CRISC Information Technology and Security Practice Question
An organization is implementing the NIST Cybersecurity Framework to manage cyber risk. The risk manager is mapping the 'Detect' function to existing risk management processes. Which of the following activities is MOST directly aligned with the 'Detect' function?
⚠ Common exam trap
CRISC often tests function-boundary confusion in the NIST CSF — candidates see 'incident response plan' or 'patch management' and pick them because they sound security-related, missing that Respond and Protect functions are distinct from Detect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing continuous security monitoring of network traffic
The NIST Cybersecurity Framework's Detect function (DE) covers activities that identify the occurrence of a cybersecurity event, including continuous security monitoring (DE.CM), anomaly and event detection (DE.AE), and detection processes (DE.DP). Implementing continuous security monitoring of network traffic maps directly to DE.CM-1 (network monitoring) and is the clearest example of a Detect activity. It is about discovering events, not responding to or preventing them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implementing continuous security monitoring of network traffic
Why this is correct
Continuous security monitoring of network traffic directly fulfils the Detect function's requirement to identify cybersecurity events as they occur. Unlike Identify or Protect activities, detection demands ongoing visibility, and traffic monitoring provides the timely anomaly discovery the framework expects, satisfying the stem's mapping of Detect to risk management processes.
- ✗
Developing an incident response plan
Why it's wrong here
An incident response plan sits in the Respond function, governing containment, eradication and recovery once an event is confirmed. It is tempting because response planning is a core CSF activity and the natural next step after detection, which is the right alignment when the requirement concerns acting on confirmed incidents rather than identifying them.
- ✗
Conducting a business impact analysis
Why it's wrong here
A business impact analysis identifies critical processes and recovery requirements, feeding the 'Identify' and 'Recover' functions, not 'Detect'. It is tempting because BIA output underpins risk assessment, but 'Detect' requires continuous monitoring activities such as anomaly detection and security event logging that reveal incidents as they occur.
- ✗
Establishing a patch management process
Why it's wrong here
Patch management maps to the Protect function, reducing exploitable vulnerabilities before events occur rather than identifying them. It is tempting because patching is a foundational control that measurably lowers risk, which is the right alignment when the requirement is preventive hardening rather than continuous monitoring for anomalous activity.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.