CRISC Information Technology and Security Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Accepted Answer

Helps align cybersecurity activities with business objectives. The NIST CSF provides a common language for communicating cybersecurity risk (option D) and helps align cybersecurity activities with business objectives (option B). It does not guarantee prevention of all cyber attacks (option A), nor does it replace the need for a separate risk appetite statement (option E), and it is not a prescriptive set of controls but a flexible framework (option C).

Answer

Ensures all cyber attacks are prevented

Answer

Provides a prescriptive set of controls for all organizations

Answer

Replaces the need for a separate risk appetite statement

Question 2

A company is implementing COBIT 2019 and wants to ensure that risk management activities are aligned with business objectives. Which governance objective is primarily responsible for evaluating, directing, and monitoring risk management?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019 defines EDM03 (Ensure Risk Optimization) as the governance objective that covers evaluating, directing, and monitoring risk management to optimize risk exposure.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 3

An organization is designing an IT risk management programme. Which of the following is the most critical component to ensure consistent identification and assessment of risks across the enterprise?

Accepted Answer

Risk assessment methodology. A standardized risk assessment methodology is essential for consistent identification and assessment of risks across the enterprise.

Answer

Risk treatment process

Answer

Risk management policy

Answer

Risk register

Question 4

A financial institution is adopting a cloud-based analytics platform. The data includes sensitive customer information subject to multiple jurisdictions' data residency laws. Which of the following poses the greatest compliance risk?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. Data sovereignty issues arise when data is stored in jurisdictions with conflicting or unknown legal frameworks, posing significant compliance risk.

Answer

Multi-tenancy isolation vulnerabilities

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Question 5

In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function of the NIST CSF focuses on safeguards to limit or contain the impact of cybersecurity events.

Answer

Detect

Answer

Recover

Answer

Identify

Question 6

An architecture review board (ARB) is evaluating a new solution architecture that processes sensitive data. Which of the following should the ARB review to ensure security risks are addressed before implementation?

Accepted Answer

Threat model and security controls. The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Answer

User acceptance test plan

Answer

Business case and ROI analysis

Answer

Project timeline and budget

Question 7

A manufacturing company is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. What is the most significant risk arising from this IT/OT convergence?

Accepted Answer

Expanded attack surface from IT to OT systems. Connecting OT to IT networks exposes ICS to threats from the corporate network, expanding the attack surface and potentially allowing attackers to pivot to OT systems.

Answer

Reduced network bandwidth for OT operations

Answer

Increased data storage costs

Answer

Loss of proprietary control protocols

Question 8

A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?

Accepted Answer

$1,000,000. ALE = LEF * LM = 0.2 * $5,000,000 = $1,000,000.

Answer

$500,000

Answer

$250,000

Answer

$5,000,000

Question 9

Which of the following is a primary concern when using AI/ML models for decisions subject to regulatory oversight?

Accepted Answer

Explainability of model decisions. Regulated decisions often require explainability to ensure compliance and auditability, which can be challenging with complex AI/ML models.

Answer

Adversarial attacks

Answer

Model bias

Answer

Data privacy in training

Question 10

An organization is evaluating cyber insurance to mitigate financial risk from potential data breaches. Which factor would most likely increase the insurance premium?

Accepted Answer

History of previous security incidents. A history of past security incidents indicates higher risk, leading insurers to charge higher premiums.

Answer

Implementation of multi-factor authentication

Answer

Adoption of a cybersecurity framework

Answer

Regular penetration testing

Question 11

A power utility must comply with NERC CIP standards. Which of the following is a key requirement under these standards?

Accepted Answer

Identifying and securing Critical Cyber Assets (CCAs). NERC CIP requires identification and protection of Critical Cyber Assets, including security controls for assets essential to bulk electric system reliability.

Answer

Implementing IEC 62443 for all control systems

Answer

Deploying AI for threat detection

Answer

Using only air-gapped networks

Question 12

Which of the following is a characteristic of IoT devices that increases cybersecurity risk?

Accepted Answer

Limited processing power for security features. IoT devices often have limited processing power and cannot run standard security software, making them vulnerable to attacks.

Answer

Built-in hardware security modules

Answer

Standardized communication protocols

Answer

Regular automatic firmware updates

Question 13

A company is planning to migrate to post-quantum cryptography. What is the primary risk that quantum computing poses to current cryptographic systems?

Accepted Answer

Breaking widely used public-key cryptographic algorithms. Quantum computers using Shor's algorithm can efficiently solve integer factorization and discrete logarithm problems, threatening RSA and ECC.

Answer

Enhancing encryption key generation

Answer

Compromising hash functions for integrity

Answer

Increased speed of brute-force attacks on symmetric keys

Question 14

A risk manager is integrating risk management with IT governance. Which of the following are key elements of an IT risk management programme design? (Choose TWO.)

Accepted Answer

Risk assessment methodology. A risk register and a risk assessment methodology are core components of an IT risk management programme design.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Vendor management policy

Question 15

An organization is deploying IoT devices in a smart building. Which of the following are significant security risks associated with IoT? (Choose THREE.)

Accepted Answer

Firmware update challenges due to device diversity. IoT risks include expanded attack surface, legacy device security gaps, and firmware update challenges.

Answer

Increased power consumption

Answer

Higher data transmission speeds