hardMultiple Choice
CRISC Practice Question: The IT risk manager for a mid-sized e-commerce…
You are the IT risk manager for a mid-sized e-commerce company. The company processes credit card payments and stores customer data. Recently, the company experienced a security incident where an attacker exploited a SQL injection vulnerability in the web application, exfiltrating a database of customer records. The vulnerability was introduced three months ago during a feature upgrade. The development team claims they followed secure coding guidelines, but the vulnerability was missed due to insufficient testing. The company's risk appetite is moderate, and they have a risk management policy that requires risks to be treated within 30 days of identification. The CISO wants to know the most effective way to reduce the likelihood of similar incidents. You have assessed that the current risk score for web application vulnerabilities is 16 (High). The company has a bug bounty program, but it has not been effective. Which of the following courses of action would BEST address the root cause and reduce the risk?
⚠ Common exam trap
Watch out — candidates often choose a compensating control (like a WAF or vulnerability scanning) because it seems faster or more familiar, but the question asks for the BEST way to reduce likelihood by addressing the root cause, which requires a preventive, process-level change like SSDLC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a secure software development lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing.
The root cause of the incident is a failure in the development process: secure coding guidelines were followed but insufficient testing allowed a SQL injection vulnerability to be introduced. Implementing a Secure Software Development Lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing directly addresses this root cause by embedding security controls into every phase of development, preventing vulnerabilities from being introduced in the first place. This is the most effective way to reduce the likelihood of similar incidents, as it proactively fixes the process rather than relying on reactive measures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the frequency of vulnerability scanning and patch management.
Why it's wrong here
Scanning and patching detect and remediate existing flaws but do not prevent insecure code entering the release; the SQL injection was introduced during a feature upgrade and missed by testing. Scanning is tempting as routine hygiene, yet the root cause is inadequate security testing within the SDLC, which secure code review and testing address.
- ✗
Deploy a web application firewall (WAF) to block SQL injection attempts.
Why it's wrong here
A WAF filters malicious requests at runtime but leaves the vulnerable code in place, so the underlying SQL injection flaw persists. WAFs are tempting as quick virtual patching for known exploits, yet the root cause is insecure code reaching production through insufficient testing, which SDLC testing controls must fix.
- ✗
Increase the reward amounts in the bug bounty program to attract more researchers.
Why it's wrong here
Raising bug bounty rewards only attracts more external researchers and cannot guarantee coverage of flaws introduced during feature upgrades. Bounties are tempting as crowd-sourced detection, but the root cause is insufficient security testing in the development lifecycle, which must be strengthened directly rather than outsourced after release.
- ✓
Implement a secure software development lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing.
Why this is correct
An SSDLC embeds security training, mandatory code reviews and automated security testing into development, catching flaws like SQL injection before release. This treats the root cause of the missed vulnerability, reducing likelihood within the 30-day policy.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.