hardMultiple ChoiceObjective-mapped
CRISC Practice Question: During a risk assessment, an organization…
During a risk assessment, an organization identifies that its remote workforce uses personal devices for work. The risk manager is concerned about data leakage. The organization has a risk appetite that is 'moderate' and wants to treat the risk. Which of the following is the MOST effective risk treatment option?
⚠ Common exam trap
Many candidates confuse 'encryption' (Option B) with 'data leakage prevention'—full disk encryption protects data at rest but does not control data flow between apps or enable selective wipe, making it less effective than containerization for a moderate risk appetite where usability and privacy are key considerations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Mobile Device Management (MDM) policy with containerization
The most effective because MDM with containerization creates a separate, encrypted work profile on the personal device, isolating corporate data from personal apps and data. This directly addresses data leakage by enforcing security policies (e.g., remote wipe of the work container only) without requiring full control over the entire device, aligning with a 'moderate' risk appetite that seeks a balance between security and usability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a VPN for remote access
Why it's wrong here
VPN secures communication but does not control data on the device.
- ✗
Require full disk encryption on all personal devices
Why it's wrong here
Encryption protects data at rest but does not prevent data leakage via apps or cloud.
- ✓
Implement a Mobile Device Management (MDM) policy with containerization
Why this is correct
MDM with containerization provides a secure work environment on personal devices.
- ✗
Ban the use of personal devices for work
Why it's wrong here
This may not be practical and could reduce productivity.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.