CRISC IT Risk Assessment Practice Question
A company is evaluating controls for a high-risk process. Which control type is designed to stop a risk event from occurring?
⚠ Common exam trap
A common pitfall in CRISC is confusing preventive controls with detective controls. For example, a candidate might see a control that identifies a threat (e.g., an IDS alert) and mistakenly classify it as preventive, when in fact it only detects the event after it has begun.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preventive
A preventive control is designed to stop a risk event from occurring by implementing barriers or safeguards before the event can happen. For a high-risk process, this might include access control lists (ACLs) on a firewall that block unauthorized traffic, or input validation routines in an application that reject malformed data before it can trigger a buffer overflow. By proactively eliminating the threat vector, preventive controls reduce the likelihood of the risk event to zero for the protected path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preventive
Why this is correct
Preventive controls, such as access controls and encryption, stop risk events.
- ✗
Detective
Why it's wrong here
Detective controls identify events after they occur.
- ✗
Corrective
Why it's wrong here
Corrective controls restore operations after an event.
- ✗
Compensating
Why it's wrong here
Compensating controls provide alternative protection when primary controls are not feasible.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.