CRISC Information Technology and Security Practice Test 4 — 15 Questions

Question 1

An organization is considering adopting the NIST Cybersecurity Framework to manage cybersecurity risk. Which of the following are core functions of the framework? (Choose TWO.)

Accepted Answer

Protect. The NIST CSF core functions include Identify, Protect, Detect, Respond, and Recover. Identify and Protect are two of them.

Answer

Prevent

Answer

Mitigate

Answer

Analyze

Question 2

In the context of IT governance, which COBIT 2019 process is specifically focused on ensuring risk optimization?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 (Ensure Risk Optimization) is the COBIT 2019 process that evaluates, directs, and monitors risk management to optimize risk exposure.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 3

An organization is designing an IT risk management program. Which of the following should be the PRIMARY consideration when developing a risk register?

Accepted Answer

Capturing risk details, including impact, likelihood, and mitigation status. A risk register should capture and track identified risks, their assessed impact and likelihood, and planned mitigation actions to enable effective risk management.

Answer

Aligning risk categories with the COSO internal control framework

Answer

Ensuring that the register is integrated with the enterprise risk management system

Answer

Automating the risk register with real-time risk monitoring tools

Question 4

A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?

Accepted Answer

Data sovereignty and compliance with local regulations. The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Answer

Multi-tenancy isolation risks

Question 5

An organization's architecture review board (ARB) is evaluating a new solution architecture. What is the PRIMARY risk management role of the ARB in this context?

Accepted Answer

Identifying and mitigating security risks in the architecture. The ARB reviews solution architectures to identify and address security risks before implementation, ensuring alignment with the organization's risk appetite.

Answer

Selecting the technology vendor for the solution

Answer

Ensuring the solution aligns with the enterprise IT strategy

Answer

Approving the project budget and timeline

Question 6

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?

Accepted Answer

Expansion of the attack surface from IT to OT environments. Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.

Answer

Increased complexity in managing network bandwidth

Answer

Potential for increased data redundancy

Answer

Higher licensing costs for security software

Question 7

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Accepted Answer

Risk assessment. The Identify function includes asset management, risk assessment, and governance to understand the organization's risk posture.

Answer

Recovery planning

Answer

Response planning

Answer

Anomalies and events detection

Question 8

A risk manager is using the FAIR model to quantify cyber risk. Which of the following inputs is MOST directly used to calculate probable financial loss?

Accepted Answer

Loss event frequency and loss magnitude. FAIR calculates loss magnitude using loss event frequency and loss magnitude (monetary impact). The probable financial loss is derived from these factors.

Answer

Annualized loss expectancy (ALE)

Answer

Vulnerability severity scores (CVSS)

Answer

Number of security incidents per year

Question 9

A power utility subject to NERC CIP standards is planning to deploy a new SCADA system. Which of the following requirements is MOST likely mandated by NERC CIP?

Accepted Answer

Establishment of an electronic security perimeter around critical cyber assets. NERC CIP standards require identification and protection of critical cyber assets, including clear boundaries (electronic security perimeters) to control access.

Answer

Adoption of a cloud-based backup solution

Answer

Use of quantum-resistant encryption for all communications

Answer

Implementation of IEC 62443 security levels

Question 10

An organization is evaluating cyber insurance options. Which of the following factors is MOST likely to influence the insurance premium?

Accepted Answer

The organization's cybersecurity maturity and incident history. Insurance premiums are heavily influenced by the organization's risk profile, including its security posture. A strong security posture reduces perceived risk and thus premiums.

Answer

The organization's annual revenue

Answer

The number of employees in the IT department

Answer

The organization's credit rating

Question 11

Which of the following is a primary goal of the 'Protect' function in the NIST Cybersecurity Framework?

Accepted Answer

Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect function focuses on implementing safeguards to limit or contain the impact of a potential cybersecurity event.

Answer

Develop and implement appropriate activities to identify the occurrence of a cybersecurity event

Answer

Develop and implement appropriate activities to take action regarding a detected cybersecurity event

Answer

Develop and implement appropriate activities to maintain plans for resilience

Question 12

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Accepted Answer

Inability to apply security patches due to legacy firmware. IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Answer

Interference with radio frequency signals

Answer

Limited data storage capacity

Answer

High power consumption leading to operational costs

Question 13

A risk manager is assessing the potential impact of quantum computing on the organization's cryptographic infrastructure. What is the MOST immediate action the organization should take?

Accepted Answer

Conduct a cryptographic inventory to identify vulnerable systems. The first step is to inventory all cryptographic systems to understand where quantum-vulnerable algorithms are used, enabling a migration plan.

Answer

Purchase quantum-resistant hardware security modules

Answer

Immediately replace all encryption with post-quantum algorithms

Answer

Discontinue use of public key cryptography

Question 14

An organization is implementing an AI/ML model for credit approval decisions subject to regulatory oversight. Which TWO of the following are the most significant risk considerations?

Accepted Answer

Model bias causing discriminatory outcomes. Regulated decisions require explainability, and model bias can lead to unfair or illegal outcomes. Both are critical risks.

Answer

Data privacy in AI training

Answer

High computational cost of model retraining

Answer

Adversarial attacks on the training data

Question 15

A global company is moving its critical applications to a public cloud. Which THREE of the following are key risk considerations in the shared responsibility model?

Accepted Answer

Identity and access management. Data security, identity management, and compliance are typically customer responsibilities, while physical security is the provider's. Misunderstanding these can lead to gaps.

Answer

Physical security of data centers

Answer

Network firewall configuration