The correct next step is to document the finding in the risk register and assign a remediation timeline. This is because, within the CRISC risk assessment process, identifying an outdated encryption algorithm constitutes a specific vulnerability that must be formally recorded and prioritized for treatment, rather than immediately escalated or patched without analysis. The risk owner’s role is to ensure the issue is tracked within the organization’s risk management framework, allowing for a structured remediation timeline that aligns with business impact and resource allocation. On the CRISC exam, this tests your understanding of the risk assessment lifecycle, where documentation in the risk register precedes any technical fix; a common trap is jumping to patch the encryption without first logging the risk. Remember the mnemonic “DRT” — Document, Register, Timeline — to recall that recording and scheduling come before action.
CRISC IT Risk Assessment Practice Question
This CRISC practice question tests your understanding of it risk assessment. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During a risk assessment of a web application, the risk owner identifies that the application uses outdated encryption algorithms. What is the most appropriate next step?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the finding in the risk register and assign a remediation timeline.
Option C is correct because the risk owner has identified a specific vulnerability (outdated encryption algorithms) that must be formally recorded in the risk register. The next step is to document the finding and assign a remediation timeline, which aligns with the risk assessment process of treating identified risks. This ensures the issue is tracked, prioritized, and addressed within the organization's risk management framework, rather than being escalated, ignored, or patched without analysis.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Escalate the issue to senior management for approval to accept the risk.
Why it's wrong here
Escalation is appropriate only if the risk exceeds tolerance, but the first step is documentation.
✗
Accept the risk without action because encryption is not critical.
Why it's wrong here
Acceptance requires documented justification and management approval; not recommended without analysis.
✓
Document the finding in the risk register and assign a remediation timeline.
Why this is correct
Proper documentation ensures the risk is tracked and addressed.
Related concept
Read the scenario before looking for a memorised answer.
✗
Immediately patch the application to use modern encryption without further analysis.
Why it's wrong here
Immediate patching may introduce conflicts or operational issues; risk assessment recommends documented remediation planning.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse the immediate need to patch (Option D) with the proper risk management process, which requires documentation and analysis before any remediation action is taken.
Detailed technical explanation
How to think about this question
Outdated encryption algorithms like DES (56-bit key) and RC4 (stream cipher with known biases) are susceptible to modern attacks; for example, DES can be brute-forced in under a day with specialized hardware, and RC4 is vulnerable to statistical attacks that can recover plaintext. In a real-world scenario, a web application using TLS 1.0 with RC4 cipher suites would expose session data to decryption, as demonstrated by the BEAST attack. The risk register should include details such as the specific algorithm (e.g., 'TLS_RSA_WITH_RC4_128_SHA'), the affected assets, and a remediation timeline based on risk priority.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
IT Risk Assessment — This question tests IT Risk Assessment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Document the finding in the risk register and assign a remediation timeline. — Option C is correct because the risk owner has identified a specific vulnerability (outdated encryption algorithms) that must be formally recorded in the risk register. The next step is to document the finding and assign a remediation timeline, which aligns with the risk assessment process of treating identified risks. This ensures the issue is tracked, prioritized, and addressed within the organization's risk management framework, rather than being escalated, ignored, or patched without analysis.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.