CRISC Information Technology and Security Practice Test 3 — 15 Questions

Question 1

During a solution architecture review, the Architecture Review Board (ARB) identifies that a new application communicates with a legacy system using plain text over a public network. Which risk treatment option is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require encryption (e.g., TLS) for the communication. Requiring encryption (e.g., TLS) directly mitigates the confidentiality and integrity risk of plaintext transmission over a public network by protecting data in transit. This is the most appropriate risk treatment because it addresses the root cause—unprotected communication—without disrupting the legacy system's functionality. TLS provides encryption, authentication, and integrity checking, which are standard controls for this scenario. The ARB should mandate this as a condition of approval.

Answer

Transfer the risk to a third-party vendor

Answer

Accept the risk because the legacy system cannot be changed

Answer

Decommission the legacy system immediately

Question 2

Which COBIT 2019 domain objective focuses on ensuring that risk is optimized through evaluation, direction, and monitoring?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the governance objective that addresses risk management evaluation, direction, and monitoring.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Question 3

A hospital is deploying IoT medical devices that connect to the network. Which risk is MOST concerning from a cybersecurity perspective?

Accepted Answer

Expanded attack surface due to many devices. IoT medical devices dramatically expand the attack surface because each device is a potential entry point, often with weak default credentials, unpatched firmware, and limited security controls. In a hospital, this expansion is the most concerning risk because it multiplies exposure across the network.

Answer

Data sovereignty compliance

Answer

Firmware update challenges

Answer

Vendor lock-in

Question 4

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Accepted Answer

Protect the reliability of the bulk electric system. NERC CIP (Critical Infrastructure Protection) standards are mandatory reliability standards specifically designed to protect the bulk electric system (BES) from cyber and physical threats. Their primary objective is to ensure the reliable operation of the BES by securing the assets that control and monitor it. This is a regulatory requirement for power utilities in North America.

Answer

Standardize industrial control protocols

Answer

Reduce energy consumption

Answer

Ensure interoperability between IT and OT systems

Question 5

A company is migrating critical applications to the cloud. The risk manager is assessing the shared responsibility model. Which risk is the customer typically responsible for?

Accepted Answer

Data classification and access control. According to the shared responsibility model, the customer is responsible for data, access management, and application-level security.

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Answer

Hypervisor security

Question 6

Which of the following is a key component of an IT risk management programme that documents identified risks, their likelihood, and impact?

Accepted Answer

Risk register. The risk register is the central repository within an IT risk management programme that formally documents identified risks, their assessed likelihood, and potential impact. It serves as the authoritative record for tracking risk ownership, mitigation status, and residual risk levels, enabling ongoing monitoring and reporting. Without a risk register, an organization cannot systematically manage or communicate its risk posture.

Answer

Risk management policy

Answer

Business continuity plan

Answer

Incident response plan

Question 7

An organization is considering cyber insurance to transfer residual risk. Which factor would MOST significantly influence the premium?

Accepted Answer

Security controls and incident history. Cyber insurance premiums are most significantly influenced by the organization's security controls and incident history, because insurers underwrite based on the likelihood and severity of a claim. Strong controls (MFA, EDR, backups, segmentation) and a clean incident history reduce perceived risk and lower premiums; poor controls and prior breaches raise them.

Answer

Industry sector

Answer

Company revenue

Answer

Number of employees

Question 8

A manufacturing company is evaluating the risks of connecting its OT network to the IT network. Which THREE risks are MOST significant due to IT/OT convergence?

Accepted Answer

Expansion of attack paths from IT to OT systems. Option A is correct because IT/OT convergence creates bridges between previously isolated environments, allowing attackers who compromise IT systems (e.g., via phishing or unpatched enterprise apps) to pivot laterally into OT networks and reach industrial control systems. Option B is correct because many OT devices such as PLCs, RTUs, and HMIs run legacy operating systems and proprietary protocols (e.g., Modbus, DNP3) with no authentication, encryption, or patch support, making them inherently vulnerable once exposed to IT-side threats. Option D is correct because compromised OT systems can directly manipulate physical processes—causing equipment damage, production outages, or safety incidents that endanger personnel, which is a uniquely severe consequence not present in pure IT breaches. Option C is not a convergence-specific risk; GDPR governs personal data protection and is largely irrelevant to OT process control data. Option E is incorrect because data storage costs are a general IT operational concern, not a significant security or safety risk arising from IT/OT convergence.

Answer

Compliance with GDPR

Answer

Increased data storage costs

Question 9

An organization is planning to adopt post-quantum cryptography. Which TWO considerations are MOST important for migration planning?

Accepted Answer

Assess the cryptographic agility of current systems. Option B is correct because cryptographic agility—the ability of systems to swap algorithms, keys, and protocols without major redesign—is essential for migrating to post-quantum cryptography (PQC), since standards such as ML-KEM (FIPS 203) and ML-DSA (FIPS 204) will continue to evolve and hybrid deployments (e.g., X25519+ML-KEM) must be supported during transition. Option C is correct because systems protecting data with long confidentiality lifetimes (classified, health, financial records) are exposed to 'harvest now, decrypt later' attacks, so migration priority must be driven by how long the data must remain secret versus when a cryptographically relevant quantum computer (CRQC) is expected. Option A is not a migration-planning consideration because the cost of quantum computers is irrelevant to an organization's own cryptographic inventory and transition roadmap. Option D is unnecessary because adopting PQC requires cryptographic and IT expertise, not training staff in quantum physics. Option E is premature because standardized PQC algorithms run on existing classical hardware via software/firmware updates, so buying 'quantum-resistant hardware' immediately is neither required nor a sound first step.

Answer

Evaluate the cost of quantum computers

Answer

Train employees on quantum physics

Answer

Purchase quantum-resistant hardware immediately

Question 10

Which COBIT 2019 governance objective focuses on ensuring that the enterprise's risk appetite and tolerance are understood, articulated, and communicated, and that risk is managed appropriately?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically designed to ensure that the enterprise's risk appetite and risk tolerance are defined, communicated, and understood, and that risk is managed within those boundaries. It focuses on aligning risk management with enterprise objectives and ensuring that residual risk is acceptable.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 11

A risk practitioner is designing an IT risk management programme. Which of the following is the BEST sequence of components to establish?

Accepted Answer

Risk management policy, risk assessment methodology, risk register, risk treatment process, risk reporting. The best sequence starts with a risk management policy, which provides the mandate and framework. Then a risk assessment methodology defines how risks are identified and evaluated. Next, a risk register captures the risks. Then a risk treatment process defines how to respond. Finally, risk reporting communicates to stakeholders. This logical order ensures that each component builds on the previous one.

Answer

Risk register, risk assessment methodology, risk treatment process, risk reporting, risk management policy

Answer

Risk assessment methodology, risk register, risk treatment process, risk management policy, risk reporting

Answer

Risk reporting, risk management policy, risk assessment methodology, risk register, risk treatment process

Question 12

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Accepted Answer

Data architecture layer. Data classification and data sovereignty are concerns about how data is categorized, where it resides, and which legal/regulatory jurisdictions govern it — all of which are addressed in the data architecture layer. This layer defines data models, ownership, retention, classification schemes, and cross-border data flow rules. Risk related to sovereignty (e.g., GDPR data residency) is fundamentally a data architecture design issue.

Answer

Application architecture layer

Answer

Business architecture layer

Answer

Infrastructure/Technology architecture layer

Question 13

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Accepted Answer

The application exposes sensitive customer data through APIs without proper authentication. The primary risk an Architecture Review Board should consider is the exposure of sensitive customer data through unauthenticated APIs, because this represents a direct, high-impact security and compliance risk (data breach, regulatory penalties, reputational damage). ARBs focus on risks that threaten confidentiality, integrity, and availability of critical assets, and unauthenticated API access to sensitive data is a classic OWASP API Security Top 10 issue.

Answer

The application does not support mobile devices

Answer

The application development timeline is aggressive

Answer

The application uses the latest JavaScript framework

Question 14

When assessing cloud computing risk, which of the following is a key concern related to data sovereignty?

Accepted Answer

Data may be stored in jurisdictions with different privacy laws. Data sovereignty is a key concern in cloud computing risk because data may be stored in jurisdictions with different privacy laws. This means that data could be subject to legal requirements that conflict with the organization's own compliance obligations, such as GDPR or HIPAA.

Answer

Shared responsibility model misunderstandings

Answer

Multi-tenancy isolation gaps

Answer

Vendor lock-in due to proprietary APIs

Question 15

A risk manager is evaluating the risk of quantum computing for the organization's encryption. The organization uses RSA-2048 for data encryption. What is the PRIMARY consideration in planning for post-quantum cryptography migration?

Accepted Answer

The timeline for quantum computers to break RSA-2048. Quantum computers capable of breaking RSA-2048 are not expected within the next few years, so the primary consideration is the timeline for quantum advantage to prioritize migration efforts.

Answer

The cost of new encryption algorithms

Answer

The availability of quantum-resistant hardware

Answer

The performance impact of post-quantum algorithms