CRISC Information Technology and Security Practice Test 5 — 15 Questions

Question 1

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Accepted Answer

Segmentation of networks into zones and conduits. IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

Answer

Mandatory cloud-based backup for all control systems

Answer

Annual penetration testing by an external firm

Answer

Use of AES-256 encryption for all communications

Question 2

An organization is implementing COBIT 2019 and the board has requested assurance that risk management activities are aligned with business objectives. Which governance objective is primarily focused on ensuring risk optimization through evaluation, direction, and monitoring?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 (Ensure Risk Optimization) is the COBIT governance objective that specifically addresses the evaluation, direction, and monitoring of risk management to align with enterprise objectives.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Question 3

A risk manager is designing an IT risk management program. Which document should serve as the primary source for defining the organization's approach to risk assessment, treatment, and reporting?

Accepted Answer

Risk management policy. The risk management policy is the authoritative document that establishes the organization's overall approach to risk management, including the principles, roles, responsibilities, and processes for risk assessment, treatment, and reporting. It sets the governance framework and mandates how risk activities must be conducted across the IT environment, ensuring consistency and alignment with business objectives.

Answer

IT strategy

Answer

Business continuity plan

Answer

Risk register

Question 4

A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.

Answer

Multi-tenancy isolation failures

Answer

Shared responsibility model gaps for patching

Answer

Vendor lock-in due to proprietary APIs

Question 5

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?

Accepted Answer

Expanded attack path from IT to OT systems. Connecting OT networks to IT networks expands the attack surface, allowing threats from the corporate network to reach ICS/SCADA systems, which were previously isolated.

Answer

Higher licensing costs for industrial software

Answer

Increased complexity of data analytics

Answer

Reduced operational efficiency due to network latency

Question 6

Which component of the NIST Cybersecurity Framework is primarily concerned with developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function in NIST CSF outlines safeguards to manage cybersecurity risk and ensure service delivery.

Answer

Detect

Answer

Identify

Answer

Recover

Question 7

A risk practitioner is using the FAIR model to quantify cyber risk for a proposed new online payment system. Which factor must be estimated to calculate the probable financial impact of a data breach?

Accepted Answer

Loss magnitude. In FAIR, the probable financial impact is derived from the loss event frequency and the loss magnitude. Loss magnitude estimates the financial loss per incident.

Answer

Threat event frequency

Answer

Vulnerability severity score

Answer

Annualized rate of occurrence

Question 8

An organization is evaluating cyber insurance to cover potential losses from ransomware attacks. The insurer requires that the organization have multi-factor authentication (MFA) on all remote access systems. This requirement is an example of which factor influencing insurance premiums?

Accepted Answer

Premium factors. Insurers assess the organization's security controls to determine risk level; MFA is a control that reduces risk, thus affecting premiums positively.

Answer

Coverage scope

Answer

Incident prerequisites

Answer

Exclusions

Question 9

A bank is considering adopting artificial intelligence for credit scoring. The risk manager identifies that the AI model might produce biased outcomes against certain demographic groups. Which AI/ML risk is most directly associated with this concern?

Accepted Answer

Model bias. Model bias occurs when training data or algorithms produce unfair or discriminatory outcomes, directly impacting fairness and regulatory compliance.

Answer

Adversarial attacks

Answer

Explainability requirements

Answer

Data privacy in AI training

Question 10

An organization is deploying a large number of Internet of Things (IoT) sensors for environmental monitoring in a remote facility. The sensors have limited processing power and cannot be patched easily. Which risk should the risk manager prioritize?

Accepted Answer

Expanded attack surface with unpatched devices. IoT devices often lack security updates, making them vulnerable to exploitation. The expanded attack surface from many devices compounds this risk.

Answer

Vendor lock-in to proprietary protocols

Answer

Insufficient bandwidth for data transmission

Answer

Data integrity issues from sensor malfunction

Question 11

A risk manager is assessing the impact of quantum computing on the organization's cryptographic infrastructure. The timeline for quantum advantage is estimated to be 10 years. What is the most appropriate immediate action to address this risk?

Accepted Answer

Begin post-quantum cryptography migration planning and crypto-agility assessment. Post-quantum cryptography migration planning is a strategic activity that should begin now to ensure readiness before quantum computers can break current cryptography.

Answer

Increase key lengths for all symmetric encryption to 256 bits

Answer

Ignore the risk until quantum computers are commercially available

Answer

Replace all existing cryptographic algorithms with post-quantum algorithms immediately

Question 12

Which enterprise architecture layer is most directly responsible for managing the storage and processing of data, and for which data classification and encryption controls are critical?

Accepted Answer

Data architecture. Data architecture is the enterprise architecture layer that defines how data is stored, managed, and processed, including data models, data flows, and storage structures. Data classification and encryption controls are critical at this layer because they directly protect the confidentiality and integrity of data at rest and in transit, ensuring compliance with policies and regulations.

Answer

Application architecture

Answer

Technology architecture

Answer

Business architecture

Question 13

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Accepted Answer

Protect the bulk power system from cybersecurity threats. NERC CIP standards are designed to protect the reliability of the bulk power system against cybersecurity threats that could cause widespread outages.

Answer

Reduce energy consumption through efficient IT operations

Answer

Ensure interoperability between different vendors' SCADA systems

Answer

Standardize industrial control protocols

Question 14

An organization is reviewing its IT risk management program and identifies that the risk register is not being updated after project changes. Which TWO components of the risk management program are most likely deficient?

Accepted Answer

Risk management policy. The risk management policy (B) is deficient because it should mandate periodic updates to the risk register after project changes, ensuring alignment with the organization's risk appetite and tolerance. Without a policy that explicitly requires post-change risk reassessment, the process lacks governance and accountability. Risk reporting (C) is also deficient because it fails to communicate the updated risk status to stakeholders, which is critical for informed decision-making and maintaining an accurate risk posture.

Answer

Risk register

Answer

Risk assessment methodology

Answer

Risk treatment process

Question 15

A financial services firm is migrating critical applications to a public cloud. The architecture review board (ARB) is evaluating the solution architecture. Which THREE risks should the ARB prioritize for review?

Accepted Answer

Vendor lock-in due to proprietary services. Data sovereignty (regulatory), shared responsibility model (security gaps), and vendor lock-in (strategic) are key cloud risks that the ARB should assess before implementation.

Answer

Energy consumption of cloud data centers

Answer

Network bandwidth limitations