CRISC Risk and Control Monitoring and Reporting Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. This JSON snippet defines a monitoring policy for S3 bucket access. Which of the following is a potential risk that might NOT be detected by this monitoring policy?

Accepted Answer

Unauthorized DELETE operations from any IP.. Option C is correct. The policy only covers PutObject and GetObject actions. DeleteObject is not monitored, so unauthorized DELETE operations would go undetected. Option A is not a risk because the policy denies PUT from the trusted IP range? Actually it denies PUT from trusted IP? Wait: the policy denies PutObject from the trusted IP range, but that might be intended. However, PUT from outside trusted range is not covered? The policy only has a rule for trusted IP; outside IPs are not addressed? But the question asks for potential risk not detected. Option C is clearest: DELETE operations are completely unmonitored. Option B is not a risk because GET is allowed from trusted IP (may be intentional). Option D is not a risk because PUT from trusted IP is denied (if that matches intent). So C is correct.

Answer

Unauthorized GET operations from within the trusted IP range.

Answer

Unauthorized PUT operations from within the trusted IP range.

Answer

Unauthorized PUT operations from outside the trusted IP range.

Question 2

A company's control monitoring dashboard shows that a key control has been operating effectively for six months. However, a recent audit revealed a material weakness. Which of the following is the MOST likely reason?

Accepted Answer

The KRI thresholds were set incorrectly.. Option C is correct because if KRI thresholds are set too high, the monitoring system may not trigger alerts even when the control is failing, giving a false sense of effectiveness. Option A is wrong because the control was likely tested during the period. Option B is wrong because frequency is not the primary issue if thresholds are misaligned. Option D is wrong because training affects operation, not monitoring thresholds.

Answer

The control was not tested during the period.

Answer

The monitoring frequency was too low.

Answer

The control owner was not trained.

Question 3

An organization is designing a risk and control monitoring program for a new cloud-based application. Which of the following is the MOST important factor to consider when selecting Key Risk Indicators (KRIs)?

Accepted Answer

Alignment with strategic objectives.. Option A is correct because KRIs must be aligned with risk appetite and business objectives to ensure they measure what matters. Option B is wrong because ease of collection is secondary to relevance. Option C is wrong because historical data may not exist for new applications. Option D is wrong because industry best practices are guidelines, not a primary factor.

Answer

Historical loss data availability.

Answer

Ease of automated data collection.

Answer

Industry best practices.

Question 4

A company's internal audit function reports that a detective control (manual review of transactions) is operating effectively based on a sample of 50 transactions showing no issues. However, the continuous monitoring system shows that 100 suspicious transactions were not reviewed during the same period. The control owner argues the control is effective. What is the BEST conclusion?

Accepted Answer

The control is ineffective because the audit sample size is too small to detect the actual failure rate.. Option D is correct because the audit sample of 50 did not include the suspicious transactions that the continuous monitoring flagged, indicating the sample size was insufficient to detect the actual failure rate. Option A is wrong because the sample alone does not prove effectiveness across all transactions. Option B is wrong because the monitoring system is likely reliable. Option C is wrong because the monitoring system is not necessarily too sensitive; it revealed actual failures.

Answer

The control is effective because the monitoring system is too sensitive.

Answer

The control is ineffective because the monitoring system is unreliable.

Answer

The control is effective because the sample showed no issues.

Question 5

A risk owner wants to implement continuous monitoring for a set of critical controls. Which of the following is the PRIMARY benefit of continuous monitoring over periodic testing?

Accepted Answer

Timely detection of control failures.. Option B is correct because continuous monitoring provides real-time or near-real-time detection of control failures, allowing faster response. Option A is wrong because continuous monitoring can be more expensive. Option C is wrong because manual testing may still be needed for some controls. Option D is wrong while compliance is a benefit, timely detection is the primary advantage.

Answer

Elimination of manual testing.

Answer

Compliance with regulatory requirements.

Answer

Reduced cost of control testing.

Question 6

After a security incident, a company implements a new control and begins monitoring its effectiveness. Which of the following metrics would BEST indicate that the control is achieving its objective?

Accepted Answer

Decrease in the number of successful attacks.. Option D is correct because the control's objective is to prevent or mitigate incidents, so a decrease in successful attacks directly measures success. Option A is wrong because incident reports include both successful and attempted. Option B is wrong because time to detect is a response metric, not control effectiveness. Option C is wrong because vulnerability count is a separate risk factor.

Answer

Reduction in the number of vulnerabilities.

Answer

Number of incidents reported.

Answer

Time to detect incidents.

Question 7

A bank's risk committee reviews a monthly risk report that includes KRIs. One KRI shows that the number of failed transactions due to system errors is trending upward. The control owner states that the trend is within the risk appetite. However, the report also shows that the number of customer complaints is stable. What should the risk manager do FIRST?

Accepted Answer

Investigate the root cause of the increasing failed transactions.. Option B is correct because an upward trend in a KRI, even if within appetite, warrants investigation to understand the root cause and prevent escalation. Option A is wrong because accepting without investigation misses potential emerging issues. Option C is wrong because increasing frequency is premature without understanding why. Option D is wrong because escalation is not needed before investigation.

Answer

Escalate to the board of directors.

Answer

Accept the control owner's assessment and continue monitoring.

Answer

Recommend increasing the monitoring frequency.

Question 8

A company is evaluating its control monitoring program. Which TWO of the following are key elements of an effective control monitoring framework? (Choose two.)

Accepted Answer

Periodic review of KRI thresholds.. Options A and C are correct. Clearly defined roles and responsibilities ensure accountability, and periodic review of KRI thresholds ensures the monitoring remains relevant. Option B is wrong because not all failures need automated alerts; some may be manual. Option D is wrong because integration with performance management is not a core element. Option E is wrong because statistical sampling is just one method and not always appropriate.

Answer

Integration with performance management.

Answer

Use of statistical sampling for all tests.

Answer

Automated alerts for all control failures.

Question 9

An organization uses a risk and control monitoring system that generates weekly reports. The reports show a key control as 'effective' for the past three months. However, during a recent audit, a significant control failure was discovered. Which TWO of the following are MOST likely root causes for this discrepancy? (Choose two.)

Accepted Answer

The control test sample was not representative.. Options B and D are correct. KRI thresholds set too high would prevent alerts even when failures occur, and a non-representative test sample would miss failures in the rest of the population. Option A is possible but less likely if the system reported objectively. Option C is possible but three months of effective reporting suggests frequency might not be the issue. Option E could be a cause but is less specific than B and D.

Answer

The reporting system had a data integrity issue.

Answer

The control owner was not reporting accurately.

Answer

The monitoring frequency was too low.

Question 10

A risk manager is designing monthly risk reports for senior management. Which THREE of the following should be included in an effective risk report? (Choose three.)

Accepted Answer

Changes in the risk landscape.. Options A, C, and D are correct. KRIs and trends provide a high-level view, status of risk treatment plans shows progress, and changes in the risk landscape highlight emerging risks. Option B is wrong because detailed test results are too granular for senior management. Option E is wrong because naming individuals is inappropriate and not constructive.

Answer

Names of individual employees responsible for control failures.

Answer

Detailed control test results for every control.

Question 11

Refer to the exhibit. If the control objective is to prevent unauthorized access via MFA, what does this test result indicate?

Accepted Answer

The control is effective for the sample but may not be for the population.. Option B is correct because the test result is based on a sample of 30 logins, so it indicates effectiveness for that sample but cannot guarantee effectiveness for the entire population. Option A is wrong because a single sample cannot prove full effectiveness. Option C is wrong because the sample size may be adequate statistically, but the result is limited. Option D is wrong because the test does not assess the design requirement for all users; it tests operation.

Answer

The control is ineffective because only 30 logins were sampled.

Answer

The control is fully effective.

Answer

The control is effective only if MFA is required for all users.

Question 12

Refer to the exhibit. Based on the exhibit, what is the most appropriate action regarding the control OWF?

Accepted Answer

The control should be reviewed because the alert frequency is approaching the threshold.. Option C is correct because the alert frequency is approaching the threshold (4 alerts in the past hour), which indicates a potential issue that should be reviewed before it escalates. Option A is wrong because while the block was successful, the increasing trend is concerning. Option B is wrong because the control blocked the traffic, so it is effective in blocking, but the frequency warrants investigation. Option D is wrong because being below threshold does not mean no action is needed; proactive review is better.

Answer

The control is effective because the traffic was blocked.

Answer

The control is ineffective because alerts indicate potential malware.

Answer

No action is needed because the threshold has not been reached.

Question 13

Refer to the exhibit. What does the exhibit most likely indicate about the control monitoring?

Accepted Answer

The control is effective but the monitoring configuration is incorrect.. Option D is correct because the target is set to 90% while the policy requires 95%, so the monitoring configuration is incorrect. The control appears to meet the target (94.5% > 90%), but it fails to meet the policy requirement. Option A is wrong because the control meets the configured target but not the policy. Option B is wrong because the current value is above the configured target. Option C is wrong because the control is not failing relative to the target; it is a configuration issue.

Answer

The control is failing and needs immediate remediation.

Answer

The control is close to target but requires attention.

Answer

The control is meeting its target.

Question 14

A retail company monitors its key risk indicator (KRI) for credit card transaction fraud. The KRI has exceeded the established threshold for three consecutive days, but the weekly control performance report shows all fraud detection controls operating effectively. What should the risk practitioner do FIRST?

Accepted Answer

Investigate the data source of the KRI to ensure accuracy and timeliness.. Option A is correct because the discrepancy between the KRI and control performance indicates a potential data integrity issue or misalignment; verifying the KRI data source is the first step. Option B is wrong because adjusting the threshold without investigation could mask a real risk. Option C is wrong because enhancing controls before understanding the root cause may be premature. Option D is wrong because ignoring the KRI violates monitoring principles.

Answer

Immediately enhance the fraud detection controls.

Answer

Report the KRI breach to the board and recommend risk acceptance.

Answer

Adjust the KRI threshold to align with current control performance.

Question 15

A manufacturing company's board of directors receives a monthly risk report. Which key performance indicator (KPI) is MOST relevant for the board to assess the effectiveness of internal controls?

Accepted Answer

Percentage of control tests passed within the reporting period.. Option B is correct because the percentage of control tests passed directly indicates control effectiveness, which is a core board concern. Option A is wrong because the number of risk assessments conducted is an activity metric, not an effectiveness measure. Option C is wrong because the number of audit findings is an output, not a proactive control measure. Option D is wrong because the percentage of employees trained is a compliance metric, not a control effectiveness measure.

Answer

Number of audit findings per business unit.

Answer

Number of risk assessments completed this month.

Answer

Percentage of employees completing annual compliance training.

CRISC Risk and Control Monitoring and Reporting Practice Test 7 — 15 Questions

Exhibit

CRISC Risk and Control Monitoring and Reporting Practice Test 7 — 15 Questions

Exhibit