CRISC Information Technology and Security Practice Test 6 — 15 Questions

Question 1

An organization is developing a new cloud-based application that will process personal data of EU citizens. The risk manager is assessing the shared responsibility model with the cloud service provider (CSP). Which of the following is the MOST critical risk to address in the risk assessment?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. In the shared responsibility model, the customer is responsible for data classification and access controls. Data sovereignty is a key concern when processing EU personal data, as the CSP may store data in jurisdictions that do not provide equivalent protection. The risk manager must ensure contractual and technical measures align with GDPR requirements.

Answer

Lack of encryption at rest

Answer

Vendor lock-in due to proprietary APIs

Answer

Multi-tenancy isolation failures

Question 2

A manufacturing company is integrating its operational technology (OT) network with the corporate IT network to enable real-time data analytics. Which of the following risks should be prioritized during the risk assessment?

Accepted Answer

Attack path expansion from IT to OT networks. Integrating OT and IT networks creates a new attack path from the IT network to the OT network. Since OT systems often lack modern security controls and run legacy protocols (e.g., Modbus, DNP3), an attacker who compromises the IT network can pivot into the OT environment, potentially disrupting physical processes. This risk is prioritized because it introduces a direct, high-impact threat to safety and availability that did not exist before the integration.

Answer

Incompatibility of IT and OT software versions

Answer

Increased latency in OT communications

Answer

Loss of data integrity in analytics dashboards

Question 3

The risk committee is reviewing a cyber risk quantification report that uses the FAIR model. The report estimates the annualized loss expectancy (ALE) for a ransomware attack as $2.5 million. The committee asks the risk manager to explain the key components used to derive this figure. Which of the following is the MOST important factor in the FAIR model for calculating ALE?

Accepted Answer

Annualized rate of occurrence (ARO) and single loss expectancy (SLE). FAIR model calculates ALE by multiplying probable frequency (annualized rate of occurrence) with probable loss magnitude (financial impact per incident). Both are essential, but the frequency estimate often has higher uncertainty and drives the overall ALE.

Answer

Threat intelligence reports on ransomware gangs

Answer

Vulnerability severity scores (CVSS)

Answer

Historical loss data from industry benchmarks

Question 4

A risk manager is designing an IT risk management program. According to COBIT 2019, which governance objective is specifically focused on ensuring that risk management is optimized?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's EDM03 (Ensure Risk Optimization) is the governance objective that directs the evaluation, direction, and monitoring of risk management to align with enterprise risk appetite.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 5

A financial institution is considering adopting a new AI/ML model for credit scoring. The model uses customer demographic data and transaction history. Which of the following risks is MOST likely to cause regulatory penalties if not addressed?

Accepted Answer

Model bias leading to unfair lending practices. Regulators require explainability for credit decisions to ensure fairness and compliance with regulations like ECOA and GDPR. Model bias can lead to discriminatory outcomes, resulting in significant penalties.

Answer

Data privacy of training data

Answer

Model drift due to changing economic conditions

Answer

Adversarial attacks on the model

Question 6

During the solution architecture review, the Architecture Review Board (ARB) identifies a security risk in a proposed cloud migration project. The solution relies on a single cloud region with no disaster recovery plan. Which of the following is the BEST recommendation to mitigate this risk?

Accepted Answer

Deploy the application across multiple cloud regions with automated failover. The risk of a single region failure can be mitigated by implementing a multi-region deployment with failover. This aligns with high availability and disaster recovery best practices.

Answer

Purchase cyber insurance to cover financial losses

Answer

Implement encryption at rest and in transit

Answer

Conduct a business impact analysis (BIA)

Question 7

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols

Question 8

Which of the following is the PRIMARY purpose of a risk register in an IT risk management program?

Accepted Answer

To document and track identified risks and their treatment plans. The risk register is the central repository for documenting identified risks, their assessed impact and likelihood, and the corresponding treatment plans (e.g., mitigate, accept, transfer, avoid). Its primary purpose is to provide a structured, living record that enables ongoing tracking, prioritization, and management of risk treatment activities throughout the IT risk management lifecycle.

Answer

To provide a historical record of past incidents

Answer

To calculate key risk indicators (KRIs)

Answer

To ensure compliance with regulatory requirements

Question 9

An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?

Accepted Answer

Implementing continuous security monitoring of network traffic. The 'Detect' function focuses on identifying cybersecurity events in a timely manner. Continuous security monitoring is a key activity to detect anomalies and incidents.

Answer

Developing an incident response plan

Answer

Conducting a business impact analysis

Answer

Establishing a patch management process

Question 10

A risk manager is evaluating the potential impact of quantum computing on the organization's encryption infrastructure. The organization uses RSA-2048 for key exchanges and digital signatures. According to current quantum computing projections, what is the MOST urgent risk management action to take?

Accepted Answer

Begin a cryptographic inventory and develop a migration plan to post-quantum cryptography. Quantum computers capable of breaking RSA-2048 are not imminent but expected within 10-20 years. The most urgent action is to start planning for post-quantum cryptography migration, as it requires long lead times for assessment and implementation.

Answer

Immediately replace all RSA-2048 keys with symmetric encryption

Answer

Purchase cyber insurance to cover potential losses from quantum attacks

Answer

Increase the RSA key length to 4096 bits

Question 11

An organization is deploying a large number of IoT sensors in a smart building project. The sensors are from multiple vendors and some have limited firmware update capabilities. Which of the following risks should be the PRIMARY concern for the risk manager?

Accepted Answer

Inability to patch vulnerabilities in legacy IoT devices. IoT devices with limited firmware update capabilities create a long-term vulnerability, as they cannot be patched against newly discovered flaws. This expands the attack surface and increases risk over time.

Answer

Data sovereignty of sensor data stored in the cloud

Answer

Interoperability issues between different sensor protocols

Answer

High energy consumption of sensors

Question 12

Which of the following is a key component of an IT risk management programme design?

Accepted Answer

Risk assessment methodology. A risk assessment methodology defines the process for identifying, analyzing, and evaluating risks, which is a core component of any risk management programme.

Answer

Incident response playbooks

Answer

Vendor security assessment reports

Answer

Network topology diagrams

Question 13

A risk manager is assessing the risks of an IT/OT convergence project in a chemical plant. Which TWO of the following are the most significant security risks? (Select two.)

Accepted Answer

Increased attack surface from IT network to OT systems. A is correct because IT/OT convergence directly connects corporate IT networks to operational technology (OT) systems, expanding the attack surface. Attackers can pivot from IT to OT via protocols like Modbus/TCP or OPC UA, potentially disrupting critical industrial processes. This is the most significant risk as it introduces new vectors for ransomware or sabotage that were previously isolated by air gaps.

Answer

Increased need for IT support staff

Answer

Higher bandwidth consumption on OT networks

Answer

Loss of real-time visibility for operators

Question 14

Which THREE of the following are key considerations when evaluating cyber insurance coverage? (Select three.)

Accepted Answer

Exclusions for acts of war or state-sponsored attacks. Cyber insurance policies have specific coverage scopes, exclusions (e.g., war, negligence), and prerequisites (e.g., multi-factor authentication). Premium factors like security controls also affect cost.

Answer

Company's stock price volatility

Answer

Office location and building security

Question 15

An organization is implementing IEC 62443 for its industrial control systems. Which THREE of the following are key requirements of IEC 62443? (Select three.)

Accepted Answer

Applying security levels (SL) to each zone based on risk. IEC 62443 is a comprehensive standard covering security management, system design, and component requirements. It requires risk assessment, defense-in-depth (zones and conduits), and secure development lifecycle.

Answer

Using proprietary protocols to enhance performance

Answer

Implementing a single-vendor solution to reduce complexity