Operations and Lifecycle Management CRISC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is decommissioning a server that contains customer personal data. The asset management team has confirmed the server is at the end of its lifecycle. Which action is the MOST critical risk mitigation step before the physical hardware is disposed of?

   • ADocument the decommissioning procedure in the change management log.
   • BEnsure the data on the storage media is securely erased or the media is physically destroyed.
   • CTransfer the asset's software licenses to another server.
   • DUpdate the asset inventory to reflect the server's decommissioned status.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A software company is adopting a DevOps model to accelerate feature delivery. The risk team is evaluating the impact of this change. Which risk is MOST likely to be introduced or increased by this transition?

   • ADecreased ability to track changes due to the removal of formal change management processes.
   • BIncreased risk of configuration drift and unauthorized changes due to automated deployment pipelines.
   • CIncreased risk of vendor lock-in due to reliance on a single cloud provider for CI/CD tools.
   • DDecreased need for security testing because of faster release cycles.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team is using an Agile methodology and wants to integrate security testing into their process without slowing down their two-week sprints. Which approach BEST aligns with this goal?

   • APerform a comprehensive security review only at the end of the project before the final release.
   • BAutomate static application security testing (SAST) to run on every code commit within the CI/CD pipeline.
   • CRequire a manual security sign-off from the risk team for every user story before it is marked 'done'.
   • DDefer all security testing to an external firm that will test the application after it is deployed to production.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization is required by regulation to retain patient medical records for seven years. After this period, the records must be destroyed. The organization has a mix of electronic and physical records. Which control is MOST important to ensure compliance at the end of the retention period?

   • AEstablish a scheduled process to review and securely destroy records that have reached their retention limit.
   • BImplement a data classification scheme to label all records as 'confidential'.
   • CEncrypt all electronic records and store physical records in a locked cabinet.
   • DRestrict access to the records to only authorized medical staff.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary role of portfolio management in an organization?

   • ATo develop and maintain software applications
   • BTo monitor network performance
   • CTo align IT projects and initiatives with business objectives and risk appetite
   • DTo manage the day-to-day operations of IT services
   Reveal Solution Discussion Select an answer first