CRISC Risk and Control Monitoring and Reporting Practice Test 8 — 15 Questions

Question 1

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

Accepted Answer

Deploy an automated monitoring tool that ingests audit logs from the CRM and cloud infrastructure APIs to trigger alerts on anomalies.. Option C is correct because an automated monitoring framework that integrates with the CRM's audit logs and cloud provider's API enables continuous, real-time monitoring across layers. Option A is wrong because manual periodic reviews cannot provide continuous monitoring. Option B is wrong because relying solely on the vendor's SOC report is insufficient for real-time monitoring. Option D is wrong because a generic framework without customization may miss application-specific risks.

Answer

Implement a generic Security Information and Event Management (SIEM) system with standard rules.

Answer

Rely on the CRM vendor's SOC 2 Type II report for control assurance.

Answer

Schedule quarterly manual reviews of user access logs and system configurations.

Question 2

During a quarterly control review, the risk team discovers that a key manual approval control was bypassed in 15% of transactions due to a recent process change. What is the FIRST action the risk practitioner should take?

Accepted Answer

Conduct a root cause analysis to determine why the bypass occurred.. Option D is correct because understanding the root cause of the bypass is essential before deciding on corrective actions. Option A is wrong because restoring the control without analysis may not address the underlying process change. Option B is wrong because escalating without analysis may not provide sufficient context. Option C is wrong because updating the risk register is important but not the first action.

Answer

Restore the original control process immediately.

Answer

Update the risk register to reflect the increased residual risk.

Answer

Escalate to senior management with a recommendation for disciplinary action.

Question 3

A risk practitioner is designing a risk dashboard for the executive team. The organization has a high risk appetite for revenue-generating activities but a low risk appetite for regulatory compliance. Which combination of metrics should be prominently displayed?

Accepted Answer

Key risk indicators (KRIs) for revenue-related risks and regulatory compliance status.. Option A is correct because KRIs that measure current risk levels against appetite thresholds, along with regulatory compliance status, directly address the dual risk appetites. Option B is wrong because control test results and training completion are input/metrics, not direct risk measures. Option C is wrong because vendor risk ratings and incident counts are important but not specific to the stated appetites. Option D is wrong because remediation timelines and budget variance are operational metrics.

Answer

Percentage of controls tested and employee training completion rates.

Answer

Vendor risk ratings and number of security incidents.

Answer

Number of open remediation items and budget variance for risk projects.

Question 4

After a control self-assessment (CSA) workshop, business units reported that 80% of controls are operating effectively. However, internal audit's recent testing indicates a 30% control failure rate. What is the BEST explanation for this discrepancy?

Accepted Answer

CSA participants may have a biased perception of control effectiveness, while audit uses objective evidence.. Option B is correct because CSA participants often overestimate control effectiveness due to subjective assessment, while audit applies objective testing. Option A is wrong because the scope difference (all controls vs. sample) could contribute but is less likely to cause such a large gap. Option C is wrong because timeliness might explain small differences, not a 50% gap. Option D is wrong because training alone rarely causes such a large discrepancy.

Answer

The audit was conducted three months after the CSA, and controls may have degraded.

Answer

CSA participants lacked adequate training on what constitutes a control failure.

Answer

The CSA covered a different scope of controls than the audit.

Question 5

A risk practitioner discovers that a critical control deficiency has been open for six months beyond the agreed remediation date. What is the MOST appropriate reporting action?

Accepted Answer

Report the overdue deficiency to senior management for escalation.. Option C is correct because overdue remediation should be escalated to senior management to ensure attention and resource allocation. Option A is wrong because only escalating to the control owner may not drive action. Option B is wrong because adjusting the date without addressing the delay is inappropriate. Option D is wrong because updating the risk register is a secondary step.

Answer

Notify the control owner and request an updated remediation plan.

Answer

Accept the delay and extend the remediation date by six months.

Answer

Update the risk register to reflect the increased residual risk and close out the deficiency.

Question 6

An organization uses a third-party vendor for payment processing. The vendor's latest SOC 2 report shows a significant control exception in logical access. What is the BEST way to monitor the effectiveness of the compensating controls the vendor has implemented?

Accepted Answer

Obtain the vendor's remediation plan and schedule a follow-up assessment to verify the compensating controls.. Option D is correct because reviewing the vendor's remediation plan and conducting a follow-up assessment verifies the effectiveness of compensating controls. Option A is wrong because switching vendors may not be feasible immediately. Option B is wrong because a clause is contractual, not monitoring. Option C is wrong because a penalty does not ensure control effectiveness.

Answer

Accept the risk and apply a monetary penalty to the vendor.

Answer

Immediately terminate the vendor contract and switch to a new payment processor.

Answer

Request the vendor to include a clause in the contract that holds them liable for any breaches.

Question 7

A global organization is consolidating risk data from multiple business units into a single enterprise risk management (ERM) system. The risk practitioner notices that KRIs for the same risk type (e.g., cybersecurity) are calculated differently across units. What is the BEST approach to ensure consistent and reliable risk monitoring and reporting?

Accepted Answer

Establish a common definition and calculation methodology for each KRI across all business units.. Option A is correct because defining standardized KRI definitions and calculation formulas ensures consistency across units, enabling accurate consolidation. Option B is wrong because accepting unit-specific KRIs prevents meaningful aggregation. Option C is wrong because using automated data feeds does not address the definition inconsistency. Option D is wrong because a common KPI set for controls does not solve the risk metric inconsistency.

Answer

Require all units to adopt a common set of key performance indicators for their control environment.

Answer

Allow each business unit to maintain its own KRI definitions but report explanations for variances.

Answer

Implement automated data feeds from each unit's system to the ERM system without changing the KRI definitions.

Question 8

Which TWO of the following are characteristics of an EFFECTIVE key risk indicator (KRI)?

Accepted Answer

Provides an early warning signal of increasing risk exposure.. Options B and E are correct. An effective KRI should be predictive (leading) and actionable. Option A is wrong because lagging indicators (e.g., loss events) are not predictive. Option C is wrong because risk appetite thresholds should be set based on the KRI, not the other way around. Option D is wrong because a KRI should be sensitive, not smoothed.

Answer

Is derived from the organization's risk appetite statement.

Answer

Uses smoothed data to avoid alert fatigue.

Answer

Measures historical loss events.

Question 9

Which THREE of the following should be included in a board-level risk report to effectively communicate the organization's risk profile?

Accepted Answer

Emerging risks and trend analysis of key risk indicators over the past quarter.. Options A, C, and E are correct. A risk heat map visualizes key risks; emerging risks and trend analysis provide context for forward-looking decisions; and risk appetite limits help the board assess alignment. Option B is wrong because detailed control descriptions are too granular for board level. Option D is wrong because individual incident details are operational; aggregated trend is more appropriate.

Answer

A list of the most recent security incidents with root cause analysis.

Answer

Detailed descriptions of all controls mitigating the top risks.

Question 10

Which TWO of the following are examples of control monitoring activities?

Accepted Answer

Periodic manual testing of a sample of transactions for compliance with approval policy.. Options A and C are correct. Automated alerts on control failures and manual testing of controls are direct monitoring activities. Option B is wrong because assigning ownership is part of control design, not monitoring. Option D is wrong because updating risk register is a risk management activity, not direct control monitoring. Option E is wrong because the wording is confusing; KRIs are risk metrics, not control monitoring.

Answer

Assigning owners to each control in the control framework.

Answer

Reporting key risk indicator values to the risk committee.

Answer

Updating the risk register based on control test results.

Question 11

Based on the exhibit, which aspect of risk monitoring is MOST concerning?

Accepted Answer

The vulnerability has been open for three months with no evidence of monitoring or remediation despite a patch being available.. Option C is correct because a critical vulnerability with a patch available has been open for nearly three months with no remediation; risk acceptance alone does not substitute for active monitoring of the accepted risk. Option A is wrong because severity is already labeled critical. Option B is wrong because the risk was accepted, but the monitoring of that acceptance is the issue. Option D is wrong because the acceptance is recent; the concern is lack of follow-up.

Answer

The vulnerability severity is critical.

Answer

The last scan was three months after the initial detection.

Answer

The risk was accepted by the system owner.

Question 12

Based on the exhibit, what control monitoring deficiency is evident in the DLP policy?

Accepted Answer

The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).. Option B is correct because the policy has no rule to block credit card data being uploaded to cloud storage or other file-sharing services; it only blocks external email and large files, leaving a gap. Option A is wrong because alerts are already sent to the security team. Option C is wrong because the policy is specific to PCI-DSS and the rules are narrowly defined. Option D is wrong because logging is configured.

Answer

Alerts are not sent to the appropriate team.

Answer

Log retention is insufficient for forensic analysis.

Answer

The rules are too broadly defined and may cause false positives.

Question 13

Based on the exhibit, which key risk indicator (KRI) would this log data be MOST useful for calculating?

Accepted Answer

Number of failed authentication attempts per hour.. Option C is correct because the log shows multiple failed login attempts from a single IP address, which is a direct indicator of possible brute force attacks. Option A is wrong because successful logins are not shown. Option B is wrong because the log does not show change activity. Option D is wrong because it does not show system downtime.

Answer

Percentage of successful user logins.

Answer

Percentage of system uptime.

Answer

Number of unauthorized changes to system configurations.

Question 14

A risk manager notices that a key risk indicator (KRI) for failed login attempts has exceeded the threshold for three consecutive weeks. Which of the following should be the FIRST action?

Accepted Answer

Investigate the root cause of the increase.. Option B is correct because the first step is to investigate the root cause to determine if there is a control failure or a false positive. Option A is wrong because ignoring may lead to undetected risk. Option C is wrong because adjusting threshold without analysis is inappropriate. Option D is wrong because reporting without investigation may cause unnecessary alarm.

Answer

Adjust the threshold to reduce false positives.

Answer

Report the breach to the senior management immediately.

Answer

Ignore the trend as a statistical anomaly.

Question 15

An organization deployed a new intrusion detection system (IDS) that generates many alerts. The security team is overwhelmed and has started ignoring some alerts. What is the BEST way to address this issue?

Accepted Answer

Tune the IDS to reduce false positive alerts.. Option C is correct because tuning the IDS to reduce false positives will make alerts more actionable. Option A is wrong because hiring more staff may not be efficient. Option B is wrong because deactivating is risky. Option D is wrong because filtering without tuning may still miss real threats.

Answer

Implement a SIEM to filter and prioritize alerts.

Answer

Deactivate the IDS until it can be properly configured.

Answer

Hire additional security analysts to handle the alert volume.