mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A security control failed to prevent unauthorized…
A security control failed to prevent unauthorized access to a sensitive database. The risk owner has been notified. What should the risk practitioner do NEXT?
⚠ Common exam trap
The trap here is that candidates often jump to a technical fix (patching) or a detailed analysis (root cause) without first updating the risk register, which is the required first step in the risk monitoring and reporting process to maintain an accurate risk posture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recalculate the residual risk level and update the risk register
After a control failure, the risk practitioner must first reassess the residual risk level, which reflects the remaining risk after considering the failed control's ineffectiveness. Updating the risk register with the new residual risk ensures that the organization has an accurate, current view of its risk posture, which is a fundamental requirement of the risk monitoring and reporting process. This step aligns with the CRISC framework's emphasis on continuous risk assessment and documentation before any remediation or escalation actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Recalculate the residual risk level and update the risk register
Why this is correct
Control failure changes residual risk; must reassess and document.
- ✗
Escalate the issue to the board of directors
Why it's wrong here
Escalation is appropriate only after impact assessment, not immediately.
- ✗
Apply a patch to the database system immediately
Why it's wrong here
Patching without analysis can cause instability; risk assessment needed first.
- ✗
Perform a root cause analysis on the control failure
Why it's wrong here
Root cause analysis is part of remediation but not the immediate next step; risk reassessment comes first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.