)

Answer

PROTECT (PR) — Identity Management, Authentication, and Access Control (PR.AA)

Question 4

A risk practitioner is reviewing the organization's identity and access management (IAM) controls. The organization uses role-based access control (RBAC) but has experienced several incidents where employees retained access to systems after transferring to different departments. Which of the following is the MOST effective control to address this risk?

Accepted Answer

Integrate the HR system with the IAM system to automatically revoke old roles and grant new roles upon a change in employee status or department.. The root cause of the incidents is that access rights are not updated when employees change roles. The most effective control is to automate the synchronization of role changes from HR to the IAM system, ensuring timely revocation of old access and assignment of new access. This preventive control addresses the issue at the source and reduces reliance on periodic reviews.

Answer

Implement mandatory password rotation every 30 days for all users.

Answer

Conduct periodic user access reviews with managers certifying that their direct reports have appropriate access.

Answer

Require all employees to sign an acceptable use policy annually.

Question 5

An organization is implementing a bring your own device (BYOD) program. The risk practitioner is asked to identify the control that BEST reduces the risk of data leakage from lost or stolen mobile devices.

Accepted Answer

Implement mobile device management (MDM) with remote wipe and encryption enforcement.. The most effective way to reduce data leakage from lost or stolen BYOD devices is to enforce encryption and enable remote wipe through MDM. This ensures that even if the device is compromised, the data remains protected or can be erased. Other controls are helpful but do not provide the same direct technical mitigation.

Answer

Require complex passwords on all BYOD devices.

Answer

Conduct annual security awareness training for BYOD users.

Answer

Prohibit storing any corporate data on BYOD devices.

Question 6

A financial services firm is adopting a DevSecOps model. The risk practitioner wants to ensure that security risks are identified and addressed as early as possible in the software development lifecycle. Which of the following practices BEST supports this objective?

Accepted Answer

Integrating static application security testing (SAST) into the continuous integration pipeline.. Integrating SAST into the CI pipeline allows security checks to run automatically with every code commit, giving developers immediate feedback on vulnerabilities. This shifts security left, enabling fixes during development when they are cheapest and fastest to resolve. Other practices like penetration testing, training, and DAST are valuable but do not provide the same early, continuous, code-level risk detection.

Answer

Conducting a penetration test immediately before production deployment.

Answer

Requiring developers to complete annual secure coding training.

Answer

Performing dynamic application security testing (DAST) on a staging environment.

Question 7

A risk practitioner is evaluating the effectiveness of the organization's IT change management process. Which of the following metrics would BEST indicate that the process is effectively reducing risk?

Accepted Answer

Percentage of changes that are tested in a non-production environment before deployment.. The percentage of changes tested in a non-production environment is a leading indicator of effective change management. It shows that the organization is proactively identifying and mitigating risks before changes reach production. This directly reduces the likelihood of incidents caused by changes, making it the best metric for assessing risk reduction.

Answer

Number of changes implemented per month.

Answer

Percentage of changes that are rolled back due to failures.

Answer

Average time to implement a change.

Question 8

A risk practitioner is reviewing the organization's backup and recovery procedures for critical systems. The organization wants to ensure that backups are protected against ransomware attacks that could encrypt both production data and backups. Which of the following controls is MOST effective for this purpose?

Accepted Answer

Implementing immutable backups that cannot be altered or deleted for a set period.. Immutable backups are the most effective control because they cannot be altered or deleted for a set period, ensuring a clean recovery point even if ransomware compromises the network. Other controls like network access controls, encryption, or backup frequency do not prevent backups from being encrypted or deleted by ransomware.

Answer

Performing daily full backups instead of incremental backups.

Answer

Encrypting backups with a strong encryption algorithm.

Answer

Storing backups on the same network as production systems with access controls.

Question 9

A risk practitioner is evaluating the effectiveness of the organization's security awareness training program. The practitioner wants to determine whether the training is reducing the risk of phishing attacks. Which of the following metrics would be MOST indicative of the program's effectiveness?

Accepted Answer

The click-through rate on simulated phishing campaigns over time.. The click-through rate on simulated phishing campaigns is the most indicative metric because it directly measures employee behavior in response to phishing attempts. A declining click-through rate over time demonstrates that employees are learning to recognize and avoid phishing, which reduces the risk of successful attacks. Other metrics like completion rates or breach counts are either indirect or influenced by external factors.

Answer

The number of phishing emails reported by employees to the security team.

Answer

The percentage of employees who completed the annual security awareness training.

Answer

The number of phishing incidents that resulted in a data breach.

Question 10

A risk practitioner is reviewing the organization's identity and access management (IAM) controls. The identity team proposes implementing just-in-time (JIT) privileged access with automated approval workflows and session recording. Which risk is MOST effectively mitigated by this approach compared to standing privileged accounts?

Accepted Answer

The risk that unused or stale privileged accounts accumulate and are exploited by attackers or insiders.. Standing privileged accounts are a persistent target because they remain valid even when unused. Just-in-time provisioning eliminates standing entitlements, granting elevated rights only for an approved, time-bound session. This shrinks the attack surface, removes dormant accounts that attackers and insiders could exploit, and adds approval and recording as compensating detective controls.

Answer

The risk of a denial-of-service attack saturating the network perimeter during peak business hours.

Answer

The risk that database administrators can read sensitive data in production without leaving an audit trail.

Answer

The risk of credential stuffing attacks against the single sign-on portal used by all employees.

Question 11

A hospital's radiology department wants to let contracted teleradiologists read CT scans from home. The scans contain protected health information (PHI) and must remain within the hospital's HIPAA compliance boundary. The CIO asks the risk practitioner to recommend an access approach that minimizes the risk of PHI residing on unmanaged personal devices. Which of the following is the BEST recommendation?

Accepted Answer

Provide teleradiologists with virtual desktop infrastructure (VDI) sessions hosted in the hospital's data center, with local drive and clipboard redirection disabled.. Centralizing PHI in hospital-controlled infrastructure while presenting only a remote display is the most effective way to keep protected health information off unmanaged endpoints. Virtual desktop infrastructure with drive and clipboard redirection disabled preserves clinical workflow yet blocks the common exfiltration paths of copy, print, and local save. Endpoint-centric alternatives leave PHI resident outside the compliance boundary and are far harder to govern.

Answer

Issue each teleradiologist a hospital-owned laptop with full-disk encryption and require them to sign an acceptable use policy.

Answer

Publish the CT images to a password-protected cloud file-sharing folder and email time-limited download links to each teleradiologist.

Answer

Grant teleradiologists VPN access to the PACS and let them install the vendor's diagnostic viewer on their personal computers.

Question 12

A risk manager is evaluating the organization's vulnerability management program. The organization scans its external-facing systems weekly but has no process for prioritizing vulnerabilities based on business impact. Which of the following should the risk manager recommend as the MOST effective improvement?

Accepted Answer

Implement a risk-based vulnerability prioritization process that considers asset criticality, threat intelligence, and exploitability.. The program lacks a risk-based approach to prioritization. The most effective improvement is to implement a process that ranks vulnerabilities by the risk they pose, considering asset criticality, threat intelligence, and exploitability. This ensures that limited resources are directed to the most significant risks, aligning vulnerability management with business objectives.

Answer

Require all vulnerabilities to be remediated within 30 days regardless of severity to enforce a strict SLA.

Answer

Outsource vulnerability scanning to a third-party provider to gain access to more comprehensive threat data.

Answer

Increase the frequency of external scans to daily to catch vulnerabilities faster.

Question 13

A risk practitioner is assessing a proposed bring-your-own-device (BYOD) programme for a law firm where attorneys will access matter files containing privileged client data. The CISO asks which controls are MOST important to reduce the risk of data leakage from lost or compromised personal devices. (Choose two.)

Accepted Answer

Deploy mobile device management (MDM) with remote wipe and containerization of firm data.. The two controls that actually prevent privileged client data from being exposed when a personal device is lost or compromised are escrowed full-device encryption and MDM with remote wipe plus containerization. Together they protect data at rest and allow selective removal of firm data, while the other choices are policy, perimeter, or financial measures that do not stop the leakage scenario.

Answer

Require attorneys to sign an acceptable use policy acknowledging that personal devices may be inspected.

Answer

Block all access to matter files from outside the firm's office network by IP allowlisting.

Answer

Increase cyber insurance limits to cover regulatory fines from client data breaches.

Question 14

A risk practitioner is assessing the security of the organization's software development lifecycle (SDLC). The organization wants to integrate security controls to reduce the risk of introducing vulnerabilities into production. Which TWO of the following are the MOST effective preventive controls to implement during the development phase? (Choose two.)

Accepted Answer

Conduct static application security testing (SAST) on source code before code is merged into the main branch.. The most effective preventive controls during development are those that stop vulnerabilities from being introduced in the first place. Static application security testing (SAST) analyzes code before it is merged, catching flaws early. Secure coding training and standards give developers the skills to write safer code. Both are proactive measures integrated into the development phase, unlike DAST, WAF, or penetration testing, which are detective or perimeter controls applied later.

Answer

Implement a web application firewall (WAF) in front of the production application to block malicious traffic.

Answer

Perform dynamic application security testing (DAST) on applications in the production environment after deployment.

Answer

Conduct a penetration test on the application after it is deployed to production.

Question 15

A risk practitioner is evaluating the organization's vulnerability management programme. The organization scans its internal network weekly, but the CIO is concerned that critical internet-facing services are not adequately covered. Which TWO of the following changes would MOST improve the identification of exploitable vulnerabilities on externally exposed assets? (Choose two.)

Accepted Answer

Implement continuous external attack surface scanning that includes discovery of unknown internet-facing assets.. Improving identification of exploitable vulnerabilities on internet-facing services requires seeing the full external attack surface and knowing which findings matter. Continuous external attack surface scanning discovers and inventories exposed assets, including unknown ones, while threat intelligence correlation prioritizes vulnerabilities that attackers are actively exploiting, focusing remediation where it reduces real risk.

Answer

Require business units to self-attest quarterly that their internet-facing applications have no known vulnerabilities.

Answer

Deploy a web application firewall (WAF) in front of all internet-facing applications and enable blocking mode.

Answer

Increase the frequency of credentialed internal vulnerability scans from weekly to daily.