easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A database error log shows repeated login…
Exhibit
Refer to the exhibit. Error Log (excerpt): [2024-03-20 14:32:10] ERROR: ORA-01017: invalid username/password; logon denied At: JDBC Thin Client connection from 192.168.1.100 [2024-03-20 14:32:15] ERROR: ORA-01017: invalid username/password; logon denied At: JDBC Thin Client connection from 192.168.1.100 [2024-03-20 14:32:20] ERROR: ORA-01017: invalid username/password; logon denied At: JDBC Thin Client connection from 192.168.1.100 [2024-03-20 14:32:25] ERROR: ORA-01017: invalid username/password; logon denied At: JDBC Thin Client connection from 192.168.1.100 [2024-03-20 14:32:30] INFO: User 'app_user' authenticated successfully from 192.168.1.100
A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?
⚠ Common exam trap
Many candidates confuse a detective control (monitoring) with a preventive control (lockout), or assume that MFA would have prevented the successful login, when in fact the question focuses on the repeated failures preceding success, which is the hallmark of a missing lockout policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Account lockout policy is not enforced
The repeated login failures followed by a successful authentication indicate that the account lockout policy was not enforced. Without a lockout threshold, an attacker can perform unlimited password attempts until they guess the correct credential. This is a direct failure of the account lockout control, which is designed to prevent brute-force attacks by disabling the account after a defined number of failed attempts (e.g., 5 failures within 15 minutes per NIST SP 800-63B).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Account lockout policy is not enforced
Why this is correct
Account should have been locked after a few failures.
- ✗
No multi-factor authentication
Why it's wrong here
MFA would help but not the immediate missing control.
- ✗
Insufficient failed login monitoring
Why it's wrong here
Monitoring exists (log), but control prevents brute force.
- ✗
Weak password policy
Why it's wrong here
Password may be strong but still vulnerable to brute force.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.