CRISC IT Risk Assessment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Compensating

  Why it's wrong here

  A compensating control reduces residual risk by providing an alternative safeguard when a primary control is impractical, but it does not detect occurrence of a risk event. It is tempting because compensating controls often involve monitoring mechanisms; however, their core purpose is to substitute for a missing or inadequate control, not to identify that a risk event has transpired. They would be correct when a required control cannot be implemented due to cost or technical constraints.

• ✗

  Preventive

  Why it's wrong here

  Preventive controls stop or deter a risk event before it occurs, through segregation of duties, access restrictions or change approval; they produce no alert when something has already happened. They would be correct where the goal is to avoid the event entirely, not to identify that it has occurred.

• ✓

  Detective

  Why this is correct

  Detective controls are designed to discover and flag that a risk event has already happened, through logs, alerts, or monitoring. Unlike preventive controls, which block events before they occur, detective controls satisfy the stem's requirement of identifying that a risk event has taken place.

• ✗

  Corrective

  Why it's wrong here

  Corrective controls act after a risk event, remediating impact or restoring service; they do not identify that the event occurred. The temptation is that corrective action presupposes detection, yet detection itself is the province of detective controls, which log, alert or reconcile to reveal incidents as they happen.

Go deeper

Related to this question