easyMultiple ChoiceObjective-mapped

CRISC Practice Question: Refer to the exhibit

Exhibit

KRI: Unauthorized Access Attempts
Threshold: 10 per day (Green), 10-20 (Amber), >20 (Red)
Current Week Data: Mon:5, Tue:8, Wed:12, Thu:15, Fri:9

Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Investigate Wednesday and Thursday spikes as they are above the Green threshold.

Wednesday (12) and Thursday (15) are in the Amber zone (10-20), indicating a need for investigation. Option A is premature because the threshold for Red (>20) was not breached. Option B ignores the amber days. Option D suggests adjusting the threshold without understanding the cause of the spikes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Adjust the KRI threshold to 15 per day to reduce false positives.
Why it's wrong here
Changing thresholds without analysis may obscure real issues.
✗
Continue monitoring as all days are within Green or Amber.
Why it's wrong here
Amber levels indicate potential risk and warrant investigation, not passive monitoring.
✓
Investigate Wednesday and Thursday spikes as they are above the Green threshold.
Why this is correct
Amber days should be analyzed to understand root causes and prevent escalation to Red.
✗
Escalate to the risk committee because the threshold was breached.
Why it's wrong here
The threshold for escalation (Red) was not exceeded; only Amber levels were observed.

Go deeper

CRISC Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question