mediumMultiple Choice
CRISC Practice Question: A manufacturing company uses IoT sensors on the…
A manufacturing company uses IoT sensors on the factory floor to monitor equipment performance. The sensors transmit data to a central server via Wi-Fi. During a risk identification workshop, the operations manager reveals that some sensors are operating on outdated firmware with known vulnerabilities. The IT director proposes replacing all sensors at a high cost. The risk team notes that a breach could cause production downtime but the sensors only collect non-sensitive operational data. The company has a low tolerance for downtime. What should the risk team identify as the most critical risk?
⚠ Common exam trap
The trap here is that candidates focus on data sensitivity (reputation or legal liability) instead of operational impact, failing to recognize that for a manufacturing company with low downtime tolerance, production disruption is the most critical risk even if the data is non-sensitive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Operational disruption from a potential cyber attack exploiting sensor vulnerabilities.
The most critical risk is operational disruption from a cyber attack exploiting the known vulnerabilities in the outdated IoT sensor firmware. Since the company has a low tolerance for downtime, any breach that causes production stoppage directly impacts business continuity, outweighing the non-sensitive nature of the data collected. The sensors' Wi-Fi connectivity provides an attack surface for lateral movement or denial-of-service, making exploitation a high-probability, high-impact event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Operational disruption from a potential cyber attack exploiting sensor vulnerabilities.
Why this is correct
Outdated firmware with known vulnerabilities on internet-connected sensors creates a credible attack path, and the company's low downtime tolerance makes production disruption the most critical impact. Although the data is non-sensitive, exploitation could halt factory operations, which aligns with the stated risk appetite.
- ✗
Legal liability from non-compliance with safety standards.
Why it's wrong here
Nothing in the scenario indicates a safety standard or regulatory obligation governing these sensors, so liability is unsupported. It is tempting because manufacturing environments are heavily regulated, and it would be correct if the firmware flaw breached an explicit compliance requirement such as machinery safety certification.
- ✗
Reputational damage from a data leak.
Why it's wrong here
The sensors hold only non-sensitive operational data, so a leak cannot produce the reputational harm described. It is tempting because data breaches commonly carry reputational consequences, and it would be the correct choice if the compromised data included customer, personal or intellectual property information rather than equipment telemetry.
- ✗
Financial loss from replacing sensors.
Why it's wrong here
Replacement cost is a budget consequence, not the risk event; the exposure is production downtime from compromised sensors, which the company's low downtime tolerance makes critical. It is tempting because the IT director framed the proposal around cost, but risk identification addresses threat-driven operational impact.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.