CRISC IT Risk Assessment Practice Question
Which of the following is a detective control?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intrusion detection system
Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data encryption
Why it's wrong here
Encryption is preventive: it renders data unreadable to thwart disclosure, rather than identifying that an incident occurred. It tempts because encryption supports compliance and data-protection goals, and it would be the right answer to a question asking for a preventive control over data at rest or in transit.
- ✓
Intrusion detection system
Why this is correct
An intrusion detection system monitors network traffic and raises alerts on suspicious activity, satisfying the detective control requirement of identifying events after they occur. Unlike preventive controls such as firewalls, which block traffic, it detects and reports intrusions without stopping them, providing the visibility CRISC expects for detection.
- ✗
Backup and restore
Why it's wrong here
Backup and restore is corrective or recovery-oriented, returning systems to operation after loss; it does not detect that an event happened. It tempts because backups are essential to resilience and auditing, and would be correct if the question asked for a recovery control.
- ✗
Firewall
Why it's wrong here
A firewall is preventive, blocking or allowing traffic by rule before it reaches a host; it generates no detection of activity that has already occurred. It tempts because firewall logs can feed monitoring, yet the device's primary control function is enforcement, not identification.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.