CRISC Risk and Control Monitoring and Reporting Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. The SIEM alert triggered, but the security team did not respond because they were investigating another incident. What is the BEST way to prevent such monitoring gaps in the future?

Accepted Answer

Configure automatic escalation to a secondary response team if the alert is not acknowledged within a set time.. Option D is correct because it directly addresses the monitoring gap caused by analyst unavailability. By configuring automatic escalation to a secondary response team if an alert is not acknowledged within a set time, the organization ensures that no alert is left unattended even when the primary team is occupied. This is a standard operational resilience control in SIEM workflows, often implemented via playbook automation or SOAR integration.

Answer

Implement a ticketing system to track alert handling.

Answer

Hire additional security analysts to handle peak loads.

Answer

Increase the threshold to reduce false positives.

Question 2

Refer to the exhibit. The control test failed because unauthorized access attempts were detected. The remediation plan suggests additional logging. Is this remediation appropriate?

Accepted Answer

No, the remediation should focus on strengthening access controls.. Option D is correct because the control test failure was due to unauthorized access attempts, which indicates a weakness in preventive controls. Adding logging (a detective control) does not address the root cause; the remediation should focus on strengthening access controls (e.g., tightening authentication, authorization, or firewall rules) to prevent unauthorized access in the first place. Logging alone would only record future incidents without reducing their likelihood.

Answer

No, the control test methodology is flawed.

Answer

Yes, because the control is detective in nature.

Answer

Yes, additional logging will help detect future attempts.

Question 3

Refer to the exhibit. What action should the risk practitioner recommend FIRST?

Accepted Answer

Initiate a patch management process to apply critical patches.. The exhibit shows that critical vulnerabilities have been identified with a high risk score, and the current patch management process is not addressing them in a timely manner. The risk practitioner should first initiate a patch management process to apply critical patches, as this directly reduces the exposure to known exploits and aligns with the principle of treating the highest risks immediately. Delaying action or adjusting thresholds without remediation would leave the organization vulnerable.

Answer

Escalate to the board of directors.

Answer

Adjust the threshold to 10%.

Answer

Schedule a root cause analysis for next month.

Question 4

A multinational financial services company has implemented a continuous monitoring program for its trading systems. The program uses automated scripts to check system configurations against a baseline every hour. Recently, the company experienced a significant security incident where a malicious actor exploited a misconfigured firewall rule to exfiltrate sensitive customer data. Post-incident analysis revealed that the misconfiguration had been present for 72 hours before detection. The monitoring scripts did not detect the change because the baseline had been updated two weeks prior to include the misconfiguration as part of a planned change that was later reversed without updating the baseline. The company's change management process requires that all configuration changes be approved and documented, but the reversal of the change was not documented. The incident response team was only alerted when a customer reported suspicious activity. The risk practitioner is tasked with recommending improvements to prevent recurrence. Which of the following is the BEST course of action?

Accepted Answer

Implement a change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates.. Option B is correct because the root cause is that the baseline was updated to include the misconfiguration, and the subsequent reversal was not documented or reflected in the baseline. A change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates, directly addresses this by ensuring that only approved changes are in the baseline and any unapproved deviation (including reversals) triggers an alert. This prevents the monitoring system from accepting unauthorized changes as normal.

Answer

Enhance incident response procedures to include notification of customers within 24 hours.

Answer

Increase the frequency of monitoring scripts to every 30 minutes.

Answer

Require manual review of all configuration changes by a second analyst.

Question 5

A retail company has a risk monitoring program that tracks key risk indicators (KRIs) for its e-commerce platform. One KRI measures the number of failed payment transactions as a percentage of total transactions. The threshold is set at 2%. Over the past quarter, the KRI has been fluctuating between 1.8% and 2.5%, breaching the threshold several times. Each time the KRI exceeded the threshold, the risk owner performed a manual investigation and found that the failures were due to transient network issues that resolved on their own. The risk owner has now requested that the threshold be raised to 3% to avoid unnecessary investigations. The risk practitioner is evaluating this request. What should the risk practitioner do?

Accepted Answer

Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change.. Option C is correct because the recurring network issues causing threshold breaches indicate an underlying problem that needs to be addressed, not just a threshold adjustment. Raising the threshold without understanding the root cause could mask a significant risk to transaction integrity and revenue. A root cause analysis (RCA) would identify whether the transient network issues stem from infrastructure, configuration, or external dependencies, enabling a proper control response.

Answer

Approve the threshold increase since investigations have not found any significant issues.

Answer

Suggest implementing automated remediation for network issues instead of raising the threshold.

Answer

Reject the request and require investigation of every breach.

Question 6

An organization has implemented a new key risk indicator (KRI) for vendor management that measures the percentage of vendors without a signed contract. The current value is 15%, exceeding the risk appetite threshold of 10%. The risk owner wants to know the most appropriate action to take based on this KRI. What should the risk practitioner recommend?

Accepted Answer

Analyze the root cause of the high percentage and develop a remediation plan.. Option D is correct because when a KRI exceeds the risk appetite threshold, the immediate priority is to understand why the breach occurred and to implement corrective actions. Analyzing the root cause and developing a remediation plan directly addresses the underlying issue—vendors without signed contracts—rather than merely monitoring or adjusting thresholds. This aligns with the CRISC principle that KRIs are leading indicators that should trigger risk response, not just reporting changes.

Answer

Increase the frequency of KRI reporting from monthly to weekly to monitor the trend.

Answer

Update the risk appetite threshold to 15% to align with the current value.

Answer

Immediately communicate the KRI breach to the board of directors.

Question 7

Based on the exhibit, which control is most critical to address first to reduce the risk of unauthorized access?

Accepted Answer

Segregation of duties conflict resolution timeliness.. Option A is correct because segregation of duties (SoD) conflict resolution timeliness directly addresses the risk that unresolved conflicts could allow a single user to execute unauthorized actions across multiple systems. If SoD conflicts are not resolved promptly, a user might retain incompatible roles (e.g., both creating and approving purchase orders), enabling fraud or unauthorized access without detection. This control is foundational because it prevents the accumulation of excessive privileges that bypass other access controls.

Answer

Privileged access review frequency.

Answer

User access recertification completion rate.

Answer

Terminated employee account disabling timeliness.

Question 8

A company has implemented a key risk indicator (KRI) for system availability, with a threshold of 99.5%. The monitoring team observes that availability has dropped to 99.2% for two consecutive months. What is the most appropriate next step?

Accepted Answer

Notify the risk owner and initiate a root cause analysis.. Option C is correct because a sustained breach of a KRI threshold (99.2% vs. 99.5%) for two consecutive months indicates a systemic issue that requires formal risk management action. The risk owner must be notified to assess the impact, and a root cause analysis (RCA) should be initiated to identify underlying failures—such as network congestion, hardware faults, or software bugs—before any remediation is planned.

Answer

Implement additional redundancy to improve availability.

Answer

Increase the threshold to 99.0% to avoid false alarms.

Answer

Escalate immediately to the board of directors.

Question 9

During a control monitoring review, the auditor finds that a control designed to detect unauthorized access has not triggered any alerts in six months. What should the risk practitioner do first?

Accepted Answer

Test the control to ensure it is functioning correctly.. The absence of alerts does not automatically confirm that the control is working; it could indicate that the control has failed silently or that the detection logic is misconfigured. The risk practitioner must first test the control (e.g., by simulating an unauthorized access attempt) to verify that it can actually detect and alert on violations. Only after confirming correct functionality can the lack of alerts be interpreted as evidence of effectiveness.

Answer

Document the lack of alerts as evidence of effectiveness.

Answer

Redesign the control with different parameters.

Answer

Increase the frequency of monitoring.

Question 10

A financial institution is implementing a new risk monitoring tool that aggregates data from multiple sources. The tool is expected to provide real-time dashboards for risk committees. However, during user acceptance testing, the dashboards show inconsistent data due to time zone differences across sources. What is the best approach to resolve this?

Accepted Answer

Standardize all timestamps to Coordinated Universal Time (UTC) during data ingestion.. Option C is correct because standardizing all timestamps to Coordinated Universal Time (UTC) during data ingestion ensures a single, unambiguous reference point for all aggregated data. This eliminates the root cause of inconsistency—differing local time zones—at the point of data entry, allowing the real-time dashboards to display consistent, comparable metrics regardless of the source's geographic location. This approach aligns with the principle of normalizing data at the earliest stage of the data pipeline, which is a fundamental practice in risk monitoring and reporting.

Answer

Modify the dashboard to display each source's local time separately.

Answer

Ask each source to adjust their time zone to the corporate headquarters time zone.

Answer

Use the time zone of the majority of sources and convert others.

Question 11

A risk practitioner is reviewing the monitoring reports for a critical business process. The report shows that a key control has a 95% effectiveness rate, but the risk appetite for the associated risk is 98%. What should the practitioner do?

Accepted Answer

Recommend enhancements to the control to improve effectiveness.. Option C is correct because the control effectiveness (95%) is below the risk appetite threshold (98%), meaning the residual risk exceeds the acceptable level. The practitioner should recommend enhancements to close this gap, as accepting the current state would violate risk appetite. This aligns with the principle that controls must be improved when monitoring shows performance below the defined tolerance.

Answer

Accept the current effectiveness as it is close to the target.

Answer

Immediately escalate to senior management.

Answer

Reduce the risk appetite to 95%.

Question 12

Which of the following is the primary purpose of a risk and control monitoring program?

Accepted Answer

To provide ongoing assurance that controls are operating effectively.. The primary purpose of a risk and control monitoring program is to provide ongoing assurance that controls are operating effectively. This is achieved through continuous or periodic testing, observation, and analysis of control activities to confirm they are designed correctly and functioning as intended to mitigate risks. Without this ongoing assurance, an organization cannot reliably know whether its risk responses remain effective over time.

Answer

To identify new risks as they emerge.

Answer

To reduce the frequency of internal audits.

Answer

To calculate key risk indicators.

Question 13

A company has a control that automatically rejects transactions over $10,000. During a review, it is found that 2% of transactions over $10,000 were approved due to a system glitch. The control owner says the glitch has been fixed. What should the risk practitioner do next?

Accepted Answer

Request evidence of the fix and perform a sample test of recent transactions.. Option B is correct because the risk practitioner must independently verify that the system glitch has been resolved before closing the finding. Requesting evidence of the fix (e.g., change logs, patch notes) and performing a sample test of recent transactions provides objective assurance that the control is now operating effectively. This aligns with the CRISC principle that control owner assurances alone are insufficient without validation, especially for automated controls where residual risk from the glitch could persist.

Answer

Accept the control owner's assurance and close the finding.

Answer

Recommend a compensating control until the fix is confirmed.

Answer

Report the issue to the audit committee.

Question 14

A risk practitioner is designing a monitoring dashboard for operational risk. Which of the following is the most important consideration?

Accepted Answer

Tailor the information to the needs of the target audience.. Option C is correct because the primary goal of a monitoring dashboard is to enable effective decision-making. Tailoring information to the target audience ensures that stakeholders receive relevant, actionable data, reducing cognitive load and preventing alert fatigue. Without this alignment, even the most technically sophisticated dashboard fails its core purpose of supporting risk-informed decisions.

Answer

Automate the generation of reports.

Answer

Use real-time data feeds.

Answer

Include all available risk indicators.

Question 15

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

Accepted Answer

There may be a brute-force attack in progress.. A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Answer

The system is experiencing a denial-of-service attack.

Answer

The password policy needs to be updated.

Answer

Users have forgotten their passwords.

CRISC Risk and Control Monitoring and Reporting Practice Test 2 — 15 Questions

Exhibit

CRISC Risk and Control Monitoring and Reporting Practice Test 2 — 15 Questions

Exhibit