CRISC Information Technology and Security Practice Test 9 — 15 Questions

Question 1

A risk practitioner is assessing the security of a new software-defined wide area network (SD-WAN) deployment that will carry regulated traffic between branch offices and a cloud environment. The vendor's controller is managed by a third party. Which of the following risks should the practitioner identify as the MOST significant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SD-WAN controller could be compromised through the third-party management interface, allowing policy manipulation and traffic redirection.. In SD-WAN architectures, the controller is a high-value target because it defines and enforces forwarding, segmentation, and encryption policies across all sites. When that controller is managed by a third party, the organization inherits supply-chain and access-control risk. A compromise there can bypass many perimeter defenses and affect every branch simultaneously, so it warrants the greatest attention in a risk assessment of regulated traffic.

Answer

Branch office staff may bypass the SD-WAN by using personal mobile hotspots for internet access.

Answer

The organization may lose visibility into application performance across the SD-WAN fabric.

Answer

SD-WAN appliances may not support the organization's existing network access control (NAC) solution.

Question 2

A risk practitioner is assessing the risk associated with the organization's use of third-party APIs that integrate with its core banking platform. The practitioner needs to determine the MOST effective way to monitor the risk exposure of these APIs on an ongoing basis. Which of the following approaches BEST addresses this requirement?

Accepted Answer

Implement API gateway logging and monitor for anomalous behavior using predefined risk thresholds.. Continuous monitoring of third-party API risk requires real-time or near-real-time data. API gateway logging with anomaly detection and risk thresholds provides ongoing visibility into API usage and potential threats. Other options like annual assessments, monthly reports, or static scores are point-in-time or retrospective and do not meet the need for continuous monitoring of dynamic risk exposure.

Answer

Use a static risk score assigned to each third-party API at onboarding.

Answer

Conduct an annual security assessment of each third-party API provider.

Answer

Require third-party API providers to submit monthly compliance reports.

Question 3

A risk practitioner is helping a mid-sized healthcare organization update its IT risk register after migrating patient scheduling to a SaaS platform. The vendor's SOC 2 Type II report shows no exceptions, but the contract omits breach notification timelines and data deletion commitments. Which action BEST addresses the residual risk?

Accepted Answer

Amend the contract to include specific breach notification timelines, data deletion rights, and audit rights, then reassess the residual risk.. The vendor's SOC 2 Type II report gives assurance over controls, but it does not replace contractual protections. Missing breach notification timelines and data deletion commitments create legal, regulatory, and reputational risk that the organization must address. Amending the contract to include these terms, along with audit rights, directly mitigates the gap and allows the risk practitioner to reassess residual risk accurately.

Answer

Accept the risk because the SOC 2 Type II report confirms the vendor's controls are operating effectively.

Answer

Transfer the risk by purchasing a cyber insurance policy that covers third-party data breaches.

Answer

Perform a penetration test against the SaaS platform to validate the vendor's security controls.

Question 4

A retail company is migrating its customer loyalty application to a cloud provider. During a risk assessment, the risk practitioner notes that the provider's infrastructure is shared across many tenants. Which of the following is the MOST significant risk that this multi-tenancy introduces?

Accepted Answer

A vulnerability in the provider's isolation controls could allow one tenant to access another tenant's data.. Multi-tenancy introduces the risk that logical isolation controls may fail, allowing one tenant to access another tenant's data or workloads. This directly threatens confidentiality and integrity and is unique to shared cloud environments. Other risks such as provider failure, loss of scanning, or price changes are important but are not caused by the shared infrastructure model itself.

Answer

The cost of cloud services may increase unexpectedly due to provider pricing changes.

Answer

The organization loses the ability to perform its own vulnerability scanning on the underlying infrastructure.

Answer

The cloud provider may go out of business, causing an abrupt loss of service.

Question 5

A hospital's radiology department wants to replace its on-premises PACS archive (DICOM images) with a vendor-hosted SaaS platform. The vendor stores images in its own multitenant cloud and provides a web viewer. Before signing, the risk practitioner must confirm which control MOST directly addresses the risk that a vendor-side compromise could expose patient images to other tenants.

Accepted Answer

Verify the vendor enforces strict tenant isolation and encryption key separation in the multitenant storage layer.. Because the images would reside in a shared multitenant platform, the risk that matters most is logical separation failure between customers. Confirming enforced tenant isolation with segregated encryption keys directly addresses that failure mode. Audit reports, right-to-audit clauses and internal penetration tests provide valuable assurance and leverage but do not specifically prevent one tenant from accessing another tenant's DICOM data.

Answer

Require the vendor to publish a SOC 2 Type II report covering the last twelve months.

Answer

Require annual penetration testing of the hospital's own internal network by an external firm.

Answer

Confirm the contract includes a right-to-audit clause allowing the hospital to inspect the vendor's data center.

Question 6

A hospital network is deploying a new medical imaging archive. The risk practitioner learns that the vendor's support engineers require remote access to the archive for maintenance. Which of the following is the BEST control to manage the third-party access risk?

Accepted Answer

Implement privileged access management with session recording, just-in-time elevation, and full session brokering through a jump host.. Third-party remote access creates standing privileged exposure that must be constrained technically, not just contractually. Privileged access management with just-in-time elevation, credential vaulting, session brokering, and recording limits vendor reach to approved windows and produces attributable evidence. Policy signatures, standing admin accounts, and insurance certificates leave the actual access path uncontrolled.

Answer

Grant vendor engineers a dedicated local administrator account with a strong password rotated every 90 days.

Answer

Require the vendor to carry cyber insurance and provide a certificate of insurance annually.

Answer

Require vendor engineers to sign an annual acceptable use policy before access is granted.

Question 7

A risk practitioner is evaluating the organization's identity and access management (IAM) controls as part of an IT risk assessment. The organization has a hybrid environment with on-premises Active Directory and a cloud identity provider. Which TWO of the following are the MOST significant risks that should be prioritized? (Choose two.)

Accepted Answer

Inconsistent identity synchronization between the on-premises directory and the cloud identity provider, leading to stale or orphaned accounts.. In hybrid IAM, the greatest risks arise from controls that grant or preserve broad access without adequate oversight. Excessive standing privileges on service accounts enable attackers to move laterally and persist, while synchronization failures can leave active cloud credentials for users who should no longer have access. Both directly undermine the principle of least privilege and are often missed because they sit between on-premises and cloud governance processes.

Answer

The organization uses single sign-on (SSO) for cloud applications, which may create a single point of failure.

Answer

Users are required to change passwords every 90 days without a history check.

Answer

Some legacy applications do not support multi-factor authentication (MFA).

Question 8

A global retailer is migrating its point-of-sale (POS) transaction processing to a public cloud provider. The risk practitioner must ensure that the organization's payment card data remains compliant with PCI DSS. Which of the following is the MOST appropriate control to implement FIRST?

Accepted Answer

Conduct a data discovery and classification exercise to identify all cardholder data locations.. The first step in any cloud migration involving cardholder data is to discover and classify that data to define the PCI DSS scope. Without knowing where the data resides, the organization cannot accurately apply encryption, firewalls, or contractual controls. Data discovery ensures that all subsequent risk treatments are targeted and complete, forming the foundation for compliance.

Answer

Implement a web application firewall (WAF) in front of the cloud-based POS application.

Answer

Require the cloud provider to sign a PCI DSS attestation of compliance (AOC).

Answer

Encrypt all cardholder data at rest and in transit using strong cryptography.

Question 9

A risk manager is evaluating the security of a new containerized application deployment in a hybrid cloud environment. The organization uses Kubernetes for orchestration and must ensure that container images are free from known vulnerabilities before deployment. Which of the following controls is MOST effective for this purpose?

Accepted Answer

Integrating a container image scanning tool into the CI/CD pipeline.. The most effective control for ensuring container images are free from known vulnerabilities before deployment is to integrate image scanning into the CI/CD pipeline. This allows automated detection and blocking of vulnerable images at build time. Runtime monitoring, network policies, and service meshes address other security aspects but do not meet the pre-deployment vulnerability assurance requirement.

Answer

Enforcing network policies to restrict container-to-container communication.

Answer

Using a service mesh to encrypt all traffic between microservices.

Answer

Implementing runtime security monitoring using a tool like Falco.

Question 10

A retail company is moving its customer loyalty application to a SaaS platform. The risk practitioner must ensure that the cloud provider's security controls are adequate. Which of the following is the MOST effective way to obtain assurance over the provider's controls?

Accepted Answer

Review the provider's SOC 2 Type II report.. A SOC 2 Type II report is specifically designed to provide independent assurance over a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. It covers both design and operating effectiveness over a period, making it the most reliable evidence for a risk practitioner assessing a cloud provider's control environment.

Answer

Rely on the provider's ISO 9001 certification.

Answer

Conduct a penetration test of the provider's environment.

Answer

Request the provider's completed security questionnaire.

Question 11

A risk manager at a retail bank is assessing risks introduced by a new open-source container orchestration platform. The platform will host internal APIs that process non-public customer information. Which TWO of the following are the MOST significant risks that should be prioritized in the risk register? (Choose two.)

Accepted Answer

Hard-coded secrets and API keys in container images or orchestration manifests.. Unpatched container images and hard-coded secrets directly threaten the confidentiality and integrity of non-public customer information. These risks are highly exploitable and can lead to data breaches, regulatory penalties, and reputational damage. Policy gaps, licensing costs, and community support delays are important but secondary; they do not represent immediate, high-impact threats to customer data in a banking context.

Answer

The platform's community support model may delay resolution of non-security bugs.

Answer

Lack of a documented container orchestration policy and standards for secure configuration.

Answer

Increased licensing costs due to the open-source platform's commercial support model.

Question 12

A retail company's risk register lists 'unauthorized access to the customer loyalty database' with a likelihood of 4 and an impact of 5 on a 1-5 scale. The CISO asks the risk practitioner to reduce the risk to an acceptable level. Which action BEST represents risk treatment in this situation?

Accepted Answer

Deploy database activity monitoring and enforce least-privilege access to the loyalty database.. Risk treatment means selecting and applying controls that change the likelihood or impact of an identified risk. Enforcing least privilege and monitoring database activity directly reduce the chance of unauthorized access, which is the likelihood dimension in the register. Re-scoring, escalation and insurance are assessment, governance and transfer activities that leave the underlying exposure unchanged.

Answer

Report the risk to the board risk committee and request a decision on acceptance.

Answer

Recalculate the likelihood and impact scores with the database team and update the risk register.

Answer

Purchase a cyber insurance policy that covers privacy breach response costs.

Question 13

A risk practitioner is reviewing the organization's vulnerability management programme. The vulnerability scan report shows thousands of findings, and remediation teams are overwhelmed. Which of the following is the MOST effective approach to prioritize remediation?

Accepted Answer

Prioritize using threat intelligence and exploitability data combined with the business criticality of the affected assets.. Vulnerability management fails when severity is confused with risk. The most effective approach combines exploitability signals, such as active exploitation and threat intelligence, with the business criticality of the asset, so remediation effort targets findings that could actually harm the organization. A pure CVSS threshold, blanket assignment, or extra scanning does not answer the prioritization question.

Answer

Remediate all findings with a Common Vulnerability Scoring System (CVSS) base score of 7.0 or higher within 30 days.

Answer

Assign every finding to the system owner and require monthly status reporting until all findings are closed.

Answer

Purchase an additional scanning tool and run scans more frequently to build a complete inventory of findings.

Question 14

A hospital is implementing a new electronic health record (EHR) system. The risk practitioner is concerned about the risk of unauthorized access to patient data by internal staff. Which of the following controls is MOST effective in mitigating this risk?

Accepted Answer

Role-based access control (RBAC) with least privilege.. RBAC with least privilege is a preventive control that restricts access based on job roles, ensuring staff can only access the patient data necessary for their duties. This directly mitigates the risk of unauthorized internal access. While training, encryption, and monitoring are valuable, they do not prevent an authorized user from accessing data they should not see.

Answer

Logging and monitoring of all access to patient records.

Answer

Encryption of patient data at rest.

Answer

Annual security awareness training for all staff.

Question 15

A hospital's risk practitioner is evaluating a new telehealth platform that will process protected health information (PHI). The platform will be hosted by a third-party vendor. Which of the following is the MOST critical risk to address during contract negotiations?

Accepted Answer

The vendor's data breach notification timeline and liability for regulatory penalties.. When a third party processes PHI, the hospital must ensure the business associate agreement clearly assigns responsibility for breach notification and regulatory penalties. This contractual protection is the most critical risk treatment because it directly addresses the hospital's legal and financial exposure under HIPAA. Other concerns like subcontractors, uptime, and data residency are important but secondary to the allocation of liability.

Answer

The vendor's service level agreement (SLA) for platform uptime.

Answer

The vendor's use of subcontractors to support the platform.

Answer

The vendor's geographic location and data residency practices.