easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A small online retailer with 15 employees sells…
A small online retailer with 15 employees sells handmade crafts through its e-commerce website. The company processes payments via a third-party gateway. The owner manually reviews transaction logs once a week for fraud indicators, but recently discovered three chargebacks due to unauthorized transactions. The retailer has limited IT budget and no dedicated security staff. The owner wants to improve detection of fraudulent transactions without significant investment. The current manual process takes about two hours per week and often results in delayed detection. The payment gateway offers basic fraud detection features such as IP geolocation and velocity checks, but these are not enabled. What is the most practical first step?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the built-in fraud detection features offered by the payment gateway.
Enabling the built-in fraud detection features offered by the payment gateway is the most practical first step because it is low-cost, quick to implement, and leverages existing capabilities without additional expense. Option B (hiring a part-time analyst) would increase costs and may not be sustainable for a small retailer. Option C (purchasing a third-party system) requires significant investment and implementation time. Option D (accepting the risk) is not acceptable given the recent chargebacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the built-in fraud detection features offered by the payment gateway.
Why this is correct
This is the correct answer because the payment gateway already offers fraud detection features that are not enabled; enabling them is a low-cost, immediate improvement.
- ✗
Hire a part-time fraud analyst to review logs daily.
Why it's wrong here
Hiring a part-time analyst would increase ongoing costs and may not be feasible given the limited budget; also, it does not address the immediate need for automated detection.
- ✗
Purchase an automated fraud detection system from a third-party vendor.
Why it's wrong here
Purchasing a separate automated system is expensive and would require significant investment and time, making it less practical as a first step.
- ✗
Accept the current risk and set aside a reserve fund for chargebacks.
Why it's wrong here
Accepting the risk is not advisable because the retailer has already experienced three chargebacks, indicating a need for improved controls.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.