nerdexam
Isaca

CRISC · Question #611

A risk practitioner finds that data has been misclassified. Which of the following is the GREATEST concern?

The correct answer is A. Unauthorized access. Misclassified data poses the greatest risk of unauthorized access because security controls are often aligned with classification levels.

Submitted by joshua94· Apr 18, 2026IT Risk Assessment

Question

A risk practitioner finds that data has been misclassified. Which of the following is the GREATEST concern?

Options

  • AUnauthorized access
  • BData corruption
  • CInadequate retention schedules
  • DData disruption

How the community answered

(21 responses)
  • A
    76% (16)
  • B
    5% (1)
  • C
    14% (3)
  • D
    5% (1)

Why each option

Misclassified data poses the greatest risk of unauthorized access because security controls are often aligned with classification levels.

AUnauthorized accessCorrect

Data misclassification means sensitive information might be labeled as less critical, leading to the application of weaker-than-appropriate security controls. This significantly increases the likelihood that individuals without the proper authorization could gain access to the data, as access controls are typically tied to established data classification levels.

BData corruption

Data corruption refers to data being altered or damaged, which is a different issue than misclassification and not its direct greatest concern.

CInadequate retention schedules

Inadequate retention schedules relate to how long data is stored, which is a consequence of misclassification but not the immediate greatest security risk.

DData disruption

Data disruption implies a loss of availability, which can be a risk, but misclassification primarily impacts confidentiality and integrity, making unauthorized access the more direct and immediate greatest concern.

Concept tested: Impact of data misclassification on security

Topics

#Data classification#Risk identification#Unauthorized access#Confidentiality

Community Discussion

No community discussion yet for this question.

Full CRISC Practice