CRISC Information Technology and Security Practice Test 2 — 15 Questions

Question 1

Which COBIT 2019 governance objective focuses on ensuring that the enterprise's risk appetite and tolerance are understood, articulated, and communicated, and that risk is managed appropriately?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically designed to ensure that the enterprise's risk appetite and risk tolerance are defined, communicated, and understood, and that risk is managed within those boundaries. It focuses on aligning risk management with enterprise objectives and ensuring that residual risk is acceptable.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 2

A risk practitioner is designing an IT risk management programme. Which of the following is the BEST sequence of components to establish?

Accepted Answer

Risk management policy, risk assessment methodology, risk register, risk treatment process, risk reporting. A logical order is to first define policy, then methodology, then risk register, then treatment process, and finally reporting. However, the question asks for the best sequence among options. Typically, policy comes first, then methodology, then risk register, then treatment, then reporting.

Answer

Risk register, risk assessment methodology, risk treatment process, risk reporting, risk management policy

Answer

Risk assessment methodology, risk register, risk treatment process, risk management policy, risk reporting

Answer

Risk reporting, risk management policy, risk assessment methodology, risk register, risk treatment process

Question 3

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Accepted Answer

Data architecture layer. Data classification and sovereignty concerns are primarily data-related, falling under the data architecture layer. The data layer defines how data is stored, classified, and managed, including sovereignty requirements.

Answer

Application architecture layer

Answer

Business architecture layer

Answer

Infrastructure/Technology architecture layer

Question 4

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Accepted Answer

The application exposes sensitive customer data through APIs without proper authentication. The ARB's role includes ensuring security risks are identified before implementation. Among the options, exposure of sensitive customer data is the most critical security risk that could impact the organization's reputation and compliance.

Answer

The application does not support mobile devices

Answer

The application development timeline is aggressive

Answer

The application uses the latest JavaScript framework

Question 5

When assessing cloud computing risk, which of the following is a key concern related to data sovereignty?

Accepted Answer

Data may be stored in jurisdictions with different privacy laws. Data sovereignty refers to legal requirements that data be stored and processed within certain geographic boundaries. Cloud providers may store data in multiple jurisdictions, leading to compliance risks if data crosses borders without authorization.

Answer

Shared responsibility model misunderstandings

Answer

Multi-tenancy isolation gaps

Answer

Vendor lock-in due to proprietary APIs

Question 6

An organization is adopting machine learning for credit scoring decisions. Which of the following risks is MOST critical from a regulatory compliance perspective?

Accepted Answer

Lack of model explainability for automated decisions. Regulatory frameworks like GDPR and the EU AI Act emphasize the right to explanation for automated decisions. Without model explainability, the organization cannot demonstrate compliance with transparency requirements, making it the most critical risk from a regulatory compliance perspective.

Answer

Model bias leading to unfair outcomes

Answer

Data privacy during model training

Answer

Adversarial attacks on the model

Question 7

A risk manager is evaluating the risk of quantum computing for the organization's encryption. The organization uses RSA-2048 for data encryption. What is the PRIMARY consideration in planning for post-quantum cryptography migration?

Accepted Answer

The timeline for quantum computers to break RSA-2048. Quantum computers capable of breaking RSA-2048 are not expected within the next few years, so the primary consideration is the timeline for quantum advantage to prioritize migration efforts.

Answer

The cost of new encryption algorithms

Answer

The availability of quantum-resistant hardware

Answer

The performance impact of post-quantum algorithms

Question 8

According to the NIST Cybersecurity Framework, which function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function (PR) is defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services.

Answer

Identify

Answer

Respond

Answer

Detect

Question 9

An organization uses the FAIR (Factor Analysis of Information Risk) model to quantify cyber risk. Which of the following is the correct definition of 'Loss Magnitude' in the FAIR model?

Accepted Answer

The probable financial impact of a cyber incident. In FAIR, Loss Magnitude is the probable financial impact of a cyber incident, typically expressed as a monetary value. It is calculated based on primary and secondary losses.

Answer

The cost of implementing security controls

Answer

The number of records compromised in a data breach

Answer

The probability that a threat event will occur

Question 10

Which of the following is a common exclusion in cyber insurance policies that a risk manager should be aware of?

Accepted Answer

Acts of war. Cyber insurance policies often exclude acts of war, including state-sponsored cyber attacks. This is a critical exclusion that can leave organizations unprotected against nation-state threats.

Answer

Business interruption

Answer

Ransomware attacks

Answer

Social engineering fraud

Question 11

An organization is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. Which of the following is the PRIMARY risk introduced by this IT/OT convergence?

Accepted Answer

Expansion of the attack surface to OT systems. The primary risk is the expansion of the attack surface, as previously isolated OT systems become accessible from the corporate network, increasing the likelihood of cyber attacks propagating to critical industrial systems.

Answer

Reduced availability of OT systems

Answer

Higher cost of network equipment

Answer

Increased complexity of data analytics

Question 12

Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?

Accepted Answer

IEC 62443. IEC 62443 is the international standard for industrial automation and control systems security, covering security for IACS across multiple levels.

Answer

ISO 27001

Answer

NERC CIP

Answer

NIST SP 800-53

Question 13

A risk manager is evaluating the risks associated with using a public cloud provider. Which TWO of the following are key considerations for multi-tenancy isolation? (Select TWO.)

Accepted Answer

Risk of misconfigured cloud storage exposing another tenant's data. Multi-tenancy isolation concerns include the risk of hypervisor vulnerabilities allowing tenants to access each other's data (A) and the risk of misconfiguration leading to data exposure (B). Vendor lock-in (C) is not about isolation; data sovereignty (D) is about geographic location; shared responsibility (E) is about roles.

Answer

Risk of unclear shared responsibility

Answer

Risk of vendor lock-in

Answer

Risk of data sovereignty violations

Question 14

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Accepted Answer

Expanded attack surface due to numerous connected devices. IoT devices often have limited security features, leading to expanded attack surface (A), lack of firmware update mechanisms (B), and use of legacy components with known vulnerabilities (C). Data sovereignty (D) is less relevant for environmental data; vendor lock-in (E) is a business risk but not a security risk.

Answer

Vendor lock-in due to proprietary protocols

Answer

Data sovereignty issues for sensor data

Question 15

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Accepted Answer

Helps align cybersecurity activities with business objectives. The NIST CSF provides a common language (A) and helps align cybersecurity activities with business objectives (B). It does not guarantee prevention of all attacks (C), nor does it replace risk appetite (D), and it is not a prescriptive standard but a framework (E).

Answer

Ensures all cyber attacks are prevented

Answer

Provides a prescriptive set of controls for all organizations

Answer

Replaces the need for a separate risk appetite statement