mediumMultiple ChoiceObjective-mapped
How to Identify Root Cause of IT Risks: CRISC Approach
A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?
Quick Answer
The answer is to perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses. This approach is correct because root cause analysis for IT risk identification digs past the immediate technical symptom—in this case, misconfigured firewall rules—to uncover the systemic process failures, such as a deficient change management workflow, that allowed the errors to occur repeatedly across multiple regional offices. On the Certified in Risk and Information Systems Control CRISC exam, this question tests your understanding that risk identification is not about finding vulnerabilities (which a penetration test would do) or increasing visibility (logging), but about tracing the chain of causation back to a broken control process. A common trap is to confuse a technical fix with a root cause; remember that the CRISC framework emphasizes process and governance over technology. Memory tip: think "RCA peels the onion"—each layer of symptom reveals a deeper process weakness, not just the outer technical layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.
Performing a root cause analysis on the firewall misconfigurations will help identify the underlying process weaknesses, such as deficiencies in change management or configuration review procedures, that allowed the misconfigurations to occur. This directly addresses the root cause of the risk. Option B is incorrect because although logging is valuable, it only captures changes and does not analyze the reasons behind the misconfigurations. Option C is incorrect because penetration testing identifies vulnerabilities but does not determine why the firewall rules were misconfigured in the first place. Option D is incorrect because updating the risk register is a subsequent step after identifying the root cause, not a method to discover it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.
Why this is correct
Root cause analysis systematically identifies the fundamental reason for the misconfigurations, such as inadequate change management.
- ✗
Implement additional logging on all firewall devices to capture configuration changes.
Why it's wrong here
Logging alone does not perform analysis; it only records events.
- ✗
Conduct a penetration test targeting all regional office networks to identify vulnerabilities.
Why it's wrong here
Penetration tests identify vulnerabilities, not process failures or root causes.
- ✗
Update the risk register to include the incidents and assign risk owners.
Why it's wrong here
Updating the risk register is a subsequent step after identification, not a root cause identification method.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the IT risk manager for a mid-sized e-commerce company that processes over 10,000 transactions per day. The company recently migrated its customer database from an on-premises SQL Server to a cloud-based PostgreSQL instance on AWS RDS. The database contains personally identifiable information (PII) including names, addresses, and credit card numbers (stored as encrypted tokens). The migration was performed by the DevOps team with minimal involvement from the security team. Two weeks after the migration, the company experienced a data breach where an attacker exfiltrated a subset of customer records. The forensic investigation revealed that the attacker exploited a misconfigured security group that allowed inbound traffic from the internet on port 5432 (PostgreSQL default port). Additionally, the database had a publicly accessible endpoint, and the master user password was weak (eight characters, no special characters). The attacker used a brute-force attack to guess the password. The security group has since been corrected, and the password has been changed to a strong one. The breach notification laws require reporting within 72 hours. The CEO wants to understand the root cause and prevent recurrence. As the risk manager, which of the following actions should you recommend as the MOST effective to prevent a similar incident?
hard- ✓ A.Implement infrastructure-as-code (IaC) security scanning and policy enforcement in the CI/CD pipeline to prevent insecure configurations.
- B.Deploy an intrusion detection system (IDS) to monitor database traffic for brute-force attempts.
- C.Hire a dedicated database administrator to review all database configurations weekly.
- D.Conduct quarterly security audits of cloud infrastructure configurations.
Why A: The root cause is the misconfigured security group and weak password, both of which stem from insufficient security review and lack of automated controls. Implementing infrastructure-as-code (IaC) security scanning and policy enforcement in the CI/CD pipeline would automatically catch and block insecure configurations (e.g., publicly accessible database, weak passwords) before deployment, thus preventing similar incidents. Option B is incorrect because an IDS detects attacks in progress but does not prevent the initial misconfiguration. Option C is incorrect because relying on a single DBA to manually review all configurations weekly is error-prone and does not scale. Option D is incorrect because quarterly audits are too infrequent to catch misconfigurations that could be exploited immediately after deployment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.