CRISC Risk Response and Reporting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Number of security incidents reported

  Why it's wrong here

  Incident counts aggregate outcomes across all controls, so a firewall blocking traffic effectively cannot be distinguished from other defences preventing the same incidents. It is tempting because incident volume is readily available, and would be a valid KRI for overall security posture rather than a KCI for one firewall.

• ✓

  Number of blocked intrusion attempts

  Why this is correct

  Blocked intrusion attempts measure the firewall's actual defensive effectiveness against real traffic, making it a KCI rather than a configuration metric. Rule counts or patch levels indicate effort or state, not control performance, so this satisfies the stem's requirement for an effectiveness measure.

• ✗

  Average time to patch vulnerabilities

  Why it's wrong here

  Patch latency measures vulnerability management on hosts, not the firewall's rule enforcement, configuration integrity or traffic filtering capability. It is tempting because patching is a measurable control activity, and would be a valid KCI for a patch management process, not for the firewall itself.

• ✗

  Percentage of employees who completed security training

  Why it's wrong here

  Training completion measures personnel awareness, not firewall rule enforcement, throughput or blocked-traffic outcomes, so it cannot indicate whether the firewall control itself operates effectively. It is tempting because awareness metrics are easy to collect and report, and would be a valid KCI for a security awareness programme rather than a perimeter device.

Go deeper

Related to this question