mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: The risk manager for a healthcare organization…
You are the risk manager for a healthcare organization that uses an electronic health records (EHR) system. The system has a built-in audit log that records all access to patient data. Recently, the Chief Information Security Officer (CISO) raised a concern that there have been multiple reports of unauthorized access to patient records, but the audit log analysis has not identified any suspicious activity. You have been asked to investigate. Your review of the audit log configuration reveals that the system only logs successful access events, not failed access attempts. Additionally, the log retention period is set to 30 days, and the logs are stored in a flat file on the same server as the EHR application. The monitoring team manually reviews the logs at the end of each month. Which of the following is the MOST significant risk associated with the current monitoring approach?
⚠ Common exam trap
The trap here is that candidates focus on the operational deficiencies (short retention, manual review, missing failed attempts) rather than the foundational security control failure of log segregation, which is the most critical risk because it compromises the entire audit trail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storing logs on the same server as the EHR application exposes them to alteration or deletion if the server is compromised.
Storing audit logs on the same server as the EHR application violates the principle of log segregation. If the server is compromised, an attacker can alter or delete the logs to cover their tracks, making detection impossible. This is the most significant risk because it directly undermines the integrity and availability of the evidence needed to investigate unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Storing logs on the same server as the EHR application exposes them to alteration or deletion if the server is compromised.
Why this is correct
Log integrity is compromised, which is a critical risk for monitoring and forensics.
- ✗
The 30-day log retention period is too short to detect long-term patterns of unauthorized access.
Why it's wrong here
Retention is a concern but not the most significant risk compared to log integrity.
- ✗
Manual review of logs is ineffective and may miss critical events; automated monitoring should be implemented.
Why it's wrong here
Manual review is a weakness but not the most critical risk.
- ✗
The audit log does not capture failed access attempts, which could indicate brute-force attacks or unauthorized access attempts.
Why it's wrong here
This is a gap but not directly related to the monitoring approach's risk.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.