CRISC IT Risk Identification Practice Test 2 — 15 Questions

Question 1

A multinational corporation is expanding its cloud infrastructure to include a new SaaS application that stores sensitive customer data. The vendor claims compliance with SOC 2 Type II and ISO 27001. The risk manager must determine if the remaining residual risk after vendor controls is within the company's risk appetite. Which of the following is the MOST critical next step?

Accepted Answer

Conduct a data classification and legal review to identify applicable regulatory obligations.. Option B is correct because understanding the data classification and regulatory requirements determines if additional controls are needed beyond the vendor's certifications. Option A is wrong because certifications alone do not guarantee all risks are addressed. Option C is wrong because the vendor's own risk assessment may not consider the company's specific requirements. Option D is wrong because a pilot does not assess regulatory compliance.

Answer

Request the vendor's latest risk assessment report.

Answer

Perform a pilot deployment and monitor for security incidents.

Answer

Accept the vendor's certifications as sufficient evidence of control effectiveness.

Question 2

An organization is implementing a new identity and access management (IAM) system. The risk manager is tasked with identifying risks associated with the migration from legacy authentication to single sign-on (SSO). Which of the following is the GREATEST risk during this migration?

Accepted Answer

Legacy authentication accounts may remain active, creating orphan accounts.. Option D is correct because legacy accounts that are not disabled after migration become unmanaged orphan accounts, posing a significant security risk. Option A is wrong because increased user convenience is a benefit, not a risk. Option B is wrong while password reuse is a risk, it is less severe than orphan accounts. Option C is wrong because SSO typically reduces help desk calls for password resets.

Answer

Users may reuse strong passwords across multiple systems.

Answer

Users may experience increased convenience, leading to reduced security awareness.

Answer

Help desk call volumes may increase due to SSO authentication failures.

Question 3

A financial institution uses a third-party cloud service for data analytics. The service has access to non-public personal information (NPI). During a risk assessment, the risk manager discovers that the cloud provider uses subprocessors without notifying the institution. The contract does not require notification of subprocessor changes. What should the risk manager do FIRST?

Accepted Answer

Notify the vendor of the contract breach and request a list of all subprocessors and their compliance certifications.. Option A is correct because immediate termination may disrupt operations; the first step should be to notify the vendor of the breach and request a list of subprocessors to assess risk. Option B is wrong because immediately terminating the contract could cause significant business disruption. Option C is wrong because the risk manager should first gather information. Option D is wrong because accepting risk without understanding the subprocessors' controls is not prudent.

Answer

Report the incident to the data protection authority as a breach of contract.

Answer

Accept the risk since the vendor remains SOC 2 Type II certified.

Answer

Terminate the contract immediately to mitigate the risk of unauthorized data access.

Question 4

A healthcare organization is migrating its electronic health records (EHR) system to a public cloud. The risk manager identifies several risks. Which TWO of the following are the MOST significant risks related to data privacy and regulatory compliance?

Accepted Answer

Data residency and jurisdiction issues.. Data residency and jurisdiction issues (B) are a top risk because healthcare data is subject to strict regulations like HIPAA and GDPR, which may require data to remain within specific geographic boundaries. Migrating EHRs to a public cloud can inadvertently place data in regions with different legal protections, exposing the organization to non-compliance and legal penalties.

Answer

Potential for service downtime affecting patient care.

Answer

Loss of control over the cloud provider's internal access controls.

Answer

Vendor lock-in due to proprietary APIs.

Question 5

You are the IT risk manager for a mid-sized e-commerce company that processes over 10,000 transactions per day. The company recently migrated its customer database from an on-premises SQL Server to a cloud-based PostgreSQL instance on AWS RDS. The database contains personally identifiable information (PII) including names, addresses, and credit card numbers (stored as encrypted tokens). The migration was performed by the DevOps team with minimal involvement from the security team. Two weeks after the migration, the company experienced a data breach where an attacker exfiltrated a subset of customer records. The forensic investigation revealed that the attacker exploited a misconfigured security group that allowed inbound traffic from the internet on port 5432 (PostgreSQL default port). Additionally, the database had a publicly accessible endpoint, and the master user password was weak (eight characters, no special characters). The attacker used a brute-force attack to guess the password. The security group has since been corrected, and the password has been changed to a strong one. The breach notification laws require reporting within 72 hours. The CEO wants to understand the root cause and prevent recurrence. As the risk manager, which of the following actions should you recommend as the MOST effective to prevent a similar incident?

Accepted Answer

Implement infrastructure-as-code (IaC) security scanning and policy enforcement in the CI/CD pipeline to prevent insecure configurations.. Option C is correct because the root cause is the misconfigured security group and weak password, both of which stem from insufficient security review and lack of automated controls. Implementing a policy-as-code tool that enforces security group rules (e.g., no public access to databases) and password policies during deployment would prevent such misconfigurations. Option A is wrong because while a dedicated DBA could help, it does not address the process gap for automated enforcement. Option B is wrong because quarterly reviews are too infrequent to catch misconfigurations quickly. Option D is wrong because IDS/IPS detects attacks but does not prevent misconfigurations.

Answer

Deploy an intrusion detection system (IDS) to monitor database traffic for brute-force attempts.

Answer

Hire a dedicated database administrator to review all database configurations weekly.

Answer

Conduct quarterly security audits of cloud infrastructure configurations.

Question 6

A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?

Accepted Answer

Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.. Option C is correct because conducting a root cause analysis on the firewall misconfigurations will identify the underlying weaknesses in the change management process. Option A is wrong because increasing logging without analysis does not identify root cause. Option B is wrong because a penetration test may find vulnerabilities but not the process failure. Option D is wrong because updating the risk register is a result of identification, not a method to identify root cause.

Answer

Implement additional logging on all firewall devices to capture configuration changes.

Answer

Conduct a penetration test targeting all regional office networks to identify vulnerabilities.

Answer

Update the risk register to include the incidents and assign risk owners.

Question 7

A financial institution is integrating a new cloud-based analytics platform that will process sensitive customer data. The project team is conducting risk identification. Which technique would be MOST effective for identifying risks related to the integration of this platform with existing on-premises systems?

Accepted Answer

Threat modeling of the integration architecture.. Threat modeling of the integration architecture is the most effective technique because it systematically identifies potential security threats, attack vectors, and vulnerabilities specific to the data flows, trust boundaries, and API interactions between the cloud-based analytics platform and existing on-premises systems. Unlike generic methods, threat modeling (e.g., STRIDE or PASTA) focuses on the unique integration points, such as authentication handshakes, data-in-transit encryption (TLS 1.2/1.3), and session management, which are critical for protecting sensitive customer data during integration.

Answer

Vulnerability scanning of the cloud platform's API endpoints.

Answer

Brainstorming sessions with the project team.

Answer

SWOT analysis to assess strengths, weaknesses, opportunities, and threats.

Question 8

A retail company uses a legacy inventory system that is no longer supported by the vendor. The IT department is planning to migrate to a modern cloud-based system. During risk identification, which of the following should be considered a PRIMARY risk?

Accepted Answer

Loss of data integrity during the data migration process.. Loss of data integrity during migration is the primary risk because the legacy system is unsupported, meaning there are no vendor patches or tools to validate or repair data inconsistencies. Corrupted or incomplete data transferred to the cloud-based system can lead to inaccurate inventory records, financial losses, and operational disruptions that are difficult to reverse without vendor support.

Answer

Inadequate training of staff on the new system.

Answer

Potential cost overrun due to migration complexity.

Answer

Failure to decommission the legacy system after migration.

Question 9

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

Accepted Answer

Unauthorized access to patient medical records.. The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.

Answer

Denial of service due to excessive login attempts.

Answer

Insufficient encryption of data in transit.

Answer

Phishing attacks targeting portal users.

Question 10

A technology startup is developing a mobile payment application. During a risk identification workshop, the team identifies a risk that the application may not comply with Payment Card Industry Data Security Standard (PCI DSS) requirements. What is the BEST way to categorize this risk?

Accepted Answer

Compliance risk.. Non-compliance with PCI DSS is a direct violation of regulatory requirements, making it a compliance risk. For a mobile payment application handling cardholder data, PCI DSS mandates specific security controls (e.g., encryption of PAN, access controls, logging). Failure to meet these standards exposes the startup to fines, legal sanctions, and potential loss of the ability to process payments.

Answer

Strategic risk.

Answer

Operational risk.

Answer

Reputational risk.

Question 11

A manufacturing company uses an industrial control system (ICS) that is connected to the corporate network for monitoring. The risk manager is identifying risks related to this connectivity. Which of the following is the MOST significant risk?

Accepted Answer

Compromise of ICS causing physical damage to manufacturing equipment.. The most significant risk is that a compromise of the ICS could lead to physical damage, such as equipment destruction, safety hazards, or environmental release. Unlike IT systems where data loss is the primary concern, ICS failures directly impact the physical world, making safety and operational integrity the top priority in risk identification.

Answer

Malware infection spreading from corporate to ICS network.

Answer

Network congestion due to ICS traffic affecting corporate users.

Answer

Unauthorized access to corporate data through the ICS connection.

Question 12

Arrange the steps for performing a risk assessment in the correct order.

Question 13

Order the steps for incident response handling.

Question 14

Sequence the steps for developing a disaster recovery plan (DRP).

Question 15

Match each CRISC domain to its description.