easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A risk manager notices that a key risk indicator…
A risk manager notices that a key risk indicator (KRI) for failed login attempts has exceeded the threshold for three consecutive weeks. Which of the following should be the FIRST action?
⚠ Common exam trap
A common mix-up: candidates choose immediate escalation (Option C) because they assume any threshold breach must be reported, but CRISC emphasizes that the first step is always to investigate and validate the indicator before escalating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the root cause of the increase.
When a KRI exceeds its threshold for multiple consecutive periods, the first action is to investigate the root cause to determine whether the increase indicates a genuine security issue (e.g., brute-force attack, credential stuffing) or a false positive. Jumping to reporting or threshold adjustment without understanding the underlying cause could lead to misallocation of resources or missed detection of an actual threat. This aligns with the CRISC principle that risk indicators must be validated before escalation or remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigate the root cause of the increase.
Why this is correct
First step is to investigate root cause.
- ✗
Adjust the threshold to reduce false positives.
Why it's wrong here
Adjusting without analysis is inappropriate.
- ✗
Report the breach to the senior management immediately.
Why it's wrong here
Reporting without investigation may cause unnecessary alarm.
- ✗
Ignore the trend as a statistical anomaly.
Why it's wrong here
Ignoring may lead to undetected risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.