easyMultiple ChoiceObjective-mapped
CRISC Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. === IDS Alert === Timestamp: 2024-01-10 09:45:22 Signature ID: 2100498 Signature Name: ET POLICY Suspicious Inbound to MSSQL Port Source IP: 203.0.113.5 Destination IP: 192.168.10.50 Destination Port: 1433 Protocol: TCP Alert Severity: High === End of Alert ===
Refer to the exhibit. During a risk identification review, the risk manager sees this IDS alert. What risk does this alert MOST directly indicate?
⚠ Common exam trap
The trap here is that candidates may conflate a single IDS alert indicating exposure with a full-blown attack outcome (exfiltration, malware, DDoS), rather than recognizing that the alert most directly signals the underlying misconfiguration risk of internet-facing internal services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An internal SQL server is exposed to the internet and may be probed for vulnerabilities.
The IDS alert indicates an inbound connection attempt to TCP port 1433 (Microsoft SQL Server) from an external IP address. This directly suggests that an internal SQL server is exposed to the internet, which is a security misconfiguration that allows external entities to probe for vulnerabilities, such as weak credentials or unpatched flaws. While data exfiltration or malware could be subsequent outcomes, the alert itself most immediately signals the exposure and probing risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitive data is being exfiltrated from the SQL server.
Why it's wrong here
Alert is for suspicious inbound, not outbound data transfer.
- ✗
A malware infection is spreading across the network.
Why it's wrong here
No indication of malware; it's a probe.
- ✗
The organization is under a distributed denial-of-service (DDoS) attack.
Why it's wrong here
Single alert, not DDoS.
- ✓
An internal SQL server is exposed to the internet and may be probed for vulnerabilities.
Why this is correct
Alert shows external IP probing internal MSSQL server, indicating internet exposure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.