Technology and Security — CRISC Practice Questions

Acme Corp plans to introduce several cloud‑based services and wants to create a technology roadmap that aligns with its enterprise architecture. What should the risk practitioner do first?

• A.Perform a gap analysis between the current baseline architecture and the desired target architecture.
• B.Obtain formal authorization from the authorizing official for the cloud adoption plan.
• C.Develop a detailed project schedule for migrating existing enterprise workloads to the cloud.
• D.Draft security and privacy controls for the cloud services based on applicable regulations.

Why: Identify the initial activity when aligning a technology roadmap with enterprise architecture A gap analysis establishes the differences between the existing baseline architecture and the target architecture, providing the sequencing plan needed to guide the roadmap; this aligns with NIST SP 800‑37r2 which defines baseline, target, and sequencing as core EA elements.

A regional health organization is creating a formal data‑lifecycle management program to protect patient records from creation through disposal. What should the risk practitioner do FIRST to ensure the program aligns with the organization’s security and privacy objectives?

• A.Identify and assign a data owner for each data domain, establishing accountability for confidentiality, integrity, and availability across the data lifecycle.
• B.Conduct a comprehensive risk assessment of all existing data repositories before designating any data stewards, aiming to map threats prior to assigning ownership.
• C.Develop a detailed technical configuration control plan for all data storage devices before any data is classified, emphasizing device settings prior to data categorization.
• D.Implement encryption mechanisms for data at rest and in transit as the initial step in the data lifecycle management program, focusing on cryptography before governance.

Why: Assign data ownership early to anchor accountability throughout the data lifecycle NIST SP 800-37r2 identifies the Mission or Business Owner as the primary responsibility for security and privacy. Assigning a data owner first creates clear accountability for confidentiality, integrity, and availability across all lifecycle phases, enabling effective control design and monitoring.

Acme Corp is transitioning its ICT initiatives to an Agile portfolio approach. The risk practitioner must ensure that risk decisions reflect the organization’s overall mission and risk appetite. What should the practitioner do FIRST?

• A.Conduct a risk assessment that maps each Agile project's objectives to the enterprise’s risk appetite and mission.
• B.Appoint a dedicated risk officer for each Scrum team to oversee risks at the team level and report locally.
• C.Prioritize projects solely on projected business value, ignoring any assessment of risk exposure or alignment with strategy.
• D.Collect each project's current risk register and merge them into a consolidated portfolio report without re‑evaluating alignment.

Why: Align Agile project risk assessment with enterprise risk appetite to achieve portfolio-wide risk visibility. NIST SP 800-221 emphasizes that ERM considerations must be based on an ICT‑portfolio perspective and that risk programs should integrate activities to identify risks with the greatest impact on the entity’s mission. Mapping each Agile project's objectives to the enterprise risk appetite provides that portfolio‑wide view.

During several sprints, the development team at Beta Solutions experiences security incidents that degrade system performance. The risk practitioner wants to embed resilience into the Agile lifecycle. Which action is most important?

• A.Implement a static code analysis tool at project start and run it a single time.
• B.Require the product owner to approve only features that have no known vulnerabilities.
• C.Add iterative threat modeling and resilience testing to the sprint definition of done.
• D.Plan a comprehensive security audit to be performed once the product is released.

Why: Integrate continuous threat modeling and resilience testing into Agile sprints to maintain system resilience. NIST SP 800-39 describes agile defense as applying information‑system resilience through iterative practices, enabling systems to operate under attack and recover quickly. Embedding threat modeling and resilience testing in each sprint’s definition of done directly implements this guidance.

In an organization implementing an enterprise architecture (EA) to support security and privacy, which role has the primary responsibility for building the holistic view of missions, business functions, information, and IT assets?

• A.System Owner
• B.Chief Information Officer
• C.Mission or Business Owner
• D.Enterprise Architect

Why: Identify the role accountable for defining EA that enables security and privacy. NIST SP 800-37r2 lists the Enterprise Architect as the individual responsible for working with leadership and subject‑matter experts to build a holistic view of the organization, including security and privacy considerations.

Which element of an enterprise architecture explicitly provides the ordering of steps for moving from the current state to the desired future state?

• A.Baseline architecture
• B.Security architecture
• C.Sequencing plan
• D.Target architecture

Why: Recognize the component of EA that defines the implementation roadmap. The excerpt from NIST SP 800-37r2 states that EA includes a baseline architecture, a target architecture, and a sequencing plan; the sequencing plan provides the ordered steps for transition.

During a routine review, the IT department discovers that its server inventory is missing several production machines. What should the risk practitioner consider MOST important?

• A.Purchase an automated discovery tool before any updates
• B.Decommission the untracked servers immediately
• C.Conduct a full security audit of all servers
• D.Update the asset inventory and classify critical assets

Why: Maintain an accurate, classified asset inventory to support risk decisions NIST SP 800-12r1 emphasizes the importance of accurate system support information for effective security management.

A manufacturing plant suffers a ransomware incident that halts production. According to NIST SP 800-161r1, what should the risk practitioner prioritize FIRST?

• A.Notify all customers about the breach
• B.Conduct a root‑cause analysis before remediation
• C.Isolate the affected systems to contain the spread
• D.Restore data from the latest backups before analysis

Why: Contain an incident promptly to limit impact before recovery actions NIST SP 800-161r1 defines resilience as the ability to withstand and recover, beginning with containment of the incident.

The organization is moving to a DevOps CI/CD pipeline but has no defined security requirements for the process. What should the risk practitioner recommend as the FIRST step?

• A.Train DevOps team members on secure coding guidelines for the pipeline
• B.Add automated vulnerability scanning tools into the CI/CD pipeline workflow
• C.Conduct a manual penetration test against the production environment
• D.Develop a security policy that defines requirements for the pipeline

Why: Establish security policy before implementing technical controls in DevOps NIST SP 800-12r1 notes that automated tools are effective but must be guided by defined security requirements and policies.

A new data‑protection regulation requires encryption at rest for all assets, but several legacy systems cannot support it. What should the risk practitioner prioritize FIRST?

• A.Procure new hardware to replace the legacy systems immediately
• B.Apply encryption only to newly purchased systems
• C.Conduct a gap analysis and develop interim mitigation controls
• D.Delay all encryption changes until every system is compatible

Why: Identify gaps and apply interim controls when regulatory changes affect existing technology NIST SP 800-39 highlights that new legislation can introduce risk, so a gap analysis to determine needed mitigations is the appropriate initial response.

In the implementation phase, what is the most appropriate action for the risk practitioner to verify that security controls are operating as intended?

• A.Conduct a user training session on security policies after go‑live.
• B.Review source code solely for compliance with coding standards.
• C.Update the risk register with newly discovered assets after deployment.
• D.Perform a security certification assessment of the implemented controls.

Why: Conduct security certification to confirm control implementation during SDLC NIST SP 800-100 defines security certification as a comprehensive assessment of management, operational, and technical controls to determine correct implementation and operation.

During the design phase of a critical system, which activity best ensures that security requirements are fully integrated?

• A.Perform a cost‑benefit analysis of security tools before finalizing the system architecture.
• B.Develop a system security plan that maps security controls to identified requirements.
• C.Conduct performance testing of the prototype to verify speed before security controls are defined.
• D.Create a project schedule that prioritizes milestones while limiting time for security tasks.

Why: Use a System Security Plan to embed security controls in system design NIST SP 800-100 requires that security assessments and system security plans be incorporated into the SDLC to ensure controls are designed and implemented correctly.