CRISC Risk Response and Reporting Practice Question
A company's IT risk manager is evaluating Key Risk Indicators (KRIs) for the cybersecurity function. Which TWO of the following are valid examples of leading KRIs?
⚠ Common exam trap
Many exam-takers confuse lagging indicators (which measure past events like downtime or audit findings) with leading indicators (which predict future risk), leading candidates to select outcome-based metrics like successful attacks instead of proactive measures like patch lag.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patch lag metric for critical systems
Option B (Patch lag metric for critical systems) is a valid leading KRI because it measures the time between patch release and deployment, a predictive indicator of exposure to known vulnerabilities before an incident occurs. Option C (Failed authentication spike detection) is also a leading KRI because a sudden increase in failed logins can signal credential-stuffing, brute-force, or password-spraying attempts, providing an early warning of an imminent compromise. In contrast, Option A (System downtime due to security incidents) is a lagging indicator, as it records impact after an incident has already happened. Option D (Number of audit findings related to access controls) is a lagging compliance metric reflecting past control weaknesses rather than forward-looking risk. Option E (Number of successful cyber attacks in the past quarter) is likewise lagging, since it counts breaches that have already succeeded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System downtime due to security incidents
Why it's wrong here
Downtime caused by security incidents measures realised impact after the event, so it is a lagging indicator. It tempts because availability metrics are quantifiable and security-linked, and downtime tracking is correct for service-level reporting or post-incident analysis, not for predicting future risk exposure.
- ✓
Patch lag metric for critical systems
Why this is correct
Patch lag measures the interval between vulnerability disclosure and remediation, quantifying exposure before exploitation occurs. It satisfies the stem's leading requirement by predicting future breach likelihood rather than reporting past incidents, and targets critical systems where unpatched flaws most directly elevate residual risk.
- ✓
Failed authentication spike detection
Why this is correct
Failed authentication spike detection is a leading KRI because it measures a precursor event — anomalous authentication attempts — that precedes credential-stuffing or brute-force compromise. It satisfies the stem's requirement for forward-looking indicators by flagging deteriorating conditions before loss occurs, unlike lagging metrics such as incident counts, which merely record harm already suffered.
- ✗
Number of audit findings related to access controls
Why it's wrong here
Audit findings describe control weaknesses already identified through retrospective review, so they trail the risk rather than foreshadow it. It tempts because findings feel forward-looking and are security-relevant, and they are correct as lagging indicators or compliance metrics, not leading KRIs.
- ✗
Number of successful cyber attacks in the past quarter
Why it's wrong here
Successful attacks are recorded after control failure, making this a lagging indicator that reports past loss rather than predicting future risk. It tempts because attack counts are easy to collect and clearly security-related, and such metrics are correct as lagging KRIs or for post-incident reporting.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.