hardMultiple ChoiceObjective-mapped
CRISC Practice Question: The risk manager for a multinational corporation…
You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement automated real-time monitoring of critical configuration changes with alerts.
Implementing automated real-time monitoring of critical configuration changes with alerts would have detected the misconfiguration immediately, allowing the SOC to respond within minutes rather than days. This directly addresses the monitoring gap (24-hour review cycle) and aligns with the low risk appetite for availability. Option B is incorrect because while CAB approval improves change control, it does not improve real-time detection; the change was made without following process, so additional approval steps would not prevent a rogue administrator. Option C is incorrect because monthly access reviews are still too infrequent to catch real-time configuration changes. Option D is incorrect because training does not provide immediate detection of unauthorized changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement automated real-time monitoring of critical configuration changes with alerts.
Why this is correct
Real-time monitoring would detect and alert on unauthorized changes immediately.
- ✗
Require all change requests to be approved by the change advisory board (CAB).
Why it's wrong here
CAB approval may prevent unauthorized changes but does not provide real-time detection.
- ✗
Increase the frequency of access reviews to monthly.
Why it's wrong here
Monthly reviews are still too slow to detect and respond to real-time changes.
- ✗
Provide additional training to cloud administrators on security policies.
Why it's wrong here
Training addresses human error but does not provide monitoring.
Visual reference
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.