The answer is to reduce the risk by disabling the feature globally through a script or administrative override before launch. This is the most appropriate FERPA privacy risk response because it directly addresses the identified vulnerability—exposed student email addresses in the LMS roster—while respecting the university’s moderate risk appetite and tight two-week deployment window. By applying a global configuration change, the IT team eliminates the privacy violation without relying on error-prone manual per-course settings, effectively lowering the likelihood of a FERPA violation to an acceptable level. On the CRISC exam, this scenario tests your ability to distinguish between risk response options—avoid, transfer, mitigate, or accept—when operational constraints like time and resources are present. A common trap is choosing “accept the risk” because the vendor offers a manual fix, but that ignores the moderate risk appetite and regulatory exposure. Memory tip: when a default setting creates a compliance gap and a global override exists, “script it, don’t click it” to reduce risk efficiently.
CRISC IT Risk Assessment Practice Question
This CRISC practice question tests your understanding of it risk assessment. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A university is implementing a new online learning management system (LMS) that will store student records, grades, and personal information. During the risk assessment, the IT team identifies that the LMS vendor's default configuration allows students to see each other's email addresses in the class roster. This could lead to privacy violations under FERPA regulations. The vendor states that this feature can be disabled in the settings but doing so will require manual configuration for each course. The university has a moderate risk appetite and wants to launch the system within two weeks. Which of the following is the MOST appropriate risk response?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reduce the risk by disabling the feature globally through a script or administrative override before launch.
Option C is the most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Transfer the risk by requiring students to sign a consent form allowing email disclosure.
Why it's wrong here
Consent may not be sufficient for FERPA compliance.
✗
Avoid the risk by selecting a different LMS vendor that does not have this issue.
Why it's wrong here
Vendor change would delay launch.
✓
Reduce the risk by disabling the feature globally through a script or administrative override before launch.
Why this is correct
Quick mitigation without launch delay.
Related concept
Read the scenario before looking for a memorised answer.
✗
Accept the risk because the exposure is limited to email addresses and not grades.
Why it's wrong here
Any privacy violation is unacceptable under FERPA.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may choose 'Accept the risk' (Option D) by underestimating the regulatory weight of FERPA, assuming email addresses are low-risk, while failing to recognize that any PII exposure, even seemingly minor, can trigger compliance violations and reputational damage.
Detailed technical explanation
How to think about this question
In practice, a global script or administrative override can leverage the LMS's API or configuration management tools (e.g., PowerShell for Microsoft-based systems or SQL updates for database-driven settings) to disable the email visibility feature across all courses simultaneously, often by modifying a single tenant-level setting or applying a group policy. This approach is efficient because many LMS platforms store such configurations in a centralized database or configuration file, allowing a bulk update that bypasses the need for per-course manual changes, which would be impractical for a large university with hundreds of courses. Real-world scenarios, such as the 2020 Zoom privacy issues, highlight how default settings can expose user data, and a proactive global fix is often the fastest path to compliance without sacrificing functionality.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CRISC exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
IT Risk Assessment — This question tests IT Risk Assessment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Reduce the risk by disabling the feature globally through a script or administrative override before launch. — Option C is the most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.