CRISC Risk and Control Monitoring and Reporting Practice Test 5 — 15 Questions

Question 1

The exhibit shows a control monitoring configuration in JSON format. Which of the following is the MOST critical gap in this monitoring setup?

Accepted Answer

There is no action defined for when the threshold is first breached. Option D is correct because the configuration lacks a defined breach action for the initial alert (when threshold is first exceeded), only escalation actions. Option A is wrong because the test date is recent. Option B is wrong because the frequency is daily. Option C is wrong because the data source is specified.

Answer

The control was last tested over a month ago

Answer

The data source 'transaction_log' is not specific enough

Answer

The monitoring frequency is set to daily, which may miss real-time breaches

Question 2

A security control failed to prevent unauthorized access to a sensitive database. The risk owner has been notified. What should the risk practitioner do NEXT?

Accepted Answer

Recalculate the residual risk level and update the risk register. The correct answer is B. After a control failure, the risk practitioner should first assess the impact on the risk level by recalculating residual risk, then update the risk register. A is wrong because immediate patching may introduce new vulnerabilities without analysis. C is wrong because escalation to senior management is premature before impact assessment. D is wrong because control testing is done after risk assessment.

Answer

Escalate the issue to the board of directors

Answer

Apply a patch to the database system immediately

Answer

Perform a root cause analysis on the control failure

Question 3

A company's key risk indicator (KRI) for 'failed login attempts' has exceeded its threshold by 20%. The control owner reports that a recent firewall change caused false positives. What should the risk practitioner do FIRST?

Accepted Answer

Validate the KRI data and investigate the root cause. The correct answer is C. The first step is to verify the KRI data and confirm whether the threshold breach is real or due to a configuration issue. Option A is premature because the threshold breach may be invalid. Option B is corrective action without confirmation. Option D is too drastic without understanding the root cause.

Answer

Implement additional controls to reduce failed logins

Answer

Revert the firewall change immediately

Answer

Increase the KRI threshold to eliminate false positives

Question 4

During a control self-assessment, an operational manager reports that a manual review control is performed quarterly instead of monthly as documented. What should the risk practitioner do?

Accepted Answer

Update the control frequency in the risk register and assess residual risk. The correct answer is D. The practitioner should update the control documentation to reflect the actual frequency and assess if the quarterly review still provides adequate risk mitigation. Options A and B are punitive and not collaborative. Option C assumes risk level unchanged without analysis.

Answer

Accept the change without documentation since risk level is unchanged

Answer

Escalate the deviation to senior management for disciplinary action

Answer

Require the manager to resume monthly reviews immediately

Question 5

A risk practitioner notices that a key control is tested only once a year, but the associated risk has a high velocity of change. What is the BEST recommendation?

Accepted Answer

Increase testing frequency to quarterly or monthly. The correct answer is B. For high velocity risks, more frequent monitoring is needed. Option A does not address velocity. Option C is reactive. Option D negates the control.

Answer

Remove the control if it cannot be tested more often

Answer

Wait for a control failure before increasing frequency

Answer

Continue annual testing because it meets regulatory requirements

Question 6

A board member asks for a summary of the top five risks. The risk practitioner has 10 risks with current residual risk levels. Which approach BEST supports board-level reporting?

Accepted Answer

Present the top five by residual risk level, including a trend indicator. The correct answer is A. Reporting should include both current status and trend to inform decision-making. Option B is too granular. Option C omits risk level. Option D is incomplete without trend.

Answer

Only highlight risks that have increased since last quarter

Answer

List risks alphabetically with current control status

Answer

Provide a detailed risk register with all 10 risks and full risk analysis

Question 7

A control test reveals a 100% pass rate for a detective control. What does this indicate?

Accepted Answer

The control is operating effectively. The correct answer is B. A 100% pass rate for a detective control suggests the control is effective at detecting issues, but it does not guarantee that no issues existed (since detection only happens if an issue occurs). Option A is irrelevant; options C and D are possible but not indicated by the pass rate alone.

Answer

The control is too expensive to maintain

Answer

The control is compensating for other weaknesses

Answer

The associated risk has been fully mitigated

Question 8

An incident occurs due to a control that was thought to be automated but was actually manual. The risk register did not reflect this. What is the MOST likely root cause?

Accepted Answer

Insufficient control monitoring and verification. The correct answer is D. The discrepancy between documentation and reality indicates a failure in control monitoring. Option A is too narrow; option B is unrelated; option C is possible but less direct.

Answer

Inadequate risk assessment methodology

Answer

Poorly designed controls

Answer

Lack of management support for risk management

Question 9

A risk practitioner is asked to reduce the number of KRIs tracked from 50 to 20. Which KRIs should be prioritized for removal?

Accepted Answer

KRIs that are not directly mapped to any risk in the risk register. The correct answer is B. KRIs that do not directly link to a risk in the risk register are likely not providing actionable information. Options A, C, and D describe KRIs that are useful for monitoring.

Answer

KRIs that have been consistently below threshold for two years

Answer

KRIs that require manual data collection

Answer

KRIs that have high volatility

Question 10

An external audit finds that a control is not operating as designed. The auditor recommends corrective action. What should the risk practitioner do FIRST?

Accepted Answer

Assess the impact of the control deficiency on residual risk. The correct answer is A. The risk practitioner should first assess the impact of the control deficiency on the risk level. Options B and C are actions that follow the assessment. Option D is reactive and may be part of remediation but not first.

Answer

Implement the auditor's recommendation immediately

Answer

Develop a remediation plan with the control owner

Answer

Update the risk register with the auditor's finding

Question 11

Which TWO of the following are appropriate criteria for selecting key risk indicators (KRIs)?

Accepted Answer

Indicators that are quantifiable and reliable. Option A is correct because key risk indicators (KRIs) must be quantifiable and reliable to provide objective, measurable data that can be consistently tracked over time. Quantifiable indicators allow for trend analysis and threshold setting, while reliability ensures the data source is accurate and repeatable, which is essential for effective risk monitoring in IT environments such as network security or system availability.

Answer

Indicators that only cover financial risks

Answer

Indicators that measure historical losses

Answer

Indicators that are easy to collect regardless of relevance

Question 12

Which THREE of the following control monitoring techniques are considered continuous monitoring?

Accepted Answer

Automated logging and alerting from SIEM tools. The correct options are A, C, and E. Continuous monitoring involves automated, ongoing techniques. Internal control self-assessments (B) are periodic, not continuous. Penetration testing (D) is periodic/ad hoc.

Answer

Quarterly internal control self-assessments

Answer

Annual penetration testing

Question 13

Which TWO of the following are key attributes of effective risk reporting?

Accepted Answer

Provides actionable information for decision-makers. The correct options are B and D. Risk reporting should be tailored to the audience (B) and actionable (D). A is incorrect because reporting should be regular, not only on incident. C is too generic; E is about distribution, not content.

Answer

Includes full risk register details

Answer

Only issued when a risk incident occurs

Answer

Sent to all employees by email

Question 14

An S3 bucket policy is configured as shown. During a monitoring review, the risk practitioner notices that the 'DenyAll' policy is never evaluated because of an explicit allow? What is the MOST likely monitoring gap?

Accepted Answer

No automated test validates that the DenyAll policy is effective. The correct answer is C. The DenyAll policy is overridden by the AllowRead policy because evaluation logic gives precedence to explicit deny over allow only if the deny is evaluated; but here the allow is explicit and matches, so the deny is not evaluated? Actually AWS evaluates explicit allow and explicit deny; an explicit deny always overrides allows. However, the exhibit shows two statements; the DenyAll would deny all actions, but the AllowRead allows GetObject. In AWS, explicit deny overrides allow, so the DenyAll should block GetObject unless the condition? But the condition on AllowRead is 10.0.0.0/8. A request from 10.x.x.x would match AllowRead but then DenyAll would also match and deny. The key monitoring gap is that there is no mechanism to check if DenyAll is properly evaluated; the risk practitioner likely missed that the condition on AllowRead makes it only effective for a specific IP range, and the DenyAll might unintentionally block legitimate access. But the question says 'never evaluated' which indicates a logic error: In AWS, explicit deny always overrides, so the DenyAll should be evaluated. However, the statement says 'because of an explicit allow' which is false; the proper gap is that the policy lacks monitoring to detect unintended deny effects. The intended correct answer is that the monitoring did not include policy validation tests. Option A is about KRI, not policy validation. Option B is about access review, not policy. Option D is about encryption, unrelated. So answer C.

Answer

No KRI is defined for unauthorized access attempts

Answer

Server-side encryption is not enabled for the bucket

Answer

User access reviews are not performed quarterly

Question 15

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Accepted Answer

A service account is authenticating with a password rather than a certificate. The correct answer is B. The most significant issue is that a service account used for backup is authenticating with a password instead of a certificate or key, which is a security weakness. Option A is true but less significant than the authentication method. Option C is not indicated (no excessive privileges). Option D is about logging, which is present.

Answer

The service account has excessive database privileges

Answer

The failed login events were not logged in real time

Answer

Failed logins indicate a possible brute force attack

CRISC Risk and Control Monitoring and Reporting Practice Test 5 — 15 Questions

Exhibit

CRISC Risk and Control Monitoring and Reporting Practice Test 5 — 15 Questions

Exhibit