mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A university is implementing a new online…
A university is implementing a new online learning management system (LMS) that will store student records, grades, and personal information. During the risk assessment, the IT team identifies that the LMS vendor's default configuration allows students to see each other's email addresses in the class roster. This could lead to privacy violations under FERPA regulations. The vendor states that this feature can be disabled in the settings but doing so will require manual configuration for each course. The university has a moderate risk appetite and wants to launch the system within two weeks. Which of the following is the MOST appropriate risk response?
⚠ Common exam trap
Test-takers frequently choose 'Accept the risk' (Option D) by underestimating the regulatory weight of FERPA, assuming email addresses are low-risk, while failing to recognize that any PII exposure, even seemingly minor, can trigger compliance violations and reputational damage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reduce the risk by disabling the feature globally through a script or administrative override before launch.
The most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transfer the risk by requiring students to sign a consent form allowing email disclosure.
Why it's wrong here
Consent may not be sufficient for FERPA compliance.
- ✗
Avoid the risk by selecting a different LMS vendor that does not have this issue.
Why it's wrong here
Vendor change would delay launch.
- ✓
Reduce the risk by disabling the feature globally through a script or administrative override before launch.
Why this is correct
Quick mitigation without launch delay.
- ✗
Accept the risk because the exposure is limited to email addresses and not grades.
Why it's wrong here
Any privacy violation is unacceptable under FERPA.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.