CRISC Information Technology and Security Practice Question
A risk manager is evaluating the risk of a distributed denial-of-service (DDoS) attack against the organization's public-facing web application. The organization has a 1 Gbps internet connection and no DDoS mitigation service. Which of the following is the MOST important factor in determining the potential impact of a volumetric DDoS attack?
⚠ Common exam trap
The trap here is focusing on downstream consequences like number of users affected or server software, rather than the direct capacity constraint that determines whether a volumetric attack succeeds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bandwidth of the organization's internet connection compared to the attack traffic volume.
In a volumetric DDoS attack, the attacker floods the target with a high volume of traffic to exhaust network bandwidth. The potential impact is primarily determined by whether the attack traffic exceeds the organization's internet connection capacity. If the attack volume is greater than 1 Gbps, the link will be saturated, causing an outage. Thus, the bandwidth of the connection relative to the attack volume is the most critical factor in assessing impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The geographic location of the attackers launching the DDoS attack.
Why it's wrong here
The origin of the attack does not change the volume of traffic or the capacity of the target's connection. DDoS attacks are often distributed globally, and the location does not affect the impact on the target's bandwidth. While geo-blocking can be a mitigation, it is not the primary factor in determining impact. The key is the attack's size relative to the target's capacity.
- ✗
The number of users who will be unable to access the application during the attack.
Why it's wrong here
The number of affected users is a consequence of the attack, but it does not determine the potential impact on the organization's ability to withstand the attack. Impact depends on whether the attack can saturate the connection and cause an outage. User count is an outcome, not a determining factor. The more critical factor is the capacity of the connection relative to the attack volume.
- ✗
The type of web server software used to host the application.
Why it's wrong here
The web server software may influence how efficiently the application handles requests, but a volumetric DDoS attack targets the network bandwidth, not the server's processing power. Even the most robust server cannot respond if the network link is saturated. Therefore, the server software is not the most important factor in determining the impact of a volumetric attack.
- ✓
The bandwidth of the organization's internet connection compared to the attack traffic volume.
Why this is correct
A volumetric DDoS attack aims to saturate the network link. If the attack traffic exceeds the 1 Gbps connection capacity, the link becomes congested, and legitimate traffic cannot pass, causing an outage. The impact is directly determined by whether the attack volume overwhelms the available bandwidth. This makes the connection bandwidth the most important factor in assessing the potential impact.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.