easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A medium-sized e-commerce company recently…
A medium-sized e-commerce company recently experienced a denial-of-service (DoS) attack that took down its website for two hours. The incident response team quickly mitigated the attack by blocking the source IPs. In the aftermath, the risk manager is tasked with identifying risks to prevent recurrence. The company relies heavily on a single internet service provider (ISP) and has no DDoS protection service. The IT director suggests purchasing additional server capacity to absorb future attacks. The CEO is concerned about the cost. The risk team has identified that the likelihood of a similar attack is high based on recent industry trends, and the impact includes lost revenue and customer trust. What is the MOST effective risk identification action the risk team should take next?
⚠ Common exam trap
A common mix-up: candidates confuse risk identification with risk treatment, selecting a specific solution (like a WAF or DDoS protection) instead of first documenting the risk and evaluating all possible options, which is the correct next step in the risk management process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the risk and evaluate alternative mitigation options, including diversifying ISPs.
The risk team's primary role during risk identification is to document the risk and evaluate alternative mitigation options before committing to a specific solution. Diversifying ISPs addresses the single point of failure in the network architecture, which is a root cause of the DoS vulnerability, and aligns with the principle of defense in depth. Simply blocking source IPs is reactive, and the IT director's suggestion of adding server capacity is a costly and potentially ineffective absorption strategy against volumetric attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a web application firewall (WAF) to filter malicious traffic.
Why it's wrong here
WAF may not stop large volumetric DDoS.
- ✗
Recommend purchasing DDoS protection from a cloud-based provider.
Why it's wrong here
This is a mitigation step, not identification.
- ✗
Accept the risk because the cost of mitigation exceeds expected loss.
Why it's wrong here
Acceptance should come after thorough analysis.
- ✓
Document the risk and evaluate alternative mitigation options, including diversifying ISPs.
Why this is correct
Proper documentation and evaluation are core to risk identification.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.