mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A hospital uses a patient portal that allows…
A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?
⚠ Common exam trap
The trap here is that candidates may focus on the immediate technical symptom (denial of service) rather than the primary business impact (unauthorized data access), which is the core of risk identification in CRISC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unauthorized access to patient medical records.
The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Denial of service due to excessive login attempts.
Why it's wrong here
DoS is a concern but typically less impactful than data exposure.
- ✓
Unauthorized access to patient medical records.
Why this is correct
Breach of medical records can lead to legal penalties, identity theft, and harm to patients.
- ✗
Insufficient encryption of data in transit.
Why it's wrong here
Encryption is a control issue, not the direct risk scenario from brute-force.
- ✗
Phishing attacks targeting portal users.
Why it's wrong here
The incident is brute-force, not phishing.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.