easyMultiple Choice
CRISC Practice Question: A risk manager notices that a key risk indicator…
A risk manager notices that a key risk indicator (KRI) for failed login attempts has exceeded the threshold for three consecutive weeks. Which of the following should be the FIRST action?
⚠ Common exam trap
A common mix-up: candidates choose immediate escalation (Option C) because they assume any threshold breach must be reported, but CRISC emphasizes that the first step is always to investigate and validate the indicator before escalating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the root cause of the increase.
When a KRI exceeds its threshold for multiple consecutive periods, the first action is to investigate the root cause to determine whether the increase indicates a genuine security issue (e.g., brute-force attack, credential stuffing) or a false positive. Jumping to reporting or threshold adjustment without understanding the underlying cause could lead to misallocation of resources or missed detection of an actual threat. This aligns with the CRISC principle that risk indicators must be validated before escalation or remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigate the root cause of the increase.
Why this is correct
A KRI breaching threshold for three consecutive weeks signals a sustained control failure, so root-cause investigation must precede escalation or remediation. This satisfies the FIRST-action constraint by establishing why failed logins rose before selecting treatment, avoiding premature or misdirected responses.
- ✗
Adjust the threshold to reduce false positives.
Why it's wrong here
Adjusting the threshold suppresses the signal rather than investigating why failed logins tripled; a KRI breach demands root-cause analysis and escalation, not recalibration. Threshold tuning suits stable, well-understood metrics where documented noise genuinely causes false positives, not an unexplained three-week breach pattern.
- ✗
Report the breach to the senior management immediately.
Why it's wrong here
Escalating immediately skips validation and risk assessment, so senior management receives an unverified indicator with no context or recommended response. It is tempting because KRI thresholds exist to trigger escalation, but the first action is to investigate the cause and confirm the breach. Reporting follows analysis.
- ✗
Ignore the trend as a statistical anomaly.
Why it's wrong here
Three consecutive weekly breaches are a sustained pattern, not random noise, so dismissing it as an anomaly leaves a possible credential-stuffing or brute-force attack unaddressed. It is tempting because single spikes often reflect benign causes, but the trend itself is the signal. Investigation must precede any dismissal.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.