Courseiva
← CRISC
Full test
mediumMultiple ChoiceObjective-mapped

CRISC Practice Question: Based on the exhibit, which vulnerability poses…

Exhibit

Refer to the exhibit.

=== Vulnerability Scan Report (Excerpt) ===
Host: 10.0.1.25 (Critical Server)
Vulnerability: CVE-2023-1234 (Remote Code Execution)
Severity: Critical (CVSS 9.8)
Status: Unpatched

Host: 10.0.2.10 (Web Server)
Vulnerability: CVE-2023-5678 (SQL Injection)
Severity: High (CVSS 7.5)
Status: Patched

Host: 10.0.3.50 (File Server)
Vulnerability: CVE-2022-9876 (Privilege Escalation)
Severity: Medium (CVSS 5.0)
Status: Compensating Control in Place

=== End of Exhibit ===

Based on the exhibit, which vulnerability poses the HIGHEST risk to the organization?

⚠ Common exam trap

The trap here is that candidates often focus solely on the CVSS score or vulnerability type without considering the asset's criticality, leading them to choose a high-severity vulnerability on a non-critical asset over a slightly lower-severity one on a critical server.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

CVE-2023-1234 on the critical server

C is correct because the critical server hosts the organization's most sensitive data or core business applications, and CVE-2023-1234 is a remote code execution vulnerability with a CVSS score of 9.8, allowing an unauthenticated attacker to fully compromise the server. The combination of high asset criticality and severe exploitability makes this the highest risk, as defined by the risk formula (Likelihood × Impact).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    CVE-2022-9876 on the file server

    Why it's wrong here

    Compensating control in place reduces risk.

  • ✗

    CVE-2023-5678 on the web server

    Why it's wrong here

    Already patched.

  • ✓

    CVE-2023-1234 on the critical server

    Why this is correct

    Unpatched critical vulnerability with high CVSS score.

  • ✗

    All vulnerabilities pose equal risk

    Why it's wrong here

    No, risk levels differ.

About these practice questions

One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.