CRISC Information Technology and Security Practice Test 7 — 15 Questions

Question 1

Which enterprise architecture layer is most directly responsible for managing the storage and processing of data, and for which data classification and encryption controls are critical?

Accepted Answer

Data architecture. Data architecture is the enterprise architecture layer that defines how data is stored, managed, and processed, including data models, data flows, and storage structures. Data classification and encryption controls are critical at this layer because they directly protect the confidentiality and integrity of data at rest and in transit, ensuring compliance with policies and regulations.

Answer

Application architecture

Answer

Technology architecture

Answer

Business architecture

Question 2

A risk manager is evaluating the application of IEC 62443 for industrial control systems. Which THREE of the following are key security requirements addressed by this standard?

Accepted Answer

Identification and authentication control. IEC 62443 is a series of standards specifically designed for the security of Industrial Automation and Control Systems (IACS). It addresses cybersecurity requirements to protect these systems from cyber threats. Identification and authentication control (B) is a foundational requirement, ensuring that only authorized users and devices can access the system, which is critical for preventing unauthorized access to industrial processes.

Answer

Environmental monitoring (temperature, humidity)

Answer

Physical security of data centers

Question 3

An organization is developing a new cloud-based application that will process personal data of EU citizens. The risk manager is assessing the shared responsibility model with the cloud service provider (CSP). Which of the following is the MOST critical risk to address in the risk assessment?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. When processing EU citizens' personal data in the cloud, the most critical risk is data sovereignty and cross-border transfer restrictions under GDPR. The regulation limits transfers of personal data outside the EU/EEA unless adequate safeguards (e.g., Standard Contractual Clauses, adequacy decisions) are in place. A CSP may store or replicate data in regions the organization did not intend, creating legal exposure that outweighs the other technical risks.

Answer

Lack of encryption at rest

Answer

Vendor lock-in due to proprietary APIs

Answer

Multi-tenancy isolation failures

Question 4

A manufacturing company is integrating its operational technology (OT) network with the corporate IT network to enable real-time data analytics. Which of the following risks should be prioritized during the risk assessment?

Accepted Answer

Attack path expansion from IT to OT networks. Integrating OT and IT networks creates a new attack path from the IT network to the OT network. Since OT systems often lack modern security controls and run legacy protocols (e.g., Modbus, DNP3), an attacker who compromises the IT network can pivot into the OT environment, potentially disrupting physical processes. This risk is prioritized because it introduces a direct, high-impact threat to safety and availability that did not exist before the integration.

Answer

Incompatibility of IT and OT software versions

Answer

Increased latency in OT communications

Answer

Loss of data integrity in analytics dashboards

Question 5

A risk manager is designing an IT risk management program. According to COBIT 2019, which governance objective is specifically focused on ensuring that risk management is optimized?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's governance objectives are organized under the EDM (Evaluate, Direct, Monitor) domain. EDM03 — Ensure Risk Optimization is the specific governance objective that ensures enterprise risk is identified, assessed, and managed within the entity's risk appetite, and that risk management activities are optimized. It is the governance-level counterpart to the management-level APO12 (Manage Risk) objective.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 6

A financial institution is considering adopting a new AI/ML model for credit scoring. The model uses customer demographic data and transaction history. Which of the following risks is MOST likely to cause regulatory penalties if not addressed?

Accepted Answer

Model bias leading to unfair lending practices. Model bias leading to unfair lending practices is the most likely risk to cause regulatory penalties because credit scoring is heavily regulated under fair lending laws such as the Equal Credit Opportunity Act (ECOA) and Fair Housing Act. If an AI/ML model uses demographic data and produces disparate impact on protected classes, regulators can impose fines, sanctions, and enforcement actions. Unlike data privacy or model drift, bias directly violates anti-discrimination statutes, making it a legal compliance issue with immediate regulatory consequences.

Answer

Data privacy of training data

Answer

Model drift due to changing economic conditions

Answer

Adversarial attacks on the model

Question 7

During the solution architecture review, the Architecture Review Board (ARB) identifies a security risk in a proposed cloud migration project. The solution relies on a single cloud region with no disaster recovery plan. Which of the following is the BEST recommendation to mitigate this risk?

Accepted Answer

Deploy the application across multiple cloud regions with automated failover. The identified risk is the lack of disaster recovery for a single-region cloud deployment. The best mitigation is to deploy across multiple cloud regions with automated failover, which directly addresses the availability and resilience gap by ensuring the application survives a regional outage. This is a preventive/architectural control that reduces both likelihood and impact of downtime.

Answer

Purchase cyber insurance to cover financial losses

Answer

Implement encryption at rest and in transit

Answer

Conduct a business impact analysis (BIA)

Question 8

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. The [CORRECT] answer is A. NERC CIP standards (specifically CIP-005) mandate the establishment and protection of Electronic Security Perimeters (ESPs) around critical cyber assets. Connecting a remote substation's OT network to the corporate WAN inherently crosses an ESP boundary, requiring strict controls such as firewalls, access control lists, and monitored electronic access points. Failure to properly define and secure the ESP is a direct compliance violation and the most significant risk because it exposes critical infrastructure to cyber threats.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols

Question 9

Which of the following is the PRIMARY purpose of a risk register in an IT risk management program?

Accepted Answer

To document and track identified risks and their treatment plans. The risk register is the central repository for documenting identified risks, their assessed impact and likelihood, and the corresponding treatment plans (e.g., mitigate, accept, transfer, avoid). Its primary purpose is to provide a structured, living record that enables ongoing tracking, prioritization, and management of risk treatment activities throughout the IT risk management lifecycle.

Answer

To provide a historical record of past incidents

Answer

To calculate key risk indicators (KRIs)

Answer

To ensure compliance with regulatory requirements

Question 10

An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?

Accepted Answer

Implementing continuous security monitoring of network traffic. The NIST Cybersecurity Framework's Detect function (DE) covers activities that identify the occurrence of a cybersecurity event, including continuous security monitoring (DE.CM), anomaly and event detection (DE.AE), and detection processes (DE.DP). Implementing continuous security monitoring of network traffic maps directly to DE.CM-1 (network monitoring) and is the clearest example of a Detect activity. It is about discovering events, not responding to or preventing them.

Answer

Developing an incident response plan

Answer

Conducting a business impact analysis

Answer

Establishing a patch management process

Question 11

A risk manager is evaluating the potential impact of quantum computing on the organization's encryption infrastructure. The organization uses RSA-2048 for key exchanges and digital signatures. According to current quantum computing projections, what is the MOST urgent risk management action to take?

Accepted Answer

Begin a cryptographic inventory and develop a migration plan to post-quantum cryptography. Quantum computers capable of breaking RSA-2048 are not imminent but expected within 10-20 years. The most urgent action is to start planning for post-quantum cryptography migration, as it requires long lead times for assessment and implementation.

Answer

Immediately replace all RSA-2048 keys with symmetric encryption

Answer

Purchase cyber insurance to cover potential losses from quantum attacks

Answer

Increase the RSA key length to 4096 bits

Question 12

An organization is deploying a large number of IoT sensors in a smart building project. The sensors are from multiple vendors and some have limited firmware update capabilities. Which of the following risks should be the PRIMARY concern for the risk manager?

Accepted Answer

Inability to patch vulnerabilities in legacy IoT devices. IoT devices with limited or no firmware update capability represent an unpatched, persistent attack surface that cannot be remediated through normal vulnerability management — this is the primary risk because it is both high-likelihood and difficult to mitigate. Unlike interoperability or power issues, unpatchable firmware means known CVEs remain exploitable for the device's entire lifecycle, and IoT devices are frequently recruited into botnets (e.g., Mirai). For a risk manager, the inability to patch is the foundational risk that amplifies all others.

Answer

Data sovereignty of sensor data stored in the cloud

Answer

Interoperability issues between different sensor protocols

Answer

High energy consumption of sensors

Question 13

Which of the following is a key component of an IT risk management programme design?

Accepted Answer

Risk assessment methodology. A risk assessment methodology defines the process for identifying, analyzing, and evaluating risks, which is a core component of any risk management programme.

Answer

Incident response playbooks

Answer

Vendor security assessment reports

Answer

Network topology diagrams

Question 14

Which THREE of the following are key considerations when evaluating cyber insurance coverage? (Select three.)

Accepted Answer

Exclusions for acts of war or state-sponsored attacks. Cyber insurance policies have specific coverage scopes, exclusions (e.g., war, negligence), and prerequisites (e.g., multi-factor authentication). Premium factors like security controls also affect cost.

Answer

Company's stock price volatility

Answer

Office location and building security

Question 15

An organization is implementing IEC 62443 for its industrial control systems. Which THREE of the following are key requirements of IEC 62443? (Select three.)

Accepted Answer

Applying security levels (SL) to each zone based on risk. Option A is correct because IEC 62443 requires assigning Security Levels (SL 1–4) to each zone and conduit based on the assessed risk, so that target security levels can be defined and verified for the assets within them. Option B is correct because IEC 62443-4-1 specifies secure development lifecycle (SDL) requirements for product suppliers, including practices such as threat modeling, secure coding, and vulnerability handling for industrial components. Option D is correct because the standard mandates a risk assessment as the foundation for identifying zones and conduits, which are then used to segment the ICS network and apply appropriate countermeasures. Option C is incorrect because IEC 62443 promotes open, standards-based and interoperable protocols rather than proprietary ones, which can hinder security monitoring and integration. Option E is incorrect because the standard favors defense-in-depth and segmentation across multiple vendors and layers, not single-vendor lock-in, which does not by itself reduce risk.

Answer

Using proprietary protocols to enhance performance

Answer

Implementing a single-vendor solution to reduce complexity