mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. === Firewall Log Entry === Time: 2023-08-15 14:32:17 Source IP: 192.168.1.100 Destination IP: 10.0.0.50 Port: 445 (SMB) Action: ALLOW Rule: INTERNAL_ACCESS === End of Entry ===
Refer to the exhibit. During a risk identification exercise for the internal network, the risk manager reviews this firewall log entry. Which of the following risks is MOST directly suggested by this log entry?
⚠ Common exam trap
The trap here is that candidates may focus on the protocol (SMB) and assume data exfiltration (Option A) without considering the direction of traffic (inbound to the server) and the typical use of SMB for lateral movement in internal networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker could use SMB to move laterally from a compromised workstation to the server.
The firewall log shows an inbound SMB connection (port 445) from a workstation (10.0.0.5) to a server (10.0.0.10). SMB is commonly used for file sharing and remote administration, and if the workstation is compromised, an attacker can leverage SMB to move laterally to the server, potentially gaining access to sensitive data or escalating privileges. This aligns with the risk of lateral movement, which is a primary concern in internal network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitive data is being exfiltrated via SMB.
Why it's wrong here
Data exfiltration is possible but not directly shown; lateral movement is more immediate risk.
- ✓
An attacker could use SMB to move laterally from a compromised workstation to the server.
Why this is correct
SMB is commonly used for lateral movement in attacks.
- ✗
The workstation may be accessing the internet via the server.
Why it's wrong here
No internet access shown; internal communication.
- ✗
The organization is vulnerable to a distributed denial-of-service (DDoS) attack.
Why it's wrong here
Log shows normal traffic, not DDoS.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.