CRISC Information Technology and Security Practice Test 7 — 15 Questions

Question 1

An organization is implementing a new cloud-based CRM system. The risk manager is reviewing the solution architecture for security risks. Which architectural layer should be evaluated to ensure data encryption at rest and in transit?

Accepted Answer

Data architecture. Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

Answer

Application architecture

Answer

Infrastructure architecture

Answer

Business architecture

Question 2

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Accepted Answer

Implement a unidirectional gateway that enforces one-way data flow. A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

Answer

Deploy a host-based intrusion detection system on each ICS device

Answer

Upgrade the ICS to modern protocols with built-in authentication

Answer

Disconnect the ICS from the corporate network and use manual data transfer

Question 3

According to COBIT 2019, which governance objective is primarily concerned with evaluating, directing, and monitoring the management of IT risk?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the governance objective that focuses on evaluating, directing, and monitoring risk management to ensure the enterprise's risk appetite and risk tolerance are understood and articulated.

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 4

A financial institution is evaluating cyber insurance to cover potential losses from a ransomware attack. Which factor is most likely to increase the insurance premium?

Accepted Answer

Weak access controls and lack of multi-factor authentication. Weak access controls (e.g., lack of multi-factor authentication) increase the likelihood and potential impact of a ransomware attack, leading insurers to charge higher premiums.

Answer

Regular third-party security audits

Answer

Comprehensive security awareness training for all employees

Answer

Implementation of multi-factor authentication across all systems

Question 5

An organization uses AI/ML for credit scoring decisions. The risk manager is concerned about regulatory compliance if the model cannot explain its decisions. Which AI risk is most directly addressed by requiring explainability?

Accepted Answer

Model bias. Requiring explainability in an AI/ML credit scoring model directly addresses model bias because it forces the model to reveal which input features (e.g., income, zip code) drive its decisions. Without explainability, the organization cannot detect or prove that the model is not discriminating against protected groups, violating regulations like the Equal Credit Opportunity Act (ECOA) or GDPR's right to explanation. Explainability is the primary technical control to audit and mitigate bias in automated decision-making.

Answer

Data privacy in AI training

Answer

Vendor lock-in

Answer

Adversarial attacks

Question 6

A company's risk management policy requires a risk register to be maintained. Which of the following is the primary purpose of a risk register?

Accepted Answer

To document and track identified risks, assessments, and risk responses. The primary purpose of a risk register is to serve as a central repository for documenting and tracking all identified risks, their assessments (including likelihood and impact), and the corresponding risk response strategies. This ensures that risk management activities are transparent, auditable, and actionable throughout the risk lifecycle, aligning with the ISACA CRISC framework.

Answer

To assign financial values to all risks

Answer

To record audit findings

Answer

To provide a list of all IT assets

Question 7

Which of the following is a key component of the NIST Cybersecurity Framework's Identify function?

Accepted Answer

Risk assessment. The Identify function includes asset management, business environment, governance, risk assessment, and risk management strategy. Risk assessment is a key component.

Answer

Response planning

Answer

Recovery plan implementation

Answer

Anomalies and events detection

Question 8

A risk manager is evaluating IoT device risks for a smart building project. Which TWO of the following are significant IoT security risks?

Accepted Answer

Firmware update challenges. IoT devices often have limited security capabilities, leading to expanded attack surface and difficulty in applying firmware updates. These are common IoT risks.

Answer

Data sovereignty compliance

Answer

Quantum computing threat to cryptography

Answer

Vendor lock-in

Question 9

According to the FAIR model, which TWO of the following are primary components used to calculate probable financial impact of a cyber incident?

Accepted Answer

Loss Magnitude (LM). FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). These two components are multiplied to derive risk.

Answer

Threat intelligence feed

Answer

Control effectiveness score

Answer

Vulnerability severity score

Question 10

A risk manager is designing an IT risk management programme. Which THREE of the following are essential components of a risk management policy?

Accepted Answer

Risk assessment methodology. A risk assessment methodology is an essential component of a risk management policy because it defines the standardized approach for identifying, analyzing, and evaluating IT risks. Without a prescribed methodology, risk assessments would be inconsistent, making it impossible to compare risks across the organization or to align them with the risk appetite. The policy must mandate a repeatable process, such as NIST SP 800-30 or ISO 31010, to ensure objectivity and defensibility in risk decisions.

Answer

Specific risk treatment plans

Answer

Detailed risk register

Question 11

An enterprise is migrating to a public cloud environment. Which THREE of the following are critical cloud-specific risk considerations?

Accepted Answer

Multi-tenancy isolation failures. Cloud-specific risks include data sovereignty, multi-tenancy isolation, and shared responsibility model gaps. Vendor lock-in is also common but not always considered 'critical' for all migrations.

Answer

On-premises network latency

Answer

Legacy system compatibility

Question 12

A risk manager is assessing IT/OT convergence risks at a manufacturing plant. Which TWO of the following are primary risks introduced by connecting industrial control systems to the corporate network?

Accepted Answer

Attack path expansion from IT to OT. Attack path expansion allows attackers to move from IT to OT. Legacy systems often have weak security. Both are primary risks.

Answer

Reduced operational efficiency

Answer

Increased data storage costs

Answer

Simplified remote access

Question 13

Which TWO of the following are key functions of an Architecture Review Board (ARB) in managing risk?

Accepted Answer

Reviewing solution architectures for security risks before implementation. Option C is correct because a primary function of an Architecture Review Board (ARB) is to evaluate solution architectures for security risks prior to implementation. This proactive review ensures that security controls are embedded in the design phase, reducing the likelihood of vulnerabilities being introduced into production systems.

Answer

Managing user access controls

Answer

Performing daily vulnerability scans

Answer

Responding to security incidents

Question 14

Which THREE of the following are typical exclusions in a cyber insurance policy?

Accepted Answer

Losses due to power outages without malicious intent. Common exclusions include acts of war, intentional acts by the insured, and infrastructure failure without malicious intent. Some policies also exclude social engineering.

Answer

Ransomware payments

Answer

Social engineering fraud

Question 15

An organization is planning for post-quantum cryptography migration. Which THREE of the following are key considerations for this migration?

Accepted Answer

Inventory of all cryptographic assets and dependencies. Option A is correct because a comprehensive inventory of cryptographic assets and dependencies is essential to identify all systems, applications, and data that rely on current cryptographic algorithms (e.g., RSA, ECDSA, Diffie-Hellman). Without this inventory, the organization cannot prioritize migration efforts, assess impact, or ensure that no legacy cryptographic dependency is overlooked during the transition to post-quantum algorithms.

Answer

Replacing all existing hardware immediately

Answer

Eliminating cloud services to reduce risk