CRISC Practice Test 21 — 15 Questions

Question 1

An S3 bucket policy is configured as shown. During a monitoring review, the risk practitioner notices that the 'DenyAll' policy is never evaluated because of an explicit allow? What is the MOST likely monitoring gap?

Accepted Answer

No automated test validates that the DenyAll policy is effective. The correct answer is C. The DenyAll policy is overridden by the AllowRead policy because evaluation logic gives precedence to explicit deny over allow only if the deny is evaluated; but here the allow is explicit and matches, so the deny is not evaluated? Actually AWS evaluates explicit allow and explicit deny; an explicit deny always overrides allows. However, the exhibit shows two statements; the DenyAll would deny all actions, but the AllowRead allows GetObject. In AWS, explicit deny overrides allow, so the DenyAll should block GetObject unless the condition? But the condition on AllowRead is 10.0.0.0/8. A request from 10.x.x.x would match AllowRead but then DenyAll would also match and deny. The key monitoring gap is that there is no mechanism to check if DenyAll is properly evaluated; the risk practitioner likely missed that the condition on AllowRead makes it only effective for a specific IP range, and the DenyAll might unintentionally block legitimate access. But the question says 'never evaluated' which indicates a logic error: In AWS, explicit deny always overrides, so the DenyAll should be evaluated. However, the statement says 'because of an explicit allow' which is false; the proper gap is that the policy lacks monitoring to detect unintended deny effects. The intended correct answer is that the monitoring did not include policy validation tests. Option A is about KRI, not policy validation. Option B is about access review, not policy. Option D is about encryption, unrelated. So answer C.

Answer

No KRI is defined for unauthorized access attempts

Answer

Server-side encryption is not enabled for the bucket

Answer

User access reviews are not performed quarterly

Question 2

A company implements a new automated control to monitor user access rights. The control sends a daily report of any users with excessive privileges. What is the PRIMARY benefit of this control?

Accepted Answer

Enables timely remediation of access violations. Option D is correct because the control enables timely identification and remediation of access violations. Option A is not necessarily true as reviews may still be needed. Option B is false because manual remediation is still required. Option C is not real-time since reports are daily.

Answer

Reduces the number of user access reviews

Answer

Eliminates the need for manual checks

Answer

Provides real-time alerts for critical changes

Question 3

During a risk assessment, a control self-assessment (CSA) indicates that a key control is operating effectively. However, an independent audit finds multiple control failures. Which of the following is the MOST likely reason for this discrepancy?

Accepted Answer

The CSA participants lacked objectivity. Option B is correct because CSA participants may lack objectivity due to bias or lack of independence. Option A is less likely if the CSA is recent. Option C is possible but not the most likely cause of systematic discrepancy. Option D is possible but not specific to CSA vs audit.

Answer

The audit tested different samples

Answer

The control environment changed

Answer

The CSA was conducted too recently

Question 4

An organization is designing a risk and control monitoring program for a new cloud-based application. Which of the following is the MOST important factor to consider when selecting Key Risk Indicators (KRIs)?

Accepted Answer

Alignment with strategic objectives.. Option A is correct because KRIs must be aligned with risk appetite and business objectives to ensure they measure what matters. Option B is wrong because ease of collection is secondary to relevance. Option C is wrong because historical data may not exist for new applications. Option D is wrong because industry best practices are guidelines, not a primary factor.

Answer

Historical loss data availability.

Answer

Ease of automated data collection.

Answer

Industry best practices.

Question 5

Refer to the exhibit. What does the exhibit most likely indicate about the control monitoring?

Accepted Answer

The control is effective but the monitoring configuration is incorrect.. Option D is correct because the target is set to 90% while the policy requires 95%, so the monitoring configuration is incorrect. The control appears to meet the target (94.5% > 90%), but it fails to meet the policy requirement. Option A is wrong because the control meets the configured target but not the policy. Option B is wrong because the current value is above the configured target. Option C is wrong because the control is not failing relative to the target; it is a configuration issue.

Answer

The control is failing and needs immediate remediation.

Answer

The control is close to target but requires attention.

Answer

The control is meeting its target.

Question 6

A risk practitioner notices that a key control is tested only once a year, but the associated risk has a high velocity of change. What is the BEST recommendation?

Accepted Answer

Increase testing frequency to quarterly or monthly. The correct answer is B. For high velocity risks, more frequent monitoring is needed. Option A does not address velocity. Option C is reactive. Option D negates the control.

Answer

Remove the control if it cannot be tested more often

Answer

Wait for a control failure before increasing frequency

Answer

Continue annual testing because it meets regulatory requirements

Question 7

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Accepted Answer

A service account is authenticating with a password rather than a certificate. The correct answer is B. The most significant issue is that a service account used for backup is authenticating with a password instead of a certificate or key, which is a security weakness. Option A is true but less significant than the authentication method. Option C is not indicated (no excessive privileges). Option D is about logging, which is present.

Answer

The service account has excessive database privileges

Answer

The failed login events were not logged in real time

Answer

Failed logins indicate a possible brute force attack

Question 8

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

Accepted Answer

Investigate the KRI calculation methodology. Option C is correct because the discrepancy suggests the KRI calculation may be flawed. Option A jumps to adjusting thresholds without understanding the root cause. Option B may be premature if the control testing is accurate. Option D escalates without first analyzing the issue.

Answer

Escalate to the risk committee

Answer

Change the KRI threshold to amber

Answer

Re-test the control

Question 9

A company's internal audit function reports that a detective control (manual review of transactions) is operating effectively based on a sample of 50 transactions showing no issues. However, the continuous monitoring system shows that 100 suspicious transactions were not reviewed during the same period. The control owner argues the control is effective. What is the BEST conclusion?

Accepted Answer

The control is ineffective because the audit sample size is too small to detect the actual failure rate.. Option D is correct because the audit sample of 50 did not include the suspicious transactions that the continuous monitoring flagged, indicating the sample size was insufficient to detect the actual failure rate. Option A is wrong because the sample alone does not prove effectiveness across all transactions. Option B is wrong because the monitoring system is likely reliable. Option C is wrong because the monitoring system is not necessarily too sensitive; it revealed actual failures.

Answer

The control is effective because the monitoring system is too sensitive.

Answer

The control is ineffective because the monitoring system is unreliable.

Answer

The control is effective because the sample showed no issues.

Question 10

An external audit finds that a control is not operating as designed. The auditor recommends corrective action. What should the risk practitioner do FIRST?

Accepted Answer

Assess the impact of the control deficiency on residual risk. The correct answer is A. The risk practitioner should first assess the impact of the control deficiency on the risk level. Options B and C are actions that follow the assessment. Option D is reactive and may be part of remediation but not first.

Answer

Implement the auditor's recommendation immediately

Answer

Develop a remediation plan with the control owner

Answer

Update the risk register with the auditor's finding

Question 11

A risk analyst is reviewing control monitoring results and notices that a detective control has a high false positive rate. What is the BEST action to improve the control's efficiency?

Accepted Answer

Adjust the control's threshold or criteria. Option B is correct because adjusting thresholds or criteria reduces false positives while maintaining detection capability. Option A is not feasible as transforming the control type is a design change. Option C may increase false positives. Option D does not improve efficiency.

Answer

Accept the false positives as operational tolerance

Answer

Increase the monitoring frequency

Answer

Convert the control to a preventive control

Question 12

Refer to the exhibit. What does this log entry indicate about the monitoring process?

Accepted Answer

The monitoring process includes appropriate categorization and response.. Option C is correct. The log shows automated detection, blocking, escalation to SOC, and analyst review, indicating a well-defined process. Option A is not complete because blocking alone does not confirm process effectiveness. Option B is not supported because one false positive does not indicate a high rate. Option D is wrong because manual validation occurred.

Answer

The monitoring process lacks manual validation.

Answer

The monitoring process has a high false positive rate.

Answer

The monitoring process is effective because the alert was automatically blocked.

Question 13

Refer to the exhibit. If the control objective is to prevent unauthorized access via MFA, what does this test result indicate?

Accepted Answer

The control is effective for the sample but may not be for the population.. Option B is correct because the test result is based on a sample of 30 logins, so it indicates effectiveness for that sample but cannot guarantee effectiveness for the entire population. Option A is wrong because a single sample cannot prove full effectiveness. Option C is wrong because the sample size may be adequate statistically, but the result is limited. Option D is wrong because the test does not assess the design requirement for all users; it tests operation.

Answer

The control is ineffective because only 30 logins were sampled.

Answer

The control is fully effective.

Answer

The control is effective only if MFA is required for all users.

Question 14

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

Accepted Answer

Deploy an automated monitoring tool that ingests audit logs from the CRM and cloud infrastructure APIs to trigger alerts on anomalies.. Option C is correct because an automated monitoring framework that integrates with the CRM's audit logs and cloud provider's API enables continuous, real-time monitoring across layers. Option A is wrong because manual periodic reviews cannot provide continuous monitoring. Option B is wrong because relying solely on the vendor's SOC report is insufficient for real-time monitoring. Option D is wrong because a generic framework without customization may miss application-specific risks.

Answer

Implement a generic Security Information and Event Management (SIEM) system with standard rules.

Answer

Rely on the CRM vendor's SOC 2 Type II report for control assurance.

Answer

Schedule quarterly manual reviews of user access logs and system configurations.

Question 15

Which TWO of the following factors should be considered when determining the frequency of control monitoring?

Accepted Answer

The criticality of the control to risk mitigation.. Option A and C are correct because risk level and control criticality drive frequency. Option B is wrong because monitoring frequency should align with risk, not necessarily cost savings. Option D is wrong because it's about control, not IT projects. Option E is wrong because auditor recommendations are secondary.

Answer

The cost of monitoring relative to control cost.

Answer

The number of IT projects in progress.

Answer

The preferences of the external auditor.

CRISC Practice Test 21 — 15 Questions

Exhibit

CRISC Practice Test 21 — 15 Questions

Exhibit