mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Based on the exhibit, what is the MOST…
Exhibit
Refer to the exhibit. Exhibit: CLI output from a vulnerability scanner: Host: 10.10.10.10 Port: 443 Vulnerability: CVE-2024-1234 CVSS Score: 9.8 Exploit Available: Yes Patch Available: No
Based on the exhibit, what is the MOST appropriate immediate risk response?
⚠ Common exam trap
Watch out — candidates often confuse 'accept the risk' as a valid immediate response when the question emphasizes 'immediate,' failing to recognize that compensating controls are the correct first step to reduce exposure before acceptance or transfer can be considered.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement compensating controls
The exhibit indicates a critical vulnerability in a core network device (e.g., a Cisco router with a known CVE in its IOS) that is actively being exploited. Implementing compensating controls, such as deploying an access control list (ACL) to block the exploit's specific traffic pattern or enabling Control Plane Policing (CoPP), immediately reduces the attack surface while a permanent patch is scheduled. This is the most appropriate response because it directly mitigates the risk without waiting for a vendor fix or accepting potential compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transfer the risk
Why it's wrong here
Transfer is not an immediate action for technical vulnerability.
- ✗
Accept the risk
Why it's wrong here
Acceptance is inappropriate for a critical vulnerability with exploit.
- ✓
Implement compensating controls
Why this is correct
Compensating controls reduce risk until a patch is available.
- ✗
Ignore the risk
Why it's wrong here
Ignoring risk is not a valid response.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.