hardMultiple ChoiceObjective-mapped
CRISC Practice Question: The IT risk manager for a mid-sized e-commerce…
You are the IT risk manager for a mid-sized e-commerce company. The company processes credit card payments and stores customer data. Recently, the company experienced a security incident where an attacker exploited a SQL injection vulnerability in the web application, exfiltrating a database of customer records. The vulnerability was introduced three months ago during a feature upgrade. The development team claims they followed secure coding guidelines, but the vulnerability was missed due to insufficient testing. The company's risk appetite is moderate, and they have a risk management policy that requires risks to be treated within 30 days of identification. The CISO wants to know the most effective way to reduce the likelihood of similar incidents. You have assessed that the current risk score for web application vulnerabilities is 16 (High). The company has a bug bounty program, but it has not been effective. Which of the following courses of action would BEST address the root cause and reduce the risk?
⚠ Common exam trap
Watch out — candidates often choose a compensating control (like a WAF or vulnerability scanning) because it seems faster or more familiar, but the question asks for the BEST way to reduce likelihood by addressing the root cause, which requires a preventive, process-level change like SSDLC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a secure software development lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing.
The root cause of the incident is a failure in the development process: secure coding guidelines were followed but insufficient testing allowed a SQL injection vulnerability to be introduced. Implementing a Secure Software Development Lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing directly addresses this root cause by embedding security controls into every phase of development, preventing vulnerabilities from being introduced in the first place. This is the most effective way to reduce the likelihood of similar incidents, as it proactively fixes the process rather than relying on reactive measures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the frequency of vulnerability scanning and patch management.
Why it's wrong here
This is reactive and does not prevent new vulnerabilities from being created.
- ✗
Deploy a web application firewall (WAF) to block SQL injection attempts.
Why it's wrong here
WAF is a compensating control but does not address the root cause of insecure coding.
- ✗
Increase the reward amounts in the bug bounty program to attract more researchers.
Why it's wrong here
This is reactive and may not prevent vulnerabilities from being introduced.
- ✓
Implement a secure software development lifecycle (SSDLC) with mandatory security training, code reviews, and automated security testing.
Why this is correct
This addresses the root cause by preventing vulnerabilities from being introduced.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.