Operations and Lifecycle Management CRISC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A project team is in the requirements gathering phase of a new customer-facing application. The risk practitioner is asked to provide input. Which security activity is MOST appropriate to perform during this phase?

   • AApprove the final security architecture and design documents.
   • BDefine security requirements, such as encryption standards and access control models.
   • CConduct a full penetration test on the application to identify vulnerabilities.
   • DReview the application's source code for security flaws.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is the FIRST step in the incident management process?

   • AResolution and recovery
   • BIncident closure
   • CEscalation
   • DDetection and logging
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key security consideration during the design phase of the SDLC?

   • AThreat modeling to identify potential security vulnerabilities in the architecture
   • BWriting secure code
   • CDeploying security patches
   • DPerforming penetration testing on the final system
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does portfolio management help in managing risk?

   • ABy evaluating projects against the organization's risk appetite and balancing the portfolio
   • BBy ignoring risks that are unlikely to occur
   • CBy eliminating all risky projects
   • DBy transferring all risks to third parties
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A multinational company must comply with data residency requirements that mandate customer data for a specific region must be stored within that region's borders. The company uses a global cloud provider. The risk team is evaluating a new application that will process this regional data. Which control is MOST critical to ensure compliance?

   • AImplement strict access controls to limit who can access the data.
   • BUse a data loss prevention (DLP) tool to monitor and block unauthorized data transfers.
   • CConfigure the application and its data storage to use a cloud region located within the required country or region.
   • DEncrypt the data at rest and in transit using strong encryption algorithms.
   Reveal Solution Discussion Select an answer first