CRISC Information Technology and Security Practice Question
A hospital is deploying IoT medical devices that connect to the network. Which risk is MOST concerning from a cybersecurity perspective?
⚠ Common exam trap
The trap is picking firmware update challenges because it sounds technical and specific — candidates overlook that the broader, more strategic risk is the sheer expansion of the attack surface across many unmanaged devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Expanded attack surface due to many devices
IoT medical devices dramatically expand the attack surface because each device is a potential entry point, often with weak default credentials, unpatched firmware, and limited security controls. In a hospital, this expansion is the most concerning risk because it multiplies exposure across the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Expanded attack surface due to many devices
Why this is correct
Each connected IoT medical device adds an entry point, so the aggregate attack surface grows faster than the hospital can patch or monitor it, giving adversaries more unmanaged vectors into clinical networks than any single device weakness.
- ✗
Data sovereignty compliance
Why it's wrong here
Data sovereignty concerns where data is stored and which jurisdiction governs it, not device compromise. It becomes relevant when patient data crosses borders or cloud regions, triggering GDPR or HIPAA transfer restrictions. Here the exposure is unpatched, internet-facing medical devices providing entry points into clinical networks.
- ✗
Firmware update challenges
Why it's wrong here
Firmware update challenges are a genuine IoT weakness, but they describe a maintenance difficulty rather than the immediate compromise path. This would be the focus when devices lack signed update mechanisms or vendor support ends. The stem asks for the most concerning cybersecurity risk, which is exploitation of insecure devices.
- ✗
Vendor lock-in
Why it's wrong here
Vendor lock-in is a commercial and strategic sourcing risk, not a cybersecurity one. It matters during procurement or exit planning, when proprietary protocols or contracts restrict migration to alternative suppliers. The scenario concerns network-connected medical devices, where the pressing exposure is unauthorised access and patient safety impact.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.