mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Based on the exhibit, which aspect of risk…
Exhibit
Refer to the exhibit. --- Vulnerability Scan Report Excerpt Target: 192.168.1.100 Vulnerability: CVE-2023-XXXX Severity: Critical Status: Open (first detected: 2024-01-15) Last scan: 2024-04-10 Patches available: Yes Risk accepted: Yes (by system owner on 2024-02-01) ---
Based on the exhibit, which aspect of risk monitoring is MOST concerning?
⚠ Common exam trap
The trap here is that candidates often focus on the technical severity (critical) or the scan frequency, but CRISC emphasizes that the most concerning aspect of risk monitoring is the failure to act on known risks, not the initial risk level or the timing of scans.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The vulnerability has been open for three months with no evidence of monitoring or remediation despite a patch being available.
The vulnerability has been open for three months with a patch available, yet there is no evidence of monitoring or remediation. This indicates a complete breakdown of the risk monitoring process, as the organization failed to track, escalate, or patch a known critical vulnerability, leaving the system exposed to exploitation. In risk monitoring, the absence of any monitoring activity or remediation action over such a long period is far more concerning than the severity alone, as it reflects a systemic failure in the control environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The vulnerability has been open for three months with no evidence of monitoring or remediation despite a patch being available.
Why this is correct
Indicates lack of ongoing monitoring of accepted risks.
- ✗
The vulnerability severity is critical.
Why it's wrong here
Severity is important but not the most concerning issue.
- ✗
The last scan was three months after the initial detection.
Why it's wrong here
Scan frequency is a concern but secondary to lack of remediation action.
- ✗
The risk was accepted by the system owner.
Why it's wrong here
Acceptance is a valid decision, but monitoring after acceptance is critical.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.