CRISC Question 225

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  D. Vulnerability The situation described, where user IDs and passwords are documented in procedure manuals for use by part-time employees, is best described as a vulnerability. A vulnerability is a weakness in a system, process, or organization that could be exploited by a threat to cause harm. In this case, the practice of documenting user credentials in manuals represents a weakness in the organization's information security practices. If these manuals were to fall into the wrong hands or be accessed by unauthorized individuals, it could potentially lead to security breaches or unauthorized access to systems and data. While it is a vulnerability, it also poses a security risk (A) because it exposes the organization to the potential for unauthorized access and data breaches. However, the most accurate term to describe the initial issue is "vulnerability."

• Chose B1

  B. Policy violation Documenting user IDs and passwords in procedure manuals is a clear violation of most organization's security policies. These policies typically prohibit the sharing or documentation of passwords due to the inherent security risks involved. In general, each user should have unique login credentials and passwords should be kept confidential. The situation also represents a serious security vulnerability and a risk, but fundamentally it is a policy violation.

• Chose D1

  Poor password management is a vulnerability. We aren't told what the passwords have access to like confidential data etc, that would be a risk