easyMultiple SelectObjective-mapped
CRISC Practice Question: A SIEM generates alerts for the following events
A SIEM generates alerts for the following events. Which TWO events should be considered potential emerging risks? (Select exactly 2.)
⚠ Common exam trap
Test-takers frequently confuse operational alerts (like low disk space or successful backups) with security risks, failing to recognize that emerging risks must involve active threat indicators such as reconnaissance or anomalous traffic patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High number of failed authentication attempts from a single IP
A high number of failed authentication attempts from a single IP (C) is a classic indicator of a brute-force or password-spraying attack. This represents an emerging risk because it signals active reconnaissance or attempted unauthorized access, which could lead to account compromise or lateral movement if successful.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scheduled backup completed successfully
Why it's wrong here
Expected administrative activity.
- ✗
Software update installed on server
Why it's wrong here
May be legitimate if authorized.
- ✓
High number of failed authentication attempts from a single IP
Why this is correct
Indicates a brute-force attack attempt.
- ✗
Low disk space alert on a file server
Why it's wrong here
Operational issue, not necessarily a security risk.
- ✓
Unusual increase in outbound traffic from a database server
Why this is correct
Could indicate data exfiltration.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.