CRISC practice examsIn development

1. When communicating risk assessment results, the MOST important audience to consider first is:

1. The stakeholders who need — correct
2. External auditors
3. The IT operations team
4. All employees in the organization

Why: Risk assessment results must first be communicated to the decision-makers — senior management and risk owners — who need the information to make risk-based decisions about resource allocation, risk treatment, and strategic direction.

2. What is the PRIMARY security risk of using default credentials on network devices and applications?

1. Default credentials automatically expire after thirty days requiring mandatory password changes
2. Default credentials are unique to each device making them impossible to guess or discover
3. Default credentials provide enhanced security because they are configured by the manufacturer
4. Default credentials are publicly known and can be easily exploited by attackers for unauthorized access — correct

Why: Default credentials are publicly documented and well-known to attackers. Using them provides easy unauthorized access since attackers can simply look up the default username and password for any device or application. Changing defaults is a fundamental security hardening step.