CCNA Crisc It Security Questions

Connecting OT networks to IT networks expands the attack surface, allowing threats from the corporate network to reach ICS/SCADA systems, which were previously isolated.

Data sovereignty (regulatory), shared responsibility model (security gaps), and vendor lock-in (strategic) are key cloud risks that the ARB should assess before implementation.

A standardized risk assessment methodology is essential for consistent identification and assessment of risks across the enterprise.

Quantum computers capable of breaking RSA-2048 are not imminent but expected within 10-20 years. The most urgent action is to start planning for post-quantum cryptography migration, as it requires long lead times for assessment and implementation.

A risk assessment methodology defines the process for identifying, analyzing, and evaluating risks, which is a core component of any risk management programme.

The Protect function focuses on implementing safeguards to limit or contain the impact of a potential cybersecurity event.

The Protect function in NIST CSF outlines safeguards to manage cybersecurity risk and ensure service delivery.

FAIR model calculates ALE by multiplying probable frequency (annualized rate of occurrence) with probable loss magnitude (financial impact per incident). Both are essential, but the frequency estimate often has higher uncertainty and drives the overall ALE.

IoT devices with limited firmware update capabilities create a long-term vulnerability, as they cannot be patched against newly discovered flaws. This expands the attack surface and increases risk over time.

The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.

In OT environments, the highest priority risk involves safety implications and physical consequences, such as an attacker manipulating operational parameters to cause equipment damage or safety incidents.

COBIT 2019 defines EDM03 (Ensure Risk Optimization) as the governance objective that covers evaluating, directing, and monitoring risk management to optimize risk exposure.

Regulated decisions require explainability. If the AI model cannot provide explanations, the institution risks regulatory non-compliance and potential legal challenges.

Cloud-specific risks include data sovereignty, multi-tenancy isolation, and shared responsibility model gaps. Vendor lock-in is also common but not always considered 'critical' for all migrations.

Regulatory frameworks like GDPR and the EU AI Act emphasize the right to explanation for automated decisions. Without model explainability, the organization cannot demonstrate compliance with transparency requirements, making it the most critical risk from a regulatory compliance perspective.

Common exclusions include acts of war, intentional acts by the insured, and infrastructure failure without malicious intent. Some policies also exclude social engineering.

According to the shared responsibility model, the customer is responsible for data, access management, and application-level security.

NERC CIP standards aim to protect the reliability of the bulk electric system by securing critical cyber assets.

Cyber insurance policies often exclude acts of war, including state-sponsored cyber attacks. This is a critical exclusion that can leave organizations unprotected against nation-state threats.

Cyber insurance policies have specific coverage scopes, exclusions (e.g., war, negligence), and prerequisites (e.g., multi-factor authentication). Premium factors like security controls also affect cost.

Requiring explainability in an AI/ML credit scoring model directly addresses model bias because it forces the model to reveal which input features (e.g., income, zip code) drive its decisions. Without explainability, the organization cannot detect or prove that the model is not discriminating against protected groups, violating regulations like the Equal Credit Opportunity Act (ECOA) or GDPR's right to explanation. Explainability is the primary technical control to audit and mitigate bias in automated decision-making.

A is correct because IT/OT convergence directly connects corporate IT networks to operational technology (OT) systems, expanding the attack surface. Attackers can pivot from IT to OT via protocols like Modbus/TCP or OPC UA, potentially disrupting critical industrial processes. This is the most significant risk as it introduces new vectors for ransomware or sabotage that were previously isolated by air gaps.

Quantum computers using Shor's algorithm can efficiently solve integer factorization and discrete logarithm problems, threatening RSA and ECC.

Connecting OT to IT networks exposes ICS to threats from the corporate network, expanding the attack surface and potentially allowing attackers to pivot to OT systems.

A history of past security incidents indicates higher risk, leading insurers to charge higher premiums.

Post-quantum cryptography migration planning is a strategic activity that should begin now to ensure readiness before quantum computers can break current cryptography.

Data architecture is the enterprise architecture layer that defines how data is stored, managed, and processed, including data models, data flows, and storage structures. Data classification and encryption controls are critical at this layer because they directly protect the confidentiality and integrity of data at rest and in transit, ensuring compliance with policies and regulations.

The NIST CSF provides a common language (A) and helps align cybersecurity activities with business objectives (B). It does not guarantee prevention of all attacks (C), nor does it replace risk appetite (D), and it is not a prescriptive standard but a framework (E).

In FAIR, Loss Magnitude is the probable financial impact of a cyber incident, typically expressed as a monetary value. It is calculated based on primary and secondary losses.

A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

IoT risks include expanded attack surface, legacy device security gaps, and firmware update challenges.

NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

NERC CIP requires identification and protection of Critical Cyber Assets, including security controls for assets essential to bulk electric system reliability.

IoT devices often have limited security features, leading to expanded attack surface (A), lack of firmware update mechanisms (B), and use of legacy components with known vulnerabilities (C). Data sovereignty (D) is less relevant for environmental data; vendor lock-in (E) is a business risk but not a security risk.

The Protect function of the NIST CSF focuses on safeguards to limit or contain the impact of cybersecurity events.

EDM03 — Ensure Risk Optimization is the governance objective that focuses on evaluating, directing, and monitoring risk management to ensure the enterprise's risk appetite and risk tolerance are understood and articulated.

NERC CIP standards are designed to protect the reliability of the bulk power system against cybersecurity threats that could cause widespread outages.

The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.

NERC CIP standards require identification and protection of critical cyber assets, including clear boundaries (electronic security perimeters) to control access.

COBIT 2019's EDM03 (Ensure Risk Optimization) is the governance objective that directs the evaluation, direction, and monitoring of risk management to align with enterprise risk appetite.

The risk management policy (B) is deficient because it should mandate periodic updates to the risk register after project changes, ensuring alignment with the organization's risk appetite and tolerance. Without a policy that explicitly requires post-change risk reassessment, the process lacks governance and accountability. Risk reporting (C) is also deficient because it fails to communicate the updated risk status to stakeholders, which is critical for informed decision-making and maintaining an accurate risk posture.

IoT devices often lack security updates, making them vulnerable to exploitation. The expanded attack surface from many devices compounds this risk.

Data sovereignty issues arise when data is stored in jurisdictions with conflicting or unknown legal frameworks, posing significant compliance risk.

Model bias occurs when training data or algorithms produce unfair or discriminatory outcomes, directly impacting fairness and regulatory compliance.

A logical order is to first define policy, then methodology, then risk register, then treatment process, and finally reporting. However, the question asks for the best sequence among options. Typically, policy comes first, then methodology, then risk register, then treatment, then reporting.

In FAIR, the probable financial impact is derived from the loss event frequency and the loss magnitude. Loss magnitude estimates the financial loss per incident.

The risk of data exposure can be mitigated by implementing encryption, such as TLS, to protect data in transit.

The 'Detect' function focuses on identifying cybersecurity events in a timely manner. Continuous security monitoring is a key activity to detect anomalies and incidents.

Option C is correct because a primary function of an Architecture Review Board (ARB) is to evaluate solution architectures for security risks prior to implementation. This proactive review ensures that security controls are embedded in the design phase, reducing the likelihood of vulnerabilities being introduced into production systems.

The risk management policy is the authoritative document that establishes the organization's overall approach to risk management, including the principles, roles, responsibilities, and processes for risk assessment, treatment, and reporting. It sets the governance framework and mandates how risk activities must be conducted across the IT environment, ensuring consistency and alignment with business objectives.

IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.

Regulated decisions require explainability, and model bias can lead to unfair or illegal outcomes. Both are critical risks.

The primary purpose of a risk register is to serve as a central repository for documenting and tracking all identified risks, their assessments (including likelihood and impact), and the corresponding risk response strategies. This ensures that risk management activities are transparent, auditable, and actionable throughout the risk lifecycle, aligning with the ISACA CRISC framework.

IEC 62443 is the international standard for industrial automation and control systems security, covering security for IACS across multiple levels.

Data classification and sovereignty concerns are primarily data-related, falling under the data architecture layer. The data layer defines how data is stored, classified, and managed, including sovereignty requirements.

The Identify function includes asset management, risk assessment, and governance to understand the organization's risk posture.

Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

A risk register and a risk assessment methodology are core components of an IT risk management programme design.

The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Regulators require explainability for credit decisions to ensure fairness and compliance with regulations like ECOA and GDPR. Model bias can lead to discriminatory outcomes, resulting in significant penalties.

Insurers assess the organization's security controls to determine risk level; MFA is a control that reduces risk, thus affecting premiums positively.

IoT devices often have limited security capabilities, leading to expanded attack surface and difficulty in applying firmware updates. These are common IoT risks.

Migration must prioritize systems with long-term data sensitivity and assess cryptographic agility to adapt to new standards.

In the FAIR model, annual loss exposure (ALE) is calculated as threat event frequency multiplied by probable loss magnitude. Threat event frequency is the most critical factor because it directly drives how often losses occur, and without an accurate estimate of how frequently ransomware attacks are expected, any loss magnitude estimate becomes meaningless for annualizing exposure.

The primary risk is the expansion of the attack surface, as previously isolated OT systems become accessible from the corporate network, increasing the likelihood of cyber attacks propagating to critical industrial systems.

The ARB's role includes ensuring security risks are identified before implementation. Among the options, exposure of sensitive customer data is the most critical security risk that could impact the organization's reputation and compliance.

Insurers assess the organization's security controls and past incidents to determine risk level, which directly affects premium.

The Identify function includes asset management, business environment, governance, risk assessment, and risk management strategy. Risk assessment is a key component.

The risk register is the central repository within an IT risk management programme that formally documents identified risks, their assessed likelihood, and potential impact. It serves as the authoritative record for tracking risk ownership, mitigation status, and residual risk levels, enabling ongoing monitoring and reporting. Without a risk register, an organization cannot systematically manage or communicate its risk posture.

FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). These two components are multiplied to derive risk.

EDM03 (Ensure Risk Optimization) is the COBIT governance objective that specifically addresses the evaluation, direction, and monitoring of risk management to align with enterprise objectives.

A risk register should capture and track identified risks, their assessed impact and likelihood, and planned mitigation actions to enable effective risk management.

Weak access controls (e.g., lack of multi-factor authentication) increase the likelihood and potential impact of a ransomware attack, leading insurers to charge higher premiums.

In the shared responsibility model, the customer is responsible for data classification and access controls. Misconfiguration of access controls is a common overlooked risk that can lead to data breaches.