mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Has received a critical vulnerability alert for a…
An organization has received a critical vulnerability alert for a web application firewall. The risk owner is on leave. What should the risk manager do?
⚠ Common exam trap
Many exam-takers assume immediate patching (Option B) is always the correct response for a critical vulnerability, but CRISC emphasizes that risk decisions must be made by the designated risk owner or their alternate, not unilaterally by the risk manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate to the designated alternate risk owner for decision.
When the risk owner is unavailable, the risk manager must ensure that risk decisions are still made in a timely manner, especially for critical vulnerabilities. Escalating to the designated alternate risk owner is the correct action because it maintains the chain of accountability and enables an informed decision on whether to apply mitigations, such as patching the WAF, without unnecessary delay.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Escalate to the designated alternate risk owner for decision.
Why this is correct
Proper escalation ensures accountability and timely response.
- ✗
Apply the patch immediately without consultation.
Why it's wrong here
Patching without authorization may violate change management procedures.
- ✗
Accept the risk since the impact is unknown.
Why it's wrong here
Acceptance without analysis is not appropriate for a critical vulnerability.
- ✗
Wait for the risk owner to return to avoid overstepping authority.
Why it's wrong here
Delaying could lead to exploitation; critical vulnerabilities require prompt attention.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.