Passing CRISC Domain 4 isn't about being the most technical person in the room. It’s about thinking like a city planner, not just a building inspector. An inspector checks if one building meets code, a reactive process. A planner designs the entire grid, the infrastructure, and the emergency response systems to be resilient from the start, a proactive strategy.
These free practice questions cover Domain 4: IT Technology and Security, aligned with the current (2024) ISACA blueprint to prepare you for the 2026 exam. Each question features a detailed rationale that dissects the correct answer and explains why the tempting distractors are wrong, training you to think like the examiner.
Key facts
- Official Body
- ISACA (Information Systems Audit and Control Association)
- Exam Domains
- 4 (Governance, IT Risk Assessment, Risk Response and Reporting, IT Technology and Security)
- Passing Score
- 450 on a scaled score range of 200 to 800
- Domain 4 Weighting
- 22% of the total exam score
- Average Study Time
- 100-140 hours
- Typical Salary
- The U.S. Bureau of Labor Statistics reports the 2023 median pay for Information Security Analysts was $120,360 per year (BLS.gov).
About These Free IT Technology and Security Questions
These aren't random samples. I’ve written them to mirror the complexity you'll face on the actual CRISC exam, specifically for Domain 4: IT Technology and Security. This domain accounts for 22% of your score and focuses on your ability to evaluate the effectiveness of security controls, architecture, and resilience planning.
The questions align with the current 2024 ISACA job practice areas, ensuring their relevance for your 2026 exam date. They cover a mix of difficulties, from direct applications of frameworks like the NIST Cybersecurity Framework (CSF) 2.0 to nuanced scenarios requiring you to weigh competing priorities.
Studying for CRISC? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
As you work through them, focus on the explanations for the wrong answers. Understanding the logic behind the distractors is the fastest way to develop the judgment the exam demands. If you need a larger, adaptive question bank, you can start a free trial with VoraPrep's CRISC course.
CRISC Domain 4 Practice Questions and Explanations
Read each question carefully. Choose the best possible answer, then review the detailed explanation below it.
Question 1: RTO/RPO Scenario
A financial services firm is implementing a new online trading platform. The business has defined a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes for the platform's core transaction database. Which of the following solutions BEST meets these requirements?
- Correct Answer: D. Synchronous replication to a hot site in a nearby city.
- Why it's right: An RTO of 15 minutes requires a very fast, automated failover, which a hot site provides. An RPO of 5 minutes (or less, ideally near-zero) demands that data is written to the primary and secondary sites simultaneously. Synchronous replication ensures no data is lost upon failover, meeting the stringent RPO.
- Why others are wrong:
- A is incorrect because tape backups have an RTO measured in hours or days, not minutes. The RPO would be up to 24 hours.
- B is tempting because it provides geographic diversity. However, "asynchronous" replication introduces a lag, meaning some data (more than the 5-minute RPO allows) would be lost in a failure.
- C provides a fast RTO but does not protect against a site-level disaster (fire, flood, power outage) that could take out the entire data center. It addresses availability, not full disaster recovery.
Question 2: Cloud Shared Responsibility
A risk practitioner is reviewing the security architecture for a new cloud-based application. According to the cloud shared responsibility model for an Infrastructure as a Service (IaaS) provider, who is PRIMARILY responsible for patching the operating systems of the virtual machines?
- Correct Answer: B. The customer.
- Why it's right: In an IaaS model, the cloud provider is responsible for the security of the cloud (the physical data centers, hardware, and hypervisor). The customer is responsible for security in the cloud. This includes everything from the virtual machine's operating system upwards: patching, network configuration, identity management, and application security.
- Why others are wrong:
- A is incorrect. This would be true in a Platform as a Service (PaaS) or Software as a Service (SaaS) model, but not IaaS.
- C is incorrect. The auditor's role is to assess and report on controls, not to perform operational tasks like patching.
- D describes the model's name but misinterprets its application. The responsibilities are clearly delineated, not shared equally for every component. This is a common exam distractor. For a deeper dive, see our guide to CRISC frameworks and cloud models.
Question 3: Business Impact Analysis Application
During a business impact analysis (BIA), the accounts payable department was identified as a critical business process. The company has a stated risk appetite for financial operations that tolerates a maximum of 4 hours of downtime. Which of the following is the MOST important consideration when designing a resilience strategy for the accounts payable system?
- Correct Answer: B. The Recovery Time Objective (RTO) derived from the BIA.
- Why it's right: The BIA is the foundational input for any resilience strategy. The RTO ("maximum of 4 hours of downtime") is the key output of the BIA that directly dictates the type of recovery solution required. All other considerations are secondary to meeting this business-defined requirement.
- Why others are wrong:
- A (Cost) is a critical factor, but it is a constraint considered after the business requirement (RTO) is established. You first determine what is needed, then you figure out how to afford it or accept the risk of not meeting the RTO.
- C (Skills) is an operational consideration for implementation and maintenance, but it does not define the strategic goal.
- D (Location) is a tactical decision made during the solution design phase, which is guided by the RTO.
How to Choose the Right Resilience Strategy: Hot, Warm, and Cold Sites Compared
The previous questions highlight the importance of matching a technical solution to a business requirement (RTO/RPO). This table breaks down the common options you'll be expected to evaluate on the exam.
| Site Type | Cost | RTO (Recovery Time) | RPO (Data Loss) | Key Characteristic |
|---|---|---|---|---|
| Hot Site | Highest | Minutes to Hours | Seconds to Minutes | Fully operational duplicate facility with real-time data synchronization. |
| Warm Site | Medium | Hours to Days | Hours | Partially equipped facility with hardware, but requires software/data restoration. |
| Cold Site | Lowest | Days to Weeks | Up to 24+ Hours | Basic facility with power and cooling; all hardware and data must be brought in. |
Question 4: Data Loss Prevention (DLP) Prerequisite
An organization wants to implement a data loss prevention (DLP) solution to protect its intellectual property. What is the MOST important prerequisite for the successful implementation of a DLP solution?
- Correct Answer: B. A comprehensive data classification scheme.
- Why it's right: A DLP system works by enforcing rules based on the sensitivity of data. If the organization doesn't know what data is sensitive (e.g., Public, Internal, Confidential, Restricted), the DLP tool cannot be configured effectively. You cannot protect what you have not identified and valued. Data classification provides the essential context for the DLP rules.
- Why others are wrong:
- A, C, and D are all valuable security controls, but they are not prerequisites for DLP. A SIEM can consume alerts from a DLP, encryption protects data at rest and in transit, and an IDS monitors network traffic. However, none of them are as foundational to the logic of the DLP system as a classification scheme.
Question 5: Mitigating a Single Point of Failure
A risk assessment identifies that the company's primary web server is a single point of failure. The business requires 99.9% uptime. Which of the following controls would be the MOST effective risk mitigation technique?
- Correct Answer: C. Deploying a load-balanced cluster of web servers.
- Why it's right: The identified risk is a "single point of failure" and the business requirement is high availability (99.9% uptime is approximately 8.76 hours of downtime per year). A load-balanced cluster directly addresses this by introducing redundancy. If one server fails, traffic is automatically redirected to the others, eliminating the single point of failure and maintaining uptime.
- Why others are wrong:
- A (Backups) is a recovery control, not a high-availability control. It helps restore service after a failure but does not prevent the initial downtime.
- B (Firewall) is a preventive control that protects against network attacks but does nothing to address server failure (e.g., hardware crash, OS bug).
- D (Penetration testing) is a detective control that identifies vulnerabilities but does not directly mitigate the risk of a single server failing.
Question 6: Incident Response First Step
A company is developing its incident response plan. The plan includes steps for containment, eradication, and recovery. Which of the following activities should be performed FIRST after an incident has been identified and confirmed?
- Correct Answer: C. Disconnect the affected systems from the network.
- Why it's right: This is the primary step in the "Containment" phase of incident response. The immediate priority is to stop the bleeding. Disconnecting affected systems prevents the incident (e.g., malware, attacker) from spreading further across the network and causing more damage.
- Why others are wrong:
- A (Eradication) and B (Recovery) are later phases. You must contain the problem before you can fix it. Attempting to eradicate malware on a connected machine could trigger it to spread faster.
- D (Root cause analysis) is a post-incident activity performed during the "Lessons Learned" phase, long after the incident is resolved. It is critical for preventing future incidents but is not an immediate response action.
- Option 1: Cold Site. Cost = $5,000/year. Estimated time to restore service (RTO) = 24 hours.
- Option 2: Hot Site. Cost = $100,000/year. Estimated time to restore service (RTO) = 1 hour.
The decision is clear. Even though the hot site is significantly more expensive, the cold site's RTO of 24 hours far exceeds the business's MTD of 2 hours. From a risk management perspective, the cold site does not effectively treat the risk. The correct recommendation is the hot site, as it is the only option that meets the business requirement defined in the BIA. The discussion then becomes about funding the appropriate control or formally accepting the risk of a 22-hour compliance gap.
Question 7: Encryption In Transit and At Rest
An organization's security policy requires all sensitive data to be encrypted both in transit and at rest. Which combination of technologies BEST fulfills this requirement?
- Correct Answer: A. SSL/TLS and BitLocker.
- Why it's right: SSL/TLS (Secure Sockets Layer/Transport Layer Security) is the standard for encrypting data in transit over a network (e.g., HTTPS). BitLocker is a full-disk encryption technology that encrypts data at rest on a hard drive. This combination directly addresses both parts of the policy requirement.
- Why others are wrong:
- B: IPsec encrypts data in transit, but data masking is a data obfuscation technique, not encryption for data at rest.
- C: WPA2 encrypts data in transit on wireless networks, but hashing is a one-way function used for integrity verification, not reversible encryption for data at rest.
- D: A VPN (Virtual Private Network) encrypts data in transit, but RAID-5 is a storage redundancy technology, not an encryption technology.
Question 8: Goal of Secure Architecture
The PRIMARY goal of designing a secure system architecture is to:
- Correct Answer: B. Reduce the attack surface of the system.
- Why it's right: This is the most strategic goal. By minimizing exposed services, open ports, and unnecessary software, you reduce opportunities for an attacker. This is a proactive approach grounded in Enterprise Architecture (EA) principles and executed using frameworks like TOGAF or SABSA. Activities like threat modeling during the design phase are key to identifying and minimizing this surface before a single line of code is written.
- Why others are wrong:
- A (Compliance) is an important outcome but not the primary goal. A system can be compliant but still insecure. Security should drive compliance, not the other way around.
- C (Encryption) is a specific control, a tactic within the broader strategy of secure architecture.
- D (Eliminate all vulnerabilities) is an impossible goal. New vulnerabilities are discovered constantly. The goal is to build a resilient system that can withstand attacks, even with some vulnerabilities present.
Question 9: Failure in IT Process
A company recently experienced a data breach where an attacker exploited a known vulnerability in a third-party software component. The vulnerability had a patch available for three months before the breach occurred. This is a failure of which of the following IT processes?
- Correct Answer: C. Patch management.
- Why it's right: Patch management is the process of identifying, acquiring, testing, and applying patches to remediate vulnerabilities. The fact that a patch was available for three months but not applied points to a direct failure in this process.
- Why others are wrong:
- A (Incident response) handles the breach after it occurred. The preventative process failed, not the response.
- B (Change management) is related, as applying a patch is a change. However, patch management is the more specific and correct answer. The failure wasn't in how the change was approved, but in the lack of action itself.
- D (Business continuity) is focused on maintaining operations during a disruption, not preventing a security breach.
Question 10: Third-Party Assurance
When evaluating the security of a third-party service provider that will handle sensitive customer data, which of the following provides the MOST assurance?
- Correct Answer: C. A recent SOC 2 Type II report.
- Why it's right: A SOC 2 (Service Organization Control 2) report is an independent, third-party audit of a service provider's controls. A Type II report specifically covers the operational effectiveness of those controls over a period of time (usually 6-12 months). This provides a much higher level of assurance than any self-attestation or contractual promise.
- Why others are wrong:
- A is a legal protection. It gives you the ability to check controls later but provides no assurance they are effective today.
- B is a self-attestation. It's useful for initial screening but relies on the provider's honesty and requires independent verification.
- D is marketing material and provides the least assurance of all.
Calculate Your CRISC Score & Study Hours by Domain
Adjust your practice scores across official CRISC blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score?
Count your correct answers. This quiz is a useful data point, but not a definitive measure of exam readiness.
- 8 or more correct: You have a strong command of Domain 4 concepts. You can correctly apply principles to scenario-based questions. Your next step is to work on speed and dive deep into the nuanced explanations for any questions you missed. VoraPrep's adaptive question bank is perfect for this, as it will automatically surface questions from your specific weak areas.
- 5 to 7 correct: You have a decent foundation but get tripped up by well-crafted distractors. Your focus should be on reinforcing the "why" behind the concepts. For instance, instead of just memorizing incident response steps, understand why containment must precede eradication. A full review of our comprehensive CRISC blueprint guide can help solidify these core ideas.
- 4 or fewer correct: You likely have some gaps in your foundational knowledge. Before doing hundreds more practice questions, take a step back. Re-read the core material on security architecture, resilience planning, and data protection. It's more effective to build the knowledge base first and then test it. VoraPrep's complete course includes textbook-grade interactive lessons that build this foundation step-by-step.
Get More CRISC Practice on VoraPrep
This 10-question quiz is just a small sample. To prepare for the 150 questions you'll face on exam day, you need a comprehensive and adaptive study system.
Legacy CRISC prep courses rely on overpriced, passive video lectures that cause fatigue and poor retention. VoraPrep is different. We've built a complete 6-pillar interactive course designed for busy professionals who need to study efficiently. Our platform includes:
- Textbook-Grade Lessons: Step-by-step interactive lessons that explain every concept on the ISACA blueprint.
- Adaptive Practice Bank: Over 1,800 exam-calibrated questions that adapt to your performance, forcing you to master your weak areas.
- 1:1 Exam Simulators: Full-length, timed mock exams that perfectly replicate the real CRISC testing experience.
- FSRS Spaced-Repetition Flashcards: A memory-scheduled flashcard system to lock in key terms and frameworks.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day to be ready by your exam date.
- Vory, Your 24/7 Tutor: Get instant, step-by-step coaching inside any lesson or practice question, any time of day.
Learn actively, practice adaptively, and go into your exam with confidence. You can see how our modern course design compares to traditional providers on our CRISC course comparison page.