CRISC IT Risk Assessment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Firewall

  Why it's wrong here

  A firewall enforces access rules in real time, so it blocks or permits traffic rather than detecting and reporting events after they occur. It is tempting because firewalls log denied connections, but that logging is a by-product; a detective control such as an IDS or log review is designed to identify activity already underway.

• ✗

  Data encryption

  Why it's wrong here

  Encryption is preventive, rendering data unreadable to unauthorised parties before any incident; it produces no logs or alerts that reveal an event. Encryption is correct when the requirement is protecting confidentiality of data at rest or in transit, not identifying that a breach occurred.

• ✗

  Backup restoration

  Why it's wrong here

  Backup restoration is corrective: it recovers data after an incident has occurred, whereas detective controls identify events as or after they happen. Restoration is the right control when the objective is recovering availability following destructive loss, not detecting the loss itself.

• ✓

  Intrusion Detection System (IDS)

  Why this is correct

  An IDS monitors network traffic and raises alerts on suspicious activity, satisfying the detective control requirement of identifying incidents after they occur. Unlike preventive controls such as firewalls, which block traffic, or corrective controls, it provides visibility and evidence, enabling timely response to potential intrusions.

Go deeper

Related to this question