easyMultiple ChoiceObjective-mapped
CRISC Practice Question: During a risk assessment, the risk manager…
During a risk assessment, the risk manager identifies a vulnerability in a web application that could allow SQL injection. The development team states they will fix it in the next release, which is six months away. What should the risk manager do?
⚠ Common exam trap
Candidates often assume accepting risk (Option B) is valid because the fix is scheduled, but CRISC emphasizes that risk acceptance requires formal sign-off and cannot be used as a default for unmitigated critical vulnerabilities; the correct response is to implement a compensating control to reduce residual risk to an acceptable level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a web application firewall (WAF) as a compensating control.
A web application firewall (WAF) is the appropriate compensating control because it can inspect and block SQL injection payloads at the HTTP/HTTPS layer without modifying the application code. This provides immediate risk reduction while the development team works on the permanent fix, aligning with the principle of defense-in-depth and the risk manager's responsibility to treat unacceptable risk during the remediation window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a web application firewall (WAF) as a compensating control.
Why this is correct
WAF can block SQL injection attacks until the fix is deployed.
- ✗
Accept the risk due to the low likelihood of exploitation.
Why it's wrong here
SQL injection is a common attack; likelihood may not be low.
- ✗
Document the risk and defer action to the next assessment.
Why it's wrong here
Deferring without mitigating controls is not acceptable.
- ✗
Request an immediate emergency patch deployment.
Why it's wrong here
Emergency patches may not be feasible or tested.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.