nerdexam
Isaca

CISM · Question #146

Which of the following risk assessment findings for an online-only business should be given the HIGHEST priority to address availability concerns?

The correct answer is B. The web server for the online store was found to be vulnerable to distributed denial of service. For an online-only business, the web server is the sole channel through which revenue is generated and customers are served. A vulnerability to Distributed Denial of Service (DDoS) attacks directly threatens availability of the entire business - a successful DDoS can take the…

Submitted by kwame.gh· Apr 18, 2026Information Security Risk Management

Question

Which of the following risk assessment findings for an online-only business should be given the HIGHEST priority to address availability concerns?

Options

  • AThe back office system that processes payments to providers has slowed.
  • BThe web server for the online store was found to be vulnerable to distributed denial of service
  • CEmail authentication through a connector to a single sign-on (SSO) service has a history of
  • DThe access point for the visitor WiFi network has several unpatched vulnerabilities.

How the community answered

(68 responses)
  • A
    22% (15)
  • B
    59% (40)
  • C
    7% (5)
  • D
    12% (8)

Explanation

For an online-only business, the web server is the sole channel through which revenue is generated and customers are served. A vulnerability to Distributed Denial of Service (DDoS) attacks directly threatens availability of the entire business - a successful DDoS can take the business completely offline. This is an existential availability risk. A slow back-office payment system (A) impacts operations but not customer access. SSO authentication failures (C) are disruptive but partial. Unpatched visitor WiFi (D) is a lower-tier network segment with minimal business-critical exposure. DDoS on the web server represents the highest impact, highest probability availability threat for an online-only operation.

Topics

#Risk Assessment#Availability#Risk Prioritization#Business Impact

Community Discussion

No community discussion yet for this question.

Full CISM Practice