mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A security analyst notices that the number of…
A security analyst notices that the number of failed login attempts has significantly increased over the past week. The SIEM alerts are not being triggered because the threshold was set too high. What is the MOST effective immediate action to improve monitoring?
⚠ Common exam trap
A common mix-up: candidates choose a more 'secure' but non-immediate option like biometrics (A) or a broad-brush approach like enabling all rules (C), failing to recognize that the question specifically asks for the 'most effective immediate action' to fix the monitoring gap caused by a misconfigured threshold.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lower the threshold for failed login alerts in the SIEM.
B is correct because the immediate issue is that the SIEM alert threshold is set too high, causing failed login attempts to go undetected. Lowering the threshold directly addresses the monitoring gap by ensuring that the SIEM generates alerts for anomalous failed login activity, enabling timely incident response without requiring a system overhaul.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a new authentication system with biometrics.
Why it's wrong here
Too costly and time-consuming for immediate action.
- ✓
Lower the threshold for failed login alerts in the SIEM.
Why this is correct
Directly fixes the issue of missed alerts.
- ✗
Enable all SIEM rules to capture every event.
Why it's wrong here
Causes alert fatigue and operational overload.
- ✗
Review logs manually each day to identify anomalies.
Why it's wrong here
Manual review is not scalable and may miss events.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.