The correct answer is to recommend a root cause analysis before considering a threshold change. Raising the KRI threshold due to transient breaches without investigation is a classic risk management error, because it treats a symptom rather than the underlying cause. The recurring network issues indicate a systemic control weakness that, if ignored, could escalate into significant transaction failures and revenue loss. On the CRISC exam, this scenario tests your understanding of the risk response lifecycle—specifically that KRIs are early warning signals, not targets to be adjusted for convenience. A common trap is to accept the risk owner’s request to raise the threshold simply because each breach was “transient,” but the exam expects you to recognize that repeated transient events point to a root cause requiring corrective action. Memory tip: “Don’t raise the flagpole because the wind keeps blowing—fix the wind.” Always prioritize root cause analysis over threshold adjustment when breaches are recurrent.
CRISC Risk and Control Monitoring and Reporting Practice Question
This CRISC practice question tests your understanding of risk and control monitoring and reporting. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A retail company has a risk monitoring program that tracks key risk indicators (KRIs) for its e-commerce platform. One KRI measures the number of failed payment transactions as a percentage of total transactions. The threshold is set at 2%. Over the past quarter, the KRI has been fluctuating between 1.8% and 2.5%, breaching the threshold several times. Each time the KRI exceeded the threshold, the risk owner performed a manual investigation and found that the failures were due to transient network issues that resolved on their own. The risk owner has now requested that the threshold be raised to 3% to avoid unnecessary investigations. The risk practitioner is evaluating this request. What should the risk practitioner do?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change.
Option C is correct because the recurring network issues causing threshold breaches indicate an underlying problem that needs to be addressed, not just a threshold adjustment. Raising the threshold without understanding the root cause could mask a significant risk to transaction integrity and revenue. A root cause analysis (RCA) would identify whether the transient network issues stem from infrastructure, configuration, or external dependencies, enabling a proper control response.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Approve the threshold increase since investigations have not found any significant issues.
Why it's wrong here
Ignores the pattern of failures.
✗
Suggest implementing automated remediation for network issues instead of raising the threshold.
Why it's wrong here
Automation is good but root cause should be addressed first.
✓
Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change.
Why this is correct
Addresses the underlying issue.
Related concept
Read the scenario before looking for a memorised answer.
✗
Reject the request and require investigation of every breach.
Why it's wrong here
May cause alert fatigue without solving root cause.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may assume raising the threshold is a simple risk acceptance decision, but CRISC emphasizes that risk responses must be based on understanding the root cause, not just adjusting metrics to avoid investigations.
Detailed technical explanation
How to think about this question
In practice, KRIs for payment transactions often track not just failure rates but also latency and error codes (e.g., HTTP 503, timeout). Transient network issues could stem from DNS resolution failures, TLS handshake timeouts, or load balancer misconfigurations. A root cause analysis might involve reviewing network logs, analyzing packet captures, or checking cloud provider SLAs to determine if the issue is internal (e.g., insufficient capacity) or external (e.g., ISP routing problems).
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Risk and Control Monitoring and Reporting — This question tests Risk and Control Monitoring and Reporting — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change. — Option C is correct because the recurring network issues causing threshold breaches indicate an underlying problem that needs to be addressed, not just a threshold adjustment. Raising the threshold without understanding the root cause could mask a significant risk to transaction integrity and revenue. A root cause analysis (RCA) would identify whether the transient network issues stem from infrastructure, configuration, or external dependencies, enabling a proper control response.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.