Courseiva
← CRISC
Full test
mediumMultiple ChoiceObjective-mapped

CRISC Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

Vulnerability Scan Report (excerpt):
Host: 10.10.50.100
Port: 443 (HTTPS)
Finding: SSL/TLS certificate uses SHA-1 signature algorithm (CVE-2015-7575)
Severity: Medium
Remediation: Replace certificate with SHA-256 or higher.

Host: 10.10.50.100
Port: 22 (SSH)
Finding: OpenSSH version 7.2 is vulnerable to CVE-2016-6515 (DoS)
Severity: Low
Remediation: Upgrade to OpenSSH 7.3 or later.

Refer to the exhibit. An organization has identified vulnerabilities on a critical server. The risk owner has limited resources and can remediate only one finding this quarter. Based on the information provided, which approach is the most appropriate risk assessment decision?

⚠ Common exam trap

It's easy for candidates to choose the easiest fix (Option C) or assume budget reallocation is always possible (Option A), failing to recognize that risk assessment prioritization must be based on severity and business impact, not remediation effort or resource flexibility.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remediate the SSL/TLS certificate vulnerability first, as it affects a critical service and has a higher severity.

The SSL/TLS certificate vulnerability affects a critical service (likely HTTPS) and has a higher severity rating, making it the most urgent risk to address given limited resources. Risk assessment prioritizes remediating vulnerabilities that pose the greatest threat to critical business functions, even if another finding is easier to fix. The risk owner should allocate the single remediation slot to the highest-severity vulnerability on a critical server to maximize risk reduction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Remediate both findings by reallocating budget from another project.

    Why it's wrong here

    Reallocating budget may not be feasible, and the scenario states limited resources.

  • ✓

    Remediate the SSL/TLS certificate vulnerability first, as it affects a critical service and has a higher severity.

    Why this is correct

    This prioritizes the higher-risk finding on a critical server, making the best use of limited resources.

  • ✗

    Remediate the SSH vulnerability first because it is easier to fix (upgrade OpenSSH).

    Why it's wrong here

    Ease of fix does not outweigh the higher risk posed by the certificate vulnerability on a critical server.

  • ✗

    Accept both risks because they are low and medium severity, and resources are limited.

    Why it's wrong here

    Accepting both risks without further analysis may leave the organization exposed to exploitable vulnerabilities on a critical server.

About these practice questions

One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.