mediumMultiple SelectObjective-mapped
CRISC Practice Question: Recently experienced a significant security…
An organization recently experienced a significant security incident that was not detected by existing monitoring controls. The risk team is reviewing the effectiveness of the control monitoring framework. Which THREE of the following are key factors that should be evaluated to improve detection capabilities?
⚠ Common exam trap
ISACA often tests the distinction between detection improvement and response improvement; the trap here is that candidates confuse the incident response plan (Option B) or automation (Option D) with detection capabilities, when they are actually post-detection activities that do not address why the incident was missed in the first place.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The correlation rules between different monitoring tools
Correlation rules between different monitoring tools (Option A) are critical because they define how alerts from disparate sources (e.g., SIEM, IDS/IPS, endpoint detection) are combined to identify complex attack patterns. Without well-tuned correlation rules, the organization may miss multi-stage attacks that span multiple systems, as no single tool alone provides the full picture. Evaluating and refining these rules directly improves the detection of incidents that existing controls failed to catch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The correlation rules between different monitoring tools
Why this is correct
Correlation reduces false positives and identifies complex patterns.
- ✗
The existence of an incident response plan
Why it's wrong here
Response plan is for after detection, not for improving detection.
- ✓
The timeliness of data collection from sources
Why this is correct
Delayed data leads to delayed detection.
- ✗
The level of automation in incident response
Why it's wrong here
Incident response automation improves reaction, not detection.
- ✓
The coverage of monitoring across all high-risk assets
Why this is correct
Unmonitored assets represent detection gaps.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.