mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A retail company uses a third-party vendor for…
A retail company uses a third-party vendor for payment processing. The vendor's service level agreement (SLA) requires 99.9% uptime. Recently, there were two incidents of downtime totaling 0.2% in a month, still within the SLA. However, the company's internal risk monitoring detected a pattern of increasing minor incidents. The vendor insists the SLA is met. The risk manager must decide on monitoring and reporting. The company's board wants to understand the risk. What is the best course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request a root cause analysis from the vendor and monitor trend more closely, reporting to board if trend worsens.
The increasing trend of incidents indicates potential risk even though the SLA is met. Requesting a root cause analysis and monitoring the trend closely allows proactive risk management and escalation to the board if the trend worsens. This aligns with best practices for risk monitoring and reporting. Terminating the contract (B) is too drastic for minor incidents. Increasing the SLA penalty (C) may not address the underlying pattern. Accepting the vendor's assurance (D) ignores the emerging risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Request a root cause analysis from the vendor and monitor trend more closely, reporting to board if trend worsens.
Why this is correct
Proactive management of increasing incidents aligns with risk monitoring best practices.
- ✗
Terminate the vendor contract.
Why it's wrong here
Termination is extreme given SLA is currently met.
- ✗
Increase the SLA penalty.
Why it's wrong here
Penalties do not address the underlying cause of incidents.
- ✗
Accept the vendor's assurance as SLA is met.
Why it's wrong here
Accepting without considering the trend may lead to future SLA breaches.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.