CRISC Risk Response and Mitigation Practice Question
Exhibit
Refer to the exhibit. Exhibit: Results from a vulnerability scan ``` Vulnerability Scan Report - 2024-01-15 Target: 192.168.1.0/24 Host: 192.168.1.10 Port 22/tcp: SSH protocol version 1.0 (critical) Port 80/tcp: Apache HTTP Server 2.2.3 (high) Port 443/tcp: OpenSSL 0.9.8 (high) Host: 192.168.1.20 Port 3389/tcp: RDP with weak encryption (medium) Port 445/tcp: SMB signing not required (medium) ```
Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?
⚠ Common exam trap
Deprecated protocol versions (like SSHv1.0) are inherently more critical than configuration weaknesses or outdated software versions, because they represent a fundamental architectural flaw that cannot be fixed by patching or configuration alone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH protocol version 1.0 on 192.168.1.10
SSH protocol version 1.0 is critically vulnerable to multiple security flaws, including session key recovery and man-in-the-middle attacks, due to weak integrity checks and lack of strong cryptographic algorithms. Unlike the other options, which represent misconfigurations or outdated software that can be mitigated with patches or configuration changes, SSHv1.0 is a deprecated protocol with known, easily exploitable vulnerabilities that directly compromise confidentiality and integrity of administrative access. This makes it the most critical risk to address first, as it exposes the core management interface of the asset.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSH protocol version 1.0 on 192.168.1.10
Why this is correct
Critical vulnerability should be addressed first.
- ✗
RDP with weak encryption on 192.168.1.20
Why it's wrong here
Medium severity.
- ✗
SMB signing not required on 192.168.1.20
Why it's wrong here
Medium severity.
- ✗
Apache HTTP Server 2.2.3 on 192.168.1.10
Why it's wrong here
High severity but not as critical as SSH v1.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.