CRISC Risk and Control Monitoring and Reporting Practice Test 6 — 15 Questions

Question 1

A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?

Accepted Answer

Account lockout policy is not enforced. The correct answer is D. The pattern suggests a brute force attack that succeeded because the account lockout threshold was not configured (or too high). Option A is possible but less direct; B is about failed attempts detection, but the control failure is the lack of lockout. C is about password complexity, not the cause of multiple attempts.

Answer

No multi-factor authentication

Answer

Insufficient failed login monitoring

Answer

Weak password policy

Question 2

A financial institution monitors the number of unauthorized access attempts to its core banking system. The risk owner recommends increasing the monitoring frequency from daily to hourly because a recent attack exploited a delayed detection. Which of the following is the PRIMARY benefit of this change?

Accepted Answer

Faster detection of anomalies. Option C is correct because faster detection reduces the window of exposure. Option A is wrong because frequency increase may increase false positives. Option B is wrong because it may degrade system performance. Option D is wrong because increasing frequency typically increases cost.

Answer

Lower cost of monitoring

Answer

Increased system performance

Answer

Reduced false positive rate

Question 3

A large e-commerce company uses several key risk indicators (KRIs) to monitor credit card fraud. The risk committee noticed that one KRI has been trending above the threshold for three consecutive months, yet no risk response was initiated. Which of the following is the MOST likely root cause?

Accepted Answer

The risk response workflow was not triggered automatically. Option A is correct because if the risk response workflow was not triggered automatically, the breach may not have been escalated. Option B is wrong because KRI validation addresses accuracy, not action. Option C is wrong if threshold too lenient it would not be breached. Option D is wrong because a monitoring tool failure would likely show no data or alerts.

Answer

The KRI was not validated for accuracy

Answer

The KRI threshold was set too lenient

Answer

The monitoring tool failed to capture data

Question 4

A company's risk management team is evaluating the effectiveness of its control monitoring program. They find that many controls are tested at the same time each year, leading to a resource bottleneck. Which of the following approaches would BEST address this issue?

Accepted Answer

Stagger testing cycles across the year. Option D is correct because staggering testing cycles spreads workload throughout the year. Option A reduces coverage, potentially increasing risk. Option B is a good practice but implementing continuous monitoring may be costly and does not directly address the existing bottleneck. Option C is a temporary fix and does not address the root cause of scheduling.

Answer

Increase the testing team size

Answer

Implement continuous monitoring automation

Answer

Reduce the number of controls tested

Question 5

A risk analyst is reviewing control monitoring results and notices that a detective control has a high false positive rate. What is the BEST action to improve the control's efficiency?

Accepted Answer

Adjust the control's threshold or criteria. Option B is correct because adjusting thresholds or criteria reduces false positives while maintaining detection capability. Option A is not feasible as transforming the control type is a design change. Option C may increase false positives. Option D does not improve efficiency.

Answer

Accept the false positives as operational tolerance

Answer

Increase the monitoring frequency

Answer

Convert the control to a preventive control

Question 6

After a significant cybersecurity incident, the board requests a report on the effectiveness of the security controls that were in place. Which reporting approach would BEST demonstrate the controls' performance?

Accepted Answer

Compare control test results against defined KRIs and risk appetite. Option C is correct because comparing test results against KRIs and risk appetite shows how well controls mitigate risks. Option A is too granular and lacks context. Option B focuses on the incident rather than controls. Option D shows a metric but not control effectiveness.

Answer

List all controls and their test results

Answer

Show the number of vulnerabilities patched

Answer

Provide a summary of the incident timeline

Question 7

An organization uses a risk register that includes inherent risk, control effectiveness, and residual risk. During a quarterly review, the risk owner updates control effectiveness from 'partially effective' to 'effective'. What effect does this have on the residual risk rating?

Accepted Answer

Residual risk decreases. Option A is correct because improved control effectiveness reduces the likelihood or impact, thus lowering residual risk. Option B is opposite. Option C is incorrect because residual risk changes. Option D is wrong because inherent risk does not change based on controls.

Answer

Inherent risk changes

Answer

Residual risk increases

Answer

Residual risk remains unchanged

Question 8

A company implements a new automated control to monitor user access rights. The control sends a daily report of any users with excessive privileges. What is the PRIMARY benefit of this control?

Accepted Answer

Enables timely remediation of access violations. Option D is correct because the control enables timely identification and remediation of access violations. Option A is not necessarily true as reviews may still be needed. Option B is false because manual remediation is still required. Option C is not real-time since reports are daily.

Answer

Reduces the number of user access reviews

Answer

Eliminates the need for manual checks

Answer

Provides real-time alerts for critical changes

Question 9

During a risk assessment, a control self-assessment (CSA) indicates that a key control is operating effectively. However, an independent audit finds multiple control failures. Which of the following is the MOST likely reason for this discrepancy?

Accepted Answer

The CSA participants lacked objectivity. Option B is correct because CSA participants may lack objectivity due to bias or lack of independence. Option A is less likely if the CSA is recent. Option C is possible but not the most likely cause of systematic discrepancy. Option D is possible but not specific to CSA vs audit.

Answer

The audit tested different samples

Answer

The control environment changed

Answer

The CSA was conducted too recently

Question 10

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

Accepted Answer

Investigate the KRI calculation methodology. Option C is correct because the discrepancy suggests the KRI calculation may be flawed. Option A jumps to adjusting thresholds without understanding the root cause. Option B may be premature if the control testing is accurate. Option D escalates without first analyzing the issue.

Answer

Escalate to the risk committee

Answer

Change the KRI threshold to amber

Answer

Re-test the control

Question 11

A company is designing its risk and control monitoring program. Which TWO of the following are key attributes of effective monitoring?

Accepted Answer

Monitoring results should be communicated to stakeholders.. Options A and C are correct. A: Monitoring frequency should be risk-based (critical controls more frequent). C: Results must be communicated to stakeholders to drive action. B is wrong because not all controls need same frequency. D is wrong because internal teams can monitor. E is wrong because monitoring can be performed by control owners if properly designed.

Answer

All controls should be monitored at the same frequency.

Answer

Monitoring should only be performed by external auditors.

Answer

Monitoring should be independent of the control owner.

Question 12

A risk analyst is reviewing the results of control testing for a critical business process. Which THREE of the following are valid reasons to classify a control as ineffective?

Accepted Answer

The control was not executed as per procedure.. Options B, C, and D are correct. B: Failure under peak load indicates the control cannot handle real conditions. C: If the design does not address the risk, the control cannot mitigate it. D: Non-execution per procedure means the control was not performed correctly. A is wrong because a single pass does not prove ineffectiveness. E is wrong because owner availability is not a control attribute.

Answer

The control was tested once and passed.

Answer

The control owner was not available during the test.

Question 13

A multinational corporation is implementing continuous monitoring of its compliance with data privacy regulations across multiple jurisdictions. Which TWO of the following are significant challenges to this approach?

Accepted Answer

Inconsistent regulatory requirements across jurisdictions.. Options A and E are correct. A: Inconsistent regulatory requirements make it hard to define a single monitoring standard. E: Data residency and sovereignty issues complicate establishing a unified data repository. B is a generic challenge but not specific to multi-jurisdiction. C is generic. D: Continuous monitoring by definition automates data collection, so it's not a challenge.

Answer

The need for manual data collection.

Answer

High cost of automation tools.

Answer

Lack of skilled personnel.

Question 14

Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?

Accepted Answer

Investigate Wednesday and Thursday spikes as they are above the Green threshold.. Option C is correct. Wednesday (12) and Thursday (15) are in the Amber zone (10-20), indicating a need for investigation. Option A is premature because the threshold for Red (>20) was not breached. Option B ignores the amber days. Option D suggests adjusting the threshold without understanding the cause of the spikes.

Answer

Adjust the KRI threshold to 15 per day to reduce false positives.

Answer

Continue monitoring as all days are within Green or Amber.

Answer

Escalate to the risk committee because the threshold was breached.

Question 15

Refer to the exhibit. What does this log entry indicate about the monitoring process?

Accepted Answer

The monitoring process includes appropriate categorization and response.. Option C is correct. The log shows automated detection, blocking, escalation to SOC, and analyst review, indicating a well-defined process. Option A is not complete because blocking alone does not confirm process effectiveness. Option B is not supported because one false positive does not indicate a high rate. Option D is wrong because manual validation occurred.

Answer

The monitoring process lacks manual validation.

Answer

The monitoring process has a high false positive rate.

Answer

The monitoring process is effective because the alert was automatically blocked.

CRISC Risk and Control Monitoring and Reporting Practice Test 6 — 15 Questions

Exhibit

CRISC Risk and Control Monitoring and Reporting Practice Test 6 — 15 Questions

Exhibit