CRISC Information Technology and Security Practice Test 6 — 15 Questions

Question 1

Which of the following is a primary goal of the 'Protect' function in the NIST Cybersecurity Framework?

Accepted Answer

Develop and implement appropriate safeguards to ensure delivery of critical services. The NIST Cybersecurity Framework's Protect function (PR) is defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. It covers areas like access control, awareness training, data security, and protective technology — all aimed at limiting or containing the impact of a potential cybersecurity event.

Answer

Develop and implement appropriate activities to identify the occurrence of a cybersecurity event

Answer

Develop and implement appropriate activities to take action regarding a detected cybersecurity event

Answer

Develop and implement appropriate activities to maintain plans for resilience

Question 2

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Accepted Answer

Inability to apply security patches due to legacy firmware. IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Answer

Interference with radio frequency signals

Answer

Limited data storage capacity

Answer

High power consumption leading to operational costs

Question 3

A risk manager is assessing the potential impact of quantum computing on the organization's cryptographic infrastructure. What is the MOST immediate action the organization should take?

Accepted Answer

Conduct a cryptographic inventory to identify vulnerable systems. The first step is to inventory all cryptographic systems to understand where quantum-vulnerable algorithms are used, enabling a migration plan.

Answer

Purchase quantum-resistant hardware security modules

Answer

Immediately replace all encryption with post-quantum algorithms

Answer

Discontinue use of public key cryptography

Question 4

An organization is implementing an AI/ML model for credit approval decisions subject to regulatory oversight. Which TWO of the following are the most significant risk considerations?

Accepted Answer

Model bias causing discriminatory outcomes. Option A (Model bias causing discriminatory outcomes) is correct because credit approval is a legally regulated decision domain where biased models can produce discriminatory lending practices, violating fair-lending laws such as the Equal Credit Opportunity Act (ECOA) and Fair Housing Act, exposing the organization to enforcement actions and reputational harm. Option B (Model explainability for regulatory compliance) is correct because regulators in credit decisions require the ability to understand and justify adverse action reasons, typically under regulations like the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA), making explainability essential for compliance and auditability. Options C, D, and E, while relevant to AI/ML generally, are not the most significant risk considerations in this specific regulated credit-approval scenario: data privacy (C) matters but is secondary to fairness and explainability in lending regulation, high computational cost (D) is an operational efficiency concern rather than a regulatory risk, and adversarial attacks on training data (E) are a security concern that is less directly tied to the regulatory oversight governing credit decisions.

Answer

Data privacy in AI training

Answer

High computational cost of model retraining

Answer

Adversarial attacks on the training data

Question 5

A global company is moving its critical applications to a public cloud. Which THREE of the following are key risk considerations in the shared responsibility model?

Accepted Answer

Identity and access management. In the shared responsibility model, the cloud provider secures the physical infrastructure, while the customer remains responsible for securing what they put in the cloud. Option B (Identity and access management) is correct because the customer must manage their own users, roles, permissions, and authentication mechanisms (e.g., IAM policies, MFA) to prevent unauthorized access to cloud resources. Option C (Compliance with regulatory requirements for data handling) is correct because the customer is accountable for ensuring that data stored and processed in the cloud meets applicable laws and standards such as GDPR, HIPAA, or PCI DSS, even though the provider may offer compliant infrastructure. Option D (Data encryption and key management) is correct because protecting data at rest and in transit, along with managing encryption keys (e.g., via KMS or customer-managed keys), is a customer responsibility in the shared model. Option A (Physical security of data centers) is not a customer risk consideration because the cloud provider is responsible for physical security of its facilities. Option E (Network firewall configuration) is not marked correct because, while customers often manage firewalls and security groups, the question asks for key risk considerations in the shared responsibility model, and firewall configuration is a specific control rather than a broad risk category like IAM, compliance, or encryption/key management.

Answer

Physical security of data centers

Answer

Network firewall configuration

Question 6

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Accepted Answer

Segmentation of networks into zones and conduits. IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

Answer

Mandatory cloud-based backup for all control systems

Answer

Annual penetration testing by an external firm

Answer

Use of AES-256 encryption for all communications

Question 7

An organization is implementing COBIT 2019 and the board has requested assurance that risk management activities are aligned with business objectives. Which governance objective is primarily focused on ensuring risk optimization through evaluation, direction, and monitoring?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's EDM03 — Ensure Risk Optimization is the governance objective that ensures enterprise risk management activities are aligned with business objectives by evaluating, directing, and monitoring risk appetite, tolerance, and capacity. It is the EDM domain objective specifically focused on risk optimization, making it the correct answer for the board's assurance need described.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Question 8

A risk manager is designing an IT risk management program. Which document should serve as the primary source for defining the organization's approach to risk assessment, treatment, and reporting?

Accepted Answer

Risk management policy. The risk management policy is the authoritative document that establishes the organization's overall approach to risk management, including the principles, roles, responsibilities, and processes for risk assessment, treatment, and reporting. It sets the governance framework and mandates how risk activities must be conducted across the IT environment, ensuring consistency and alignment with business objectives.

Answer

IT strategy

Answer

Business continuity plan

Answer

Risk register

Question 9

A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.

Answer

Multi-tenancy isolation failures

Answer

Shared responsibility model gaps for patching

Answer

Vendor lock-in due to proprietary APIs

Question 10

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?

Accepted Answer

Expanded attack path from IT to OT systems. The convergence of IT and OT networks creates a bridge between two environments that were traditionally air-gapped. This bridge allows threats that compromise the corporate IT network to pivot into the industrial control systems (ICS), expanding the attack surface and providing adversaries with a direct path to operational technology (OT). Unlike licensing costs or analytics complexity, this is a direct security risk that can lead to physical consequences, making it the most critical risk introduced by such integration.

Answer

Higher licensing costs for industrial software

Answer

Increased complexity of data analytics

Answer

Reduced operational efficiency due to network latency

Question 11

Which component of the NIST Cybersecurity Framework is primarily concerned with developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The NIST Cybersecurity Framework Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. The Protect function is explicitly defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services, covering areas like access control, awareness training, data security, and protective technology. This matches the question's wording exactly, making Protect the correct answer.

Answer

Detect

Answer

Identify

Answer

Recover

Question 12

A risk practitioner is using the FAIR model to quantify cyber risk for a proposed new online payment system. Which factor must be estimated to calculate the probable financial impact of a data breach?

Accepted Answer

Loss magnitude. In the FAIR (Factor Analysis of Information Risk) model, risk is quantified as the probable frequency and probable magnitude of future loss. To calculate the probable financial impact of a data breach, the practitioner must estimate Loss Magnitude — the monetary value of the loss event, typically broken down into primary loss (response, replacement, fines) and secondary loss (reputation, legal, competitive advantage). Threat event frequency drives the probability side of the equation, not the impact side.

Answer

Threat event frequency

Answer

Vulnerability severity score

Answer

Annualized rate of occurrence

Question 13

A bank is considering adopting artificial intelligence for credit scoring. The risk manager identifies that the AI model might produce biased outcomes against certain demographic groups. Which AI/ML risk is most directly associated with this concern?

Accepted Answer

Model bias. Model bias occurs when an AI/ML model produces systematically unfair outcomes against certain demographic groups, often because training data reflects historical discrimination or underrepresentation. In credit scoring, if the model learns from historical lending data that excluded or disadvantaged certain groups, it will replicate and even amplify that bias. This is the risk most directly associated with biased outcomes.

Answer

Adversarial attacks

Answer

Explainability requirements

Answer

Data privacy in AI training

Question 14

An organization is deploying a large number of Internet of Things (IoT) sensors for environmental monitoring in a remote facility. The sensors have limited processing power and cannot be patched easily. Which risk should the risk manager prioritize?

Accepted Answer

Expanded attack surface with unpatched devices. IoT sensors with limited processing power that cannot be easily patched represent a classic expanded attack surface with unpatched devices. Each unpatched sensor is a potential entry point into the network, and the sheer number of devices multiplies the risk. Because patching is infeasible, compensating controls (network segmentation, monitoring, least privilege) become critical, making this the priority risk for the risk manager.

Answer

Vendor lock-in to proprietary protocols

Answer

Insufficient bandwidth for data transmission

Answer

Data integrity issues from sensor malfunction

Question 15

A risk manager is assessing the impact of quantum computing on the organization's cryptographic infrastructure. The timeline for quantum advantage is estimated to be 10 years. What is the most appropriate immediate action to address this risk?

Accepted Answer

Begin post-quantum cryptography migration planning and crypto-agility assessment. Beginning post-quantum cryptography (PQC) migration planning and crypto-agility assessment is the most appropriate immediate action because it addresses the long-term risk without premature disruption. Crypto-agility ensures systems can quickly switch algorithms, and planning allows for a smooth transition as standards mature. This proactive approach aligns with risk management principles.

Answer

Increase key lengths for all symmetric encryption to 256 bits

Answer

Ignore the risk until quantum computers are commercially available

Answer

Replace all existing cryptographic algorithms with post-quantum algorithms immediately