CRISC IT Risk Assessment Practice Question
Which of the following is an example of a preventive control?
⚠ Common exam trap
CRISC often tests the distinction between control types by presenting controls that seem protective but are actually detective or corrective, such as intrusion detection systems or incident response plans, leading candidates to misclassify them as preventive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption of sensitive data
Encryption of sensitive data is a preventive control because it stops unauthorized parties from reading the data in the first place, even if they gain access to the storage or transmission medium. It acts before an incident causes harm by rendering the data unintelligible without the correct key. This aligns with the CRISC definition of preventive controls, which are designed to deter or stop an event from occurring or reduce its impact before it happens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption of sensitive data
Why this is correct
Encryption renders sensitive data unreadable to unauthorised parties before an incident occurs, stopping disclosure rather than detecting it afterwards. That proactive blocking of the threat event is what defines a preventive control, unlike detective or corrective controls that act during or after compromise.
- ✗
Incident response plan
Why it's wrong here
An incident response plan is a corrective and recovery control: it guides action after an event has occurred, so it cannot stop the event happening. It is tempting because planning feels proactive, and it would be correct when the objective is containing, eradicating and recovering from a realised incident.
- ✗
Intrusion detection system
Why it's wrong here
An IDS monitors and alerts on malicious activity after it occurs, so it detects rather than blocks; it cannot stop an attack from succeeding. It is tempting because it is a security control, but its purpose is detective, making it the right answer when the question asks for detection rather than prevention.
- ✗
Security logs
Why it's wrong here
Security logs record events for later review and forensic analysis, so they provide detective evidence rather than stopping an action before it happens. They are tempting because logging underpins security monitoring, but logs are the correct choice when the requirement is retrospective visibility or audit, not prevention.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.