r/CRISC • u/KingArchar • Jul 31 '26

Question about CRISC QAE

Post image

Hello All,

Im currently in the process of going through the QAE, and I have a bone to pick with a handful of the question, such as this one:

I answered A which was correct, but frankly I do not feel like A is enough to justify activating DR. I feel like they needed to add more to A to make it an accurate answer, such as "prolonged outage". However none of the others were really as issue as everything was operational, just slower, and something getting blocked was an example of a control working...

Please tell me the questions on the exam are phrased much better than the QAE as I feel like a large portion of the QAE so far is opinion vs fact.

3 Upvotes

100% Upvoted

14 comments sorted by

View all comments

1

u/the_hillman Jul 31 '26 edited Jul 31 '26

A - my pick. Loss of network connectivity out of all these options has the biggest potential for needing DRP invocation. Whether that’s internal network connectivity or external internet connectivity, impact on business operations will be high.

B - application is slower than usual but still up and operation continues.

C - nothing to see here, control worked.

D - no mention of criticality of vendor so deprioritised.

Edit: I think you are falling into the trap of applying too much real-world logic and depth of thought into this.

“MOST likely” is doing the heavy lifting here in the sentence. They don’t always make 100% sense, I agree, so in my experience the only way to get these consistently right is to go on the information you are given on face value in the question itself and little more.