CRISC Information Technology and Security Practice Test 4 — 15 Questions

Question 1

According to the NIST Cybersecurity Framework, which function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The NIST Cybersecurity Framework's Protect function (PR) covers the safeguards needed to ensure delivery of critical infrastructure services — including access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is the function that directly addresses preventive controls.

Answer

Identify

Answer

Respond

Answer

Detect

Question 2

An organization uses the FAIR (Factor Analysis of Information Risk) model to quantify cyber risk. Which of the following is the correct definition of 'Loss Magnitude' in the FAIR model?

Accepted Answer

The probable financial impact of a cyber incident. In FAIR, Loss Magnitude represents the probable financial impact resulting from a loss event — it quantifies how much money an organization would lose if a threat event materializes into a loss. It is one of the two primary factors (alongside Loss Event Frequency) that combine to produce risk. It encompasses primary and secondary loss forms across productivity, response, replacement, fines, and reputation.

Answer

The cost of implementing security controls

Answer

The number of records compromised in a data breach

Answer

The probability that a threat event will occur

Question 3

Which of the following is a common exclusion in cyber insurance policies that a risk manager should be aware of?

Accepted Answer

Acts of war. Acts of war (and sometimes terrorism, nation-state cyber operations, or hostile acts) are a common exclusion in cyber insurance policies. Insurers exclude them because the potential for catastrophic, correlated losses across many policyholders is uninsurable. A risk manager must be aware of this exclusion because it can leave the organization without coverage for state-sponsored cyberattacks.

Answer

Business interruption

Answer

Ransomware attacks

Answer

Social engineering fraud

Question 4

An organization is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. Which of the following is the PRIMARY risk introduced by this IT/OT convergence?

Accepted Answer

Expansion of the attack surface to OT systems. Connecting ICS/OT systems to the corporate IT network exposes previously isolated OT devices to the corporate attack surface, allowing threats that compromise IT to pivot into OT. This expansion of the attack surface is the primary risk of IT/OT convergence because OT systems often lack security controls and cannot be easily patched. The other options are secondary or not risks at all.

Answer

Reduced availability of OT systems

Answer

Higher cost of network equipment

Answer

Increased complexity of data analytics

Question 5

Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?

Accepted Answer

IEC 62443. IEC 62443 is the international standard series specifically designed for industrial automation and control systems (IACS) security. It provides a framework for securing IACS across the entire lifecycle, including risk assessment, system design, and operational security, with roles defined for asset owners, system integrators, and product suppliers. It is the de facto standard for OT/ICS security.

Answer

ISO 27001

Answer

NERC CIP

Answer

NIST SP 800-53

Question 6

An organization is deploying IoT devices for environmental monitoring in a manufacturing facility. Which THREE of the following are significant security risks that should be addressed? (Select THREE.)

Accepted Answer

Expanded attack surface due to numerous connected devices. Option A is correct because deploying many IoT sensors multiplies entry points (each device's network services, management interfaces, and APIs), greatly expanding the attack surface an adversary can probe or exploit. Option C is correct because IoT devices without a secure firmware update mechanism cannot receive patches for newly disclosed CVEs, leaving them permanently vulnerable to exploitation. Option E is correct because legacy components often run outdated firmware or unsupported OS/protocol stacks with publicly known vulnerabilities that attackers can leverage. Option B is not a direct security risk but a business/procurement concern, and Option D concerns legal/regulatory data residency rather than a technical security vulnerability.

Answer

Vendor lock-in due to proprietary protocols

Answer

Data sovereignty issues for sensor data

Question 7

Which TWO of the following are key benefits of integrating the NIST Cybersecurity Framework with an organization's risk management processes? (Select TWO.)

Accepted Answer

Helps align cybersecurity activities with business objectives. Option B is correct because the NIST Cybersecurity Framework (CSF) is designed to be integrated with enterprise risk management so that cybersecurity investments and activities are prioritized according to business objectives, mission needs, and organizational risk tolerances, rather than treated as a purely technical concern. Option D is correct because the CSF Core's Functions, Categories, and Subcategories (Identify, Protect, Detect, Respond, Recover, and Govern in CSF 2.0) establish a standardized taxonomy that gives technical and business stakeholders a common language for describing, discussing, and communicating cybersecurity risk. Option A is incorrect because no framework can guarantee prevention of all cyber attacks; the CSF is risk-based and assumes some incidents will occur, emphasizing detection, response, and recovery. Option C is incorrect because the CSF is outcome-based and voluntary, not a prescriptive checklist of mandatory controls for every organization. Option E is incorrect because the CSF complements, rather than replaces, an organization's risk appetite statement, which is a governance input used to guide risk-based decisions.

Answer

Ensures all cyber attacks are prevented

Answer

Provides a prescriptive set of controls for all organizations

Answer

Replaces the need for a separate risk appetite statement

Question 8

A company is implementing COBIT 2019 and wants to ensure that risk management activities are aligned with business objectives. Which governance objective is primarily responsible for evaluating, directing, and monitoring risk management?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically responsible for ensuring that enterprise risk is identified, assessed, and managed within the risk appetite, and that risk management activities align with business objectives. It covers evaluating risk, directing risk treatment, and monitoring risk exposure. The other EDM objectives address governance framework, benefits, and resources, not risk optimization.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 9

An organization is designing an IT risk management programme. Which of the following is the most critical component to ensure consistent identification and assessment of risks across the enterprise?

Accepted Answer

Risk assessment methodology. A risk assessment methodology provides a standardized approach for identifying, analyzing, and evaluating risks. It ensures that all business units use consistent criteria, scales, and processes, which is essential for comparing and aggregating risks across the enterprise. Without a common methodology, risk assessments become subjective and inconsistent, undermining the risk management program.

Answer

Risk treatment process

Answer

Risk management policy

Answer

Risk register

Question 10

A financial institution is adopting a cloud-based analytics platform. The data includes sensitive customer information subject to multiple jurisdictions' data residency laws. Which of the following poses the greatest compliance risk?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. Data sovereignty issues arise when data is stored in jurisdictions with conflicting or unknown legal frameworks, posing significant compliance risk.

Answer

Multi-tenancy isolation vulnerabilities

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Question 11

In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function in the NIST Cybersecurity Framework (CSF) covers the safeguards that limit or contain the impact of a cybersecurity event — access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is explicitly defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. Detect, Identify, and Recover address different phases of the risk lifecycle.

Answer

Detect

Answer

Recover

Answer

Identify

Question 12

An architecture review board (ARB) is evaluating a new solution architecture that processes sensitive data. Which of the following should the ARB review to ensure security risks are addressed before implementation?

Accepted Answer

Threat model and security controls. The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Answer

User acceptance test plan

Answer

Business case and ROI analysis

Answer

Project timeline and budget

Question 13

A manufacturing company is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. What is the most significant risk arising from this IT/OT convergence?

Accepted Answer

Expanded attack surface from IT to OT systems. Expanded attack surface from IT to OT systems. Connecting ICS/OT networks to corporate IT networks creates a bridge that allows threats to move laterally from IT into OT environments. Historically, OT networks were air-gapped or highly segmented, but IT/OT convergence introduces new entry points and attack vectors, significantly increasing the risk of cyberattacks that can disrupt physical industrial processes. This is the most significant risk because it can lead to safety incidents, production outages, and physical damage.

Answer

Reduced network bandwidth for OT operations

Answer

Increased data storage costs

Answer

Loss of proprietary control protocols

Question 14

A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?

Accepted Answer

$1,000,000. Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM). Here, LEF = 0.2 per year and LM = $5,000,000, so ALE = 0.2 × $5,000,000 = $1,000,000. This represents the expected annualized financial loss from the ransomware scenario.

Answer

$500,000

Answer

$250,000

Answer

$5,000,000

Question 15

Which of the following is a primary concern when using AI/ML models for decisions subject to regulatory oversight?

Accepted Answer

Explainability of model decisions. When AI/ML models drive decisions subject to regulatory oversight (e.g., credit, hiring, healthcare), explainability is the primary concern because regulators and affected individuals must understand how a decision was reached. Without explainability, the organization cannot demonstrate compliance with laws like GDPR Article 22 (right to explanation) or fair lending regulations, and cannot defend decisions in audits or disputes.

Answer

Adversarial attacks

Answer

Model bias

Answer

Data privacy in training