CRISC Information Technology and Security Practice Test 2 — 15 Questions

Question 1

A risk manager is evaluating the security of a new API gateway that will expose internal microservices to external partners. The gateway will use OAuth 2.0 for authorization. Which of the following is the MOST critical risk to assess regarding the OAuth 2.0 implementation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authorization server may issue access tokens with excessive scopes or long expiration times, leading to privilege escalation if a token is compromised.. The most critical risk is that the authorization server may issue access tokens with excessive scopes or long expiration times. This can lead to privilege escalation if a token is compromised, as the attacker gains broader access for a longer duration. Proper scope and lifetime management is a fundamental OAuth 2.0 security control. Other risks, while valid, are either not OAuth-specific or have a narrower impact.

Answer

The gateway may log sensitive data in plaintext, including access tokens, which could be exposed in log files.

Answer

The gateway may not validate the 'aud' (audience) claim in the access token, allowing tokens intended for other services to be replayed.

Answer

The API gateway may not support mutual TLS (mTLS) for client authentication, allowing unauthorized clients to connect.

Question 2

A risk practitioner is evaluating the security of an organization's software development lifecycle. The organization uses a CI/CD pipeline with automated deployments. Which of the following is the MOST effective control to reduce the risk of vulnerable code reaching production?

Accepted Answer

Software composition analysis (SCA) with automated blocking of builds containing critical known vulnerabilities.. The greatest risk in a CI/CD pipeline is that known vulnerable third-party components are automatically built and deployed. Software composition analysis integrated as a blocking quality gate directly addresses that risk by identifying and preventing such components from reaching production. Other controls are useful but do not provide the same automated, dependency-focused protection.

Answer

Mandatory peer code review before merging pull requests.

Answer

Static application security testing (SAST) integrated into the pipeline as a quality gate.

Answer

Annual secure coding training for all developers.

Question 3

A risk manager is reviewing the organization's backup strategy for a critical database. The current strategy performs full backups weekly and differential backups daily, with no transaction log backups. The recovery point objective (RPO) is 4 hours. Which of the following is the MOST likely risk if a failure occurs 3 hours after the last differential backup?

Accepted Answer

The organization will lose up to 3 hours of data, which is within the RPO.. Differential backups capture all changes since the last full backup. The most recent differential was taken at some point, and any transactions after that are lost. A failure 3 hours after the last differential results in up to 3 hours of data loss, which is within the 4-hour RPO. Thus, the RPO is met, and the risk of data loss is acceptable. The other options either miscalculate the loss window or misunderstand differential backup restore requirements.

Answer

The organization will lose up to 24 hours of data, exceeding the RPO.

Answer

The organization will lose all data since the last full backup because differential backups cannot be restored without the full backup.

Answer

The organization will lose up to 4 hours of data, exactly meeting the RPO.

Question 4

A risk practitioner is assessing the security of a new web application that will process credit card payments. The organization must comply with PCI DSS. Which TWO of the following are core requirements of PCI DSS that directly apply to this scenario? (Choose two.)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks.. PCI DSS Requirements 1 and 4 are fundamental for protecting cardholder data in a web application. Requirement 1 ensures network segmentation and firewall protection, while Requirement 4 ensures encryption during transmission. Both are directly applicable to a payment-processing web application and are critical for preventing unauthorized access and data interception.

Answer

Implement a formal risk assessment process at least annually.

Answer

Restrict physical access to cardholder data.

Answer

Develop and maintain secure systems and applications.

Question 5

A risk practitioner is assessing the security of a new software-defined wide area network (SD-WAN) deployment that connects branch offices directly to cloud services. Which TWO of the following are the MOST significant risks introduced by this architecture? (Choose two.)

Accepted Answer

Loss of centralized traffic inspection and policy enforcement.. SD-WAN's direct internet breakout and use of multiple transport links create two major risks: traffic can bypass centralized security inspection, and security policies may be applied inconsistently across branches. These risks require compensating controls such as local firewalls, cloud security gateways, and centralized policy orchestration to maintain a consistent security posture.

Answer

Reduced network performance due to backhauling traffic to a central location.

Answer

Inability to prioritize real-time traffic such as voice over IP.

Answer

Increased complexity of managing encryption keys across branches.

Question 6

A risk practitioner is assessing the security of a new Internet of Things (IoT) deployment in a manufacturing plant. The deployment includes thousands of sensors that communicate over a wireless mesh network. Which TWO of the following are the MOST significant risks introduced by this IoT deployment? (Choose two.)

Accepted Answer

Inadequate physical security of the sensors allows tampering or theft.. The two most significant risks in this IoT deployment are inadequate physical security of sensors and limited computational resources preventing strong encryption. Physical tampering can lead to data manipulation or network access, while resource constraints often result in weak encryption, exposing data to interception. These directly affect the confidentiality and integrity of the IoT system, making them critical for risk management.

Answer

The wireless mesh network increases the attack surface for denial-of-service attacks.

Answer

Sensor data is transmitted in plaintext, violating data privacy regulations.

Answer

The large number of sensors overwhelms the organization's security monitoring tools.

Question 7

A risk practitioner is assessing the organization's backup and recovery capabilities for a critical financial application. The current backup schedule is daily full backups with a 24-hour recovery point objective (RPO) and a 12-hour recovery time objective (RTO). The business has now mandated an RPO of 1 hour and an RTO of 4 hours. Which change should the practitioner recommend FIRST?

Accepted Answer

Implement continuous data protection or transaction log shipping to achieve near-zero data loss.. The current daily full backup cannot meet a 1-hour RPO. Continuous data protection or transaction log shipping captures changes continuously, enabling recovery to within the last hour or less. This approach is more efficient than hourly full backups and supports faster recovery, helping achieve the 4-hour RTO. Hardware upgrades or further analysis do not directly close the RPO gap.

Answer

Perform a business impact analysis to confirm the new RPO and RTO requirements.

Answer

Increase the frequency of full backups to every hour.

Answer

Upgrade the backup server hardware to reduce backup and restore times.

Question 8

A risk practitioner is assessing the security of a new web application that uses OAuth 2.0 for authorization. The application allows users to grant third-party applications access to their resources. Which TWO of the following are the MOST critical risks to evaluate in this scenario? (Choose two.)

Accepted Answer

Lack of refresh token rotation enabling long-term unauthorized access if a token is stolen.. The most critical risks are insufficient scope validation and lack of refresh token rotation. Scope validation ensures third-party apps only get the permissions they need, reducing the blast radius of a compromise. Refresh token rotation limits the lifetime of stolen tokens, preventing long-term unauthorized access. Together, they address the core security concerns of delegated authorization in OAuth 2.0.

Answer

Use of the implicit grant flow, which exposes access tokens in the URL fragment.

Answer

Failure to use JSON Web Tokens (JWT) for access tokens, relying on opaque tokens instead.

Answer

Absence of mutual TLS (mTLS) between the client and the authorization server.

Question 9

A risk practitioner is reviewing the organization's backup strategy for a critical database. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which of the following backup approaches BEST meets these objectives?

Accepted Answer

Daily full backups with transaction log backups every 15 minutes.. To meet a 15-minute RPO, the organization must capture data changes at least every 15 minutes. Daily full backups with transaction log backups every 15 minutes achieve this by allowing point-in-time recovery. The 2-hour RTO requires that restoration from the full backup and log replay can be completed within that window, which is feasible with proper planning and testing.

Answer

Snapshot-based backups taken every 4 hours.

Answer

Weekly full backups with differential backups every 6 hours.

Answer

Continuous data protection (CDP) with asynchronous replication to a remote site.

Question 10

A multinational corporation is developing a Bring Your Own Device (BYOD) policy. The risk practitioner is concerned about data leakage from lost or stolen mobile devices. Which of the following controls is MOST effective in mitigating this risk?

Accepted Answer

Enforce full-device encryption and remote wipe capabilities.. Full-device encryption and remote wipe are the most effective technical controls against data leakage from lost or stolen devices. Encryption ensures confidentiality of data at rest, and remote wipe enables removal of corporate data if the device is lost. These controls directly address the risk scenario and are considered best practices for BYOD.

Answer

Implement mobile device management (MDM) with application sandboxing.

Answer

Prohibit the storage of corporate data on mobile devices.

Answer

Require complex passwords and periodic changes.

Question 11

A risk practitioner is reviewing the organization's identity and access management (IAM) programme after an audit noted excessive standing privileges. The CISO asks which controls would MOST directly reduce the risk of credential misuse by insiders. (Choose two.)

Accepted Answer

Implement just-in-time (JIT) privileged access that grants elevated rights only for an approved, time-bound window.. Excessive standing privileges are reduced by making elevation temporary and by periodically validating that entitlements remain justified. Just-in-time access removes always-on rights, and recertification prunes accumulated permissions, together shrinking both the window and the breadth of potential insider misuse. Controls such as MFA, hardening, and monitoring strengthen adjacent layers but leave permanently valid privileged access in place.

Answer

Deploy privileged access workstations (PAWs) that are hardened and dedicated solely to administrative tasks.

Answer

Enable session recording and keystroke logging for all privileged sessions.

Answer

Enforce multi-factor authentication for all administrative logins to the identity provider.

Question 12

A large retail company is implementing a new cloud-based inventory management system. The system will store sensitive customer data and integrate with existing on-premises ERP. The risk manager is asked to identify the most critical risk to address in the shared responsibility model. Which risk is MOST likely to be overlooked?

Accepted Answer

Misconfiguration of access controls. In the shared responsibility model, the cloud provider secures the infrastructure (security OF the cloud), while the customer is responsible for securing what they put IN the cloud—including access controls, identity management, and configuration of their own applications and data. Misconfiguration of access controls is the most commonly overlooked risk because organizations often assume the provider handles all security, leading to overly permissive IAM roles, exposed storage buckets, or weak authentication. This risk is directly under the customer's control and is a leading cause of cloud data breaches, making it the most critical to address.

Answer

Vendor lock-in

Answer

Multi-tenancy isolation

Answer

Data sovereignty compliance

Question 13

An energy company is integrating its IT network with OT systems for real-time monitoring. The risk manager is assessing the expanded attack surface. Which risk should be given the HIGHEST priority due to its potential for physical consequences?

Accepted Answer

Manipulation of operational parameters leading to equipment damage. When IT and OT networks are integrated, the highest-priority risk is one with physical consequences. Manipulation of operational parameters (e.g., changing setpoints, valve positions, or PLC logic) can directly cause equipment damage, safety incidents, or environmental harm — consequences unique to OT environments. This makes it the top priority because the potential for physical impact elevates severity beyond typical IT risks.

Answer

Increased number of malware infections

Answer

Unauthorized access to corporate financial systems

Answer

Denial of service affecting IT services

Question 14

A risk manager is designing an IT risk management programme. Which document should be created FIRST to guide the overall approach to risk management?

Accepted Answer

Risk management policy. A risk management policy establishes the principles, objectives, and responsibilities for risk management, providing a foundation for all other risk management activities.

Answer

Risk treatment plan

Answer

Risk register

Answer

Risk assessment methodology

Question 15

A financial institution is adopting AI for credit scoring. The model is currently a black box and requires explainability for regulatory compliance. Which risk is MOST critical to address?

Accepted Answer

Lack of explainability. When a model is a black box and regulatory compliance requires explainability, the most critical risk is the lack of explainability itself — without it, the institution cannot justify credit decisions to regulators, customers, or auditors, and may violate fair lending laws (e.g., ECOA, GDPR Article 22). Explainability is the gating requirement here; bias, adversarial attacks, and data privacy are real risks but secondary to the stated compliance driver. Addressing explainability often also surfaces and mitigates bias.

Answer

Model bias

Answer

Adversarial attacks

Answer

Data privacy in training