CRISC Risk Response and Reporting Practice Question
A risk practitioner notices that the number of failed authentication attempts has spiked by 300% over the past week. Which of the following actions should be taken FIRST?
⚠ Common exam trap
The trap here is that candidates often jump to implementing a security control (like MFA or password changes) as a first response, but CRISC emphasizes that analysis and understanding of the risk must precede any response action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyze the logs to identify the source and nature of the attempts
The first step in responding to a security incident, such as a 300% spike in failed authentication attempts, is to analyze the logs to determine the source and nature of the activity. This aligns with the NIST incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes any containment or reporting action. Without understanding whether the spike is due to a brute-force attack, a misconfigured application, or a credential-stuffing campaign, any subsequent action could be premature or ineffective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Report the spike to the board
Why it's wrong here
Board reporting is an escalation and communication step, not triage; the spike must first be investigated to establish whether it is an attack, a misconfigured client or a monitoring artefact. It is tempting because governance bodies own risk oversight, but board notification is warranted only once material impact and severity are established.
- ✗
Implement multi-factor authentication
Why it's wrong here
Deploying multi-factor authentication is a remediation control that takes time to roll out and does not tell the practitioner what is causing the spike. It is tempting because MFA genuinely mitigates credential-based attacks, but it is the eventual treatment, not the immediate first action of validating and scoping the anomaly.
- ✗
Increase the frequency of password changes
Why it's wrong here
Changing password frequency does nothing to identify or contain the source of the failed attempts, and forced rotation would not stop an ongoing brute-force or credential-stuffing campaign. It is tempting because password rotation is a familiar control, but it belongs to standing account hygiene policy, not to triaging a live authentication anomaly.
- ✓
Analyze the logs to identify the source and nature of the attempts
Why this is correct
Analysing logs establishes whether the 300% spike reflects a brute-force attack, misconfigured application or credential-stuffing campaign. This satisfies the first-action constraint by determining the source and nature of the attempts before escalating, blocking or notifying, avoiding a premature response to an unidentified cause.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.