CRISC Data exposure risk Practice Question
Exhibit
Refer to the exhibit.
AWS S3 bucket policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?
⚠ Common exam trap
Test-takers frequently confuse a permissive policy with a standard configuration, overlooking the severe security implication of a wildcard permission that allows public access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk of data exposure; apply a deny rule to restrict access
The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk of cost; set a budget alert
Why it's wrong here
A budget alert addresses financial overspend, not the security exposure shown in the exhibit, and detection alone changes nothing. Cost monitoring is the correct response when the risk is uncontrolled cloud consumption or project overrun, not a control weakness affecting data.
- ✓
Risk of data exposure; apply a deny rule to restrict access
Why this is correct
The exposed storage configuration permits anonymous or over-broad access, creating data exposure risk. Applying a deny rule restricts that access, satisfying the stem's requirement for a response that directly removes the exposure path rather than merely detecting or transferring the risk.
- ✗
Risk of availability; implement backup
Why it's wrong here
The exhibit points to an integrity or access exposure, not service downtime, so backup restores data rather than preventing the identified threat. Backup is the right response when availability loss is the genuine risk, such as hardware failure or ransomware destroying production systems.
- ✗
No risk; the policy is standard
Why it's wrong here
The exhibit shows a deviation from expected control configuration, so dismissing it as standard ignores a genuine gap requiring treatment. Accepting a policy as standard is valid only when it demonstrably meets the organisation's risk appetite and no exposure exists.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.