mediumMultiple Choice
How to Identify Root Cause of IT Risks: CRISC Approach
A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?
Quick Answer
The answer is to perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses. This approach is correct because root cause analysis for IT risk identification digs past the immediate technical symptom—in this case, misconfigured firewall rules—to uncover the systemic process failures, such as a deficient change management workflow, that allowed the errors to occur repeatedly across multiple regional offices. On the Certified in Risk and Information Systems Control CRISC exam, this question tests your understanding that risk identification is not about finding vulnerabilities (which a penetration test would do) or increasing visibility (logging), but about tracing the chain of causation back to a broken control process. A common trap is to confuse a technical fix with a root cause; remember that the CRISC framework emphasizes process and governance over technology. Memory tip: think "RCA peels the onion"—each layer of symptom reveals a deeper process weakness, not just the outer technical layer.
⚠ Common exam trap
CRISC often tests the difference between identifying symptoms/vulnerabilities (logging, pen testing) and determining the underlying cause (RCA) — candidates may choose logging or pen testing because they sound proactive, but they do not answer 'why' the risk exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.
Root cause analysis (RCA) on the firewall misconfigurations directly investigates why the misconfigurations occurred, uncovering underlying process weaknesses such as inadequate change management, lack of configuration standards, or insufficient training. This addresses the root cause rather than symptoms, which is exactly what the risk manager needs to prevent recurrence across regional offices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.
Why this is correct
Root cause analysis examines the firewall misconfigurations to expose the underlying process weaknesses, such as absent change control or review, that allowed them across regions. This addresses the stem's need to identify why the risk occurred, not merely remediate individual rules.
- ✗
Implement additional logging on all firewall devices to capture configuration changes.
Why it's wrong here
Logging captures future configuration changes, so it cannot explain the misconfigurations already exploited across the regional offices. It tempts because logging underpins detective controls and is correct when the goal is ongoing monitoring or building an audit trail after causes are established.
- ✗
Conduct a penetration test targeting all regional office networks to identify vulnerabilities.
Why it's wrong here
A penetration test identifies exploitable vulnerabilities but does not establish why firewall rules were misconfigured in each office. It tempts because it directly probes the affected networks, and it is the right choice when validating control effectiveness or measuring exposure rather than diagnosing root cause.
- ✗
Update the risk register to include the incidents and assign risk owners.
Why it's wrong here
Registering incidents and assigning owners records and tracks known risk; it performs no causal investigation, so the recurring firewall misconfiguration stays unidentified. It tempts because risk registers are the standard CRISC artefact, and they are correct once causes are known and treatment must be monitored.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the IT risk manager for a mid-sized e-commerce company that processes over 10,000 transactions per day. The company recently migrated its customer database from an on-premises SQL Server to a cloud-based PostgreSQL instance on AWS RDS. The database contains personally identifiable information (PII) including names, addresses, and credit card numbers (stored as encrypted tokens). The migration was performed by the DevOps team with minimal involvement from the security team. Two weeks after the migration, the company experienced a data breach where an attacker exfiltrated a subset of customer records. The forensic investigation revealed that the attacker exploited a misconfigured security group that allowed inbound traffic from the internet on port 5432 (PostgreSQL default port). Additionally, the database had a publicly accessible endpoint, and the master user password was weak (eight characters, no special characters). The attacker used a brute-force attack to guess the password. The security group has since been corrected, and the password has been changed to a strong one. The breach notification laws require reporting within 72 hours. The CEO wants to understand the root cause and prevent recurrence. As the risk manager, which of the following actions should you recommend as the MOST effective to prevent a similar incident?
hard- ✓ A.Implement infrastructure-as-code (IaC) security scanning and policy enforcement in the CI/CD pipeline to prevent insecure configurations.
- B.Deploy an intrusion detection system (IDS) to monitor database traffic for brute-force attempts.
- C.Hire a dedicated database administrator to review all database configurations weekly.
- D.Conduct quarterly security audits of cloud infrastructure configurations.
Why A: The root cause is the misconfigured security group and weak password, both of which stem from insufficient security review and lack of automated controls. Implementing infrastructure-as-code (IaC) security scanning and policy enforcement in the CI/CD pipeline would automatically catch and block insecure configurations (e.g., publicly accessible database, weak passwords) before deployment, thus preventing similar incidents. Option B is incorrect because an IDS detects attacks in progress but does not prevent the initial misconfiguration. Option C is incorrect because relying on a single DBA to manually review all configurations weekly is error-prone and does not scale. Option D is incorrect because quarterly audits are too infrequent to catch misconfigurations that could be exploited immediately after deployment.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.