easyMultiple Choice
CRISC Practice Question: Refer to the exhibit
Exhibit
KRI: Unauthorized Access Attempts Threshold: 10 per day (Green), 10-20 (Amber), >20 (Red) Current Week Data: Mon:5, Tue:8, Wed:12, Thu:15, Fri:9
Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?
⚠ Common exam trap
The trap is treating any threshold breach as requiring immediate escalation, when in fact Amber breaches typically call for investigation first, and Red breaches trigger escalation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate Wednesday and Thursday spikes as they are above the Green threshold.
In KRI monitoring, values above the Green threshold but below the Red threshold (Amber zone) indicate a potential emerging risk that warrants investigation before escalation. Wednesday and Thursday spikes exceed the Green threshold, so the risk manager should first investigate these anomalies to determine if they are false positives or early signs of a real issue. This aligns with the CRISC principle of proactive risk monitoring and timely response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Adjust the KRI threshold to 15 per day to reduce false positives.
Why it's wrong here
Raising the threshold to suppress alerts hides a genuine upward trend rather than addressing it, and thresholds should not be re-tuned in response to a single week's breach. Adjusting thresholds is valid only after sustained false positives are confirmed through historical analysis.
- ✗
Continue monitoring as all days are within Green or Amber.
Why it's wrong here
Passive monitoring ignores that the KRI has moved into Amber, which signals deteriorating risk requiring investigation before it reaches Red. Continuing to monitor is correct only while readings remain within Green and no upward trend is present.
- ✓
Investigate Wednesday and Thursday spikes as they are above the Green threshold.
Why this is correct
Wednesday and Thursday breaches exceed the Green threshold, so the KRI demands immediate investigation before escalation or reporting. Threshold breaches signal control drift, and the risk manager must first establish cause and impact. Investigating these spikes satisfies the stem's requirement to act on current-week KRI data exceeding defined tolerance.
- ✗
Escalate to the risk committee because the threshold was breached.
Why it's wrong here
Escalation is premature: the exhibit shows the KRI breaching only an Amber threshold, and the question asks for the FIRST action. Escalating to the risk committee is the correct step once a Red threshold is breached or the risk exceeds appetite.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.