CRISC Information Technology and Security Practice Question
A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time data analytics. Which of the following represents the MOST significant risk introduced by this convergence?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Expansion of the attack surface from IT to OT environments
Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increased complexity in managing network bandwidth
Why it's wrong here
Bandwidth contention is a manageable operational concern, not the dominant risk. The convergence's defining danger is that IT-side compromise or a flat network path lets attackers pivot directly into ICS, disrupting physical processes. Complexity would be the leading answer only if the ICS were already fully segmented and isolated from corporate traffic.
- ✗
Potential for increased data redundancy
Why it's wrong here
Data redundancy is a storage and data-quality issue, not a threat to industrial operations. Convergence removes the air gap, letting corporate-network compromises reach ICS and disrupt physical processes. Redundancy would matter if the question addressed analytics data quality.
- ✓
Expansion of the attack surface from IT to OT environments
Why this is correct
Bridging IT and OT dissolves the air gap that previously isolated industrial control systems. Each newly reachable OT device, protocol and service becomes an additional entry point, so the attack surface expands from enterprise IT into operational technology, exposing safety-critical processes to IT-borne threats.
- ✗
Higher licensing costs for security software
Why it's wrong here
Licensing expenditure is a budgetary concern, not an operational risk to production. Convergence exposes ICS to corporate malware and lateral movement, threatening physical processes. Cost would be relevant if the question asked about financial impact of security tooling.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.