CRISC Risk Response and Reporting Practice Question
An organization is selecting a control to prevent unauthorized access to a critical database. Which control type is most appropriate?
⚠ Common exam trap
It's easy for candidates to confuse 'preventive' with 'detective' controls, mistakenly thinking that logging and monitoring (detective) are sufficient to stop unauthorized access, when in fact they only provide visibility after the fact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preventive control
Preventive control is the most appropriate because it directly stops unauthorized access before it occurs. For a critical database, this includes mechanisms like database firewalls, access control lists (ACLs), or mandatory access control (MAC) policies that enforce authentication and authorization at the point of entry, such as requiring valid credentials and role-based permissions before any query is processed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detective control
Why it's wrong here
Detective controls identify and log unauthorised access after it occurs, so the connection to the critical database is not stopped. They are tempting because monitoring and alerting are vital for compliance and response, and would be correct where the requirement is discovering and investigating access events rather than preventing them.
- ✗
Corrective control
Why it's wrong here
Corrective controls restore systems after an incident, so they cannot stop an unauthorised database connection from succeeding. They are tempting because remediation and recovery steps are essential after a breach, and would be the right selection when the requirement is to recover access or repair data following an incident.
- ✗
Directive control
Why it's wrong here
Directive controls set policy, procedures and awareness that steer behaviour, but they impose no technical enforcement preventing a connection. They are tempting because written access policies underpin governance, and would be correct where the objective is establishing mandatory rules rather than blocking the access attempt itself.
- ✓
Preventive control
Why this is correct
Preventive controls stop unauthorised access before it occurs, directly satisfying the stem's requirement to prevent access to the critical database. Detective controls only identify access after the fact, and corrective controls restore service afterwards, so neither blocks the initial intrusion.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.