CRISC Information Technology and Security Practice Question
A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?
⚠ Common exam trap
CRISC often tests the ability to distinguish between direct security risks and secondary business impacts; candidates may incorrectly focus on operational or financial outcomes rather than the immediate security risk of expanded attack paths.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Expanded attack path from IT to OT systems
The convergence of IT and OT networks creates a bridge between two environments that were traditionally air-gapped. This bridge allows threats that compromise the corporate IT network to pivot into the industrial control systems (ICS), expanding the attack surface and providing adversaries with a direct path to operational technology (OT). Unlike licensing costs or analytics complexity, this is a direct security risk that can lead to physical consequences, making it the most critical risk introduced by such integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Higher licensing costs for industrial software
Why it's wrong here
Licensing costs are a commercial budgeting concern, not a security or operational risk created by connecting ICS to corporate networks. Licensing would be the correct focus when evaluating software procurement or contract renewals, not the exposure introduced by IT/OT convergence.
- ✓
Expanded attack path from IT to OT systems
Why this is correct
Converging ICS with corporate IT dissolves the air gap, letting compromised enterprise credentials or lateral movement reach operational technology. This expanded attack path directly satisfies the stem's convergence scenario, where IT-borne threats can now pivot into production systems, escalating impact from data loss to physical process disruption.
- ✗
Increased complexity of data analytics
Why it's wrong here
Analytics complexity affects reporting capability, not the security exposure created by joining ICS to corporate IT. Analytics complexity would be the correct consideration when designing dashboards or data pipelines, not when assessing risks arising from IT/OT network convergence.
- ✗
Reduced operational efficiency due to network latency
Why it's wrong here
Latency affects throughput, not the exposure created by bridging IT and OT networks; the convergence widens the attack surface, letting enterprise-borne malware reach ICS. Reduced efficiency is tempting because segmentation does add latency, so this would be the answer if the question asked about performance impact rather than an introduced risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.