CRISC Information Technology and Security Practice Test 5 — 15 Questions

Question 1

An organization is evaluating cyber insurance to mitigate financial risk from potential data breaches. Which factor would most likely increase the insurance premium?

Accepted Answer

History of previous security incidents. A history of previous security incidents most likely increases the insurance premium because it indicates a higher risk profile to the insurer. Insurers assess past claims and incident frequency as a key factor in determining the likelihood of future breaches, leading to higher premiums or even denial of coverage.

Answer

Implementation of multi-factor authentication

Answer

Adoption of a cybersecurity framework

Answer

Regular penetration testing

Question 2

A power utility must comply with NERC CIP standards. Which of the following is a key requirement under these standards?

Accepted Answer

Identifying and securing Critical Cyber Assets (CCAs). NERC CIP (Critical Infrastructure Protection) standards require utilities to identify and protect Critical Cyber Assets (CCAs) — later evolved into BES Cyber Systems — that support the reliable operation of the Bulk Electric System. Identification, categorization, and implementation of security controls for these assets is a foundational requirement across the CIP standards (CIP-002 through CIP-014).

Answer

Implementing IEC 62443 for all control systems

Answer

Deploying AI for threat detection

Answer

Using only air-gapped networks

Question 3

Which of the following is a characteristic of IoT devices that increases cybersecurity risk?

Accepted Answer

Limited processing power for security features. IoT devices are frequently constrained by cost, size, and power, which limits CPU, memory, and battery. This directly restricts their ability to run strong encryption, host-based firewalls, secure boot, or frequent patching, expanding the attack surface. Limited processing power is therefore a structural characteristic that elevates cybersecurity risk.

Answer

Built-in hardware security modules

Answer

Standardized communication protocols

Answer

Regular automatic firmware updates

Question 4

A company is planning to migrate to post-quantum cryptography. What is the primary risk that quantum computing poses to current cryptographic systems?

Accepted Answer

Breaking widely used public-key cryptographic algorithms. Quantum computers using Shor's algorithm can efficiently solve integer factorization and discrete logarithm problems, threatening RSA and ECC.

Answer

Enhancing encryption key generation

Answer

Compromising hash functions for integrity

Answer

Increased speed of brute-force attacks on symmetric keys

Question 5

A risk manager is integrating risk management with IT governance. Which of the following are key elements of an IT risk management programme design? (Choose TWO.)

Accepted Answer

Risk assessment methodology. Option A (Risk assessment methodology) is correct because an IT risk management programme must define a consistent, repeatable approach for identifying, analyzing, and evaluating risks — including likelihood, impact, and risk criteria — so that risks can be prioritized and treated consistently across the enterprise. Option E (Risk register) is correct because it is the core record that captures identified risks, their owners, ratings, treatment decisions, and status, enabling ongoing monitoring and reporting that links IT risk to governance objectives. The other options do not belong as key design elements of an IT risk management programme: an incident response plan (B) and a business continuity plan (C) are operational response and recovery capabilities that may be informed by risk assessments but are not themselves risk programme design components, and a vendor management policy (D) is a third-party governance control that addresses only one risk domain rather than the overall programme structure.

Answer

Incident response plan

Answer

Business continuity plan

Answer

Vendor management policy

Question 6

An organization is deploying IoT devices in a smart building. Which of the following are significant security risks associated with IoT? (Choose THREE.)

Accepted Answer

Firmware update challenges due to device diversity. IoT risks include expanded attack surface, legacy device security gaps, and firmware update challenges.

Answer

Increased power consumption

Answer

Higher data transmission speeds

Question 7

An organization is considering adopting the NIST Cybersecurity Framework to manage cybersecurity risk. Which of the following are core functions of the framework? (Choose TWO.)

Accepted Answer

Protect. The NIST Cybersecurity Framework defines five core functions: Identify, Protect, Detect, Respond, and Recover. Option E (Identify) is correct because it covers understanding the organization's assets, risks, and governance to prioritize cybersecurity efforts. Option C (Protect) is correct because it encompasses safeguards such as access control, awareness training, and data security to limit or contain the impact of a potential cybersecurity event. Options A (Prevent), B (Mitigate), and D (Analyze) are not among the five core functions, even though they describe related risk-management concepts; the framework uses Detect, Respond, and Recover instead of those terms.

Answer

Prevent

Answer

Mitigate

Answer

Analyze

Question 8

In the context of IT governance, which COBIT 2019 process is specifically focused on ensuring risk optimization?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's EDM03 — Ensure Risk Optimization is the governance process specifically focused on ensuring that IT-related risk is identified, assessed, and managed within the enterprise's risk appetite. It is part of the Evaluate, Direct, and Monitor (EDM) domain, which is the governance domain.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 9

An organization is designing an IT risk management program. Which of the following should be the PRIMARY consideration when developing a risk register?

Accepted Answer

Capturing risk details, including impact, likelihood, and mitigation status. The primary purpose of a risk register is to serve as the central repository that documents identified risks along with their key attributes—impact, likelihood, mitigation status, ownership, and timelines. Without capturing these core details, the register cannot support risk prioritization, decision-making, or tracking of remediation efforts. Options A, B, and C describe supporting or enhancing elements, but they are secondary to the fundamental requirement of recording essential risk information. Therefore, D is the primary consideration.

Answer

Aligning risk categories with the COSO internal control framework

Answer

Ensuring that the register is integrated with the enterprise risk management system

Answer

Automating the risk register with real-time risk monitoring tools

Question 10

A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?

Accepted Answer

Data sovereignty and compliance with local regulations. The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Answer

Multi-tenancy isolation risks

Question 11

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?

Accepted Answer

Expansion of the attack surface from IT to OT environments. Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.

Answer

Increased complexity in managing network bandwidth

Answer

Potential for increased data redundancy

Answer

Higher licensing costs for security software

Question 12

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Accepted Answer

Risk assessment. The NIST Cybersecurity Framework's Identify function includes categories such as Asset Management, Business Environment, Governance, Risk Assessment, and Risk Management Strategy. Risk assessment is explicitly a key component of Identify because understanding organizational risk is foundational to prioritizing cybersecurity activities. It is listed under ID.RA in the framework core.

Answer

Recovery planning

Answer

Response planning

Answer

Anomalies and events detection

Question 13

A risk manager is using the FAIR model to quantify cyber risk. Which of the following inputs is MOST directly used to calculate probable financial loss?

Accepted Answer

Loss event frequency and loss magnitude. The FAIR (Factor Analysis of Information Risk) model calculates probable financial loss by combining Loss Event Frequency (LEF)—how often a threat event occurs—with Loss Magnitude (LM)—how much each event costs. These two factors are the core inputs to FAIR's risk quantification, producing a loss distribution rather than a single point estimate. This makes option B the most direct input pair.

Answer

Annualized loss expectancy (ALE)

Answer

Vulnerability severity scores (CVSS)

Answer

Number of security incidents per year

Question 14

A power utility subject to NERC CIP standards is planning to deploy a new SCADA system. Which of the following requirements is MOST likely mandated by NERC CIP?

Accepted Answer

Establishment of an electronic security perimeter around critical cyber assets. NERC CIP standards require identification and protection of critical cyber assets, including clear boundaries (electronic security perimeters) to control access.

Answer

Adoption of a cloud-based backup solution

Answer

Use of quantum-resistant encryption for all communications

Answer

Implementation of IEC 62443 security levels

Question 15

An organization is evaluating cyber insurance options. Which of the following factors is MOST likely to influence the insurance premium?

Accepted Answer

The organization's cybersecurity maturity and incident history. An organization's cybersecurity maturity and incident history (C) is the most direct factor influencing cyber insurance premiums because insurers assess the likelihood and potential cost of a claim based on the organization's security controls, past breaches, and risk management practices. A mature security posture with few incidents lowers the perceived risk and therefore the premium.

Answer

The organization's annual revenue

Answer

The number of employees in the IT department

Answer

The organization's credit rating