mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Based on the exhibit, what is the primary risk to…
Exhibit
Refer to the exhibit.
```
{
"PolicyName": "S3PublicAccessBlock",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::customer-data/*"
}
]
}
```Based on the exhibit, what is the primary risk to the organization?
⚠ Common exam trap
The trap here is that candidates often focus on the database server's role (e.g., modification or deletion risks) instead of recognizing that the unencrypted HTTP exposure directly enables unauthorized disclosure of data in transit, which is the most immediate and severe risk to confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unauthorized disclosure of sensitive customer data
The exhibit shows a database server with customer data accessible via a web application that uses unencrypted HTTP (port 80) and has direct internet exposure. This configuration allows an attacker to intercept traffic or exploit the lack of encryption to read sensitive customer data in transit, making unauthorized disclosure the primary risk. The core reasoning is that unencrypted HTTP exposes data to eavesdropping and man-in-the-middle attacks, directly violating confidentiality requirements for sensitive customer information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Unauthorized modification of customer data
Why it's wrong here
The policy only allows GetObject, not PutObject.
- ✗
Data loss due to accidental deletion
Why it's wrong here
No delete permissions are granted.
- ✓
Unauthorized disclosure of sensitive customer data
Why this is correct
Public access exposes data to anyone on the internet.
- ✗
Denial of service due to excessive read requests
Why it's wrong here
While possible, the primary risk is data exposure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.