CRISC Risk and Control Monitoring and Reporting Practice Test 9 — 15 Questions

Question 1

A financial institution is redesigning its control monitoring program to comply with a new regulatory requirement that mandates near-real-time monitoring of high-risk transactions. The current system performs batch processing daily. Which approach BEST meets the requirement while minimizing operational impact?

Accepted Answer

Implement a real-time monitoring solution that only processes transactions flagged as high-risk based on predefined criteria.. Option A is correct because implementing a parallel real-time stream for high-risk transactions directly meets the requirement without affecting existing batch processing. Option B is wrong because increasing batch frequency may still not be real-time. Option C is wrong because replacing batch with real-time for all transactions is costly and risky. Option D is wrong because manual review is not near-real-time.

Answer

Use manual reviews of high-risk transactions by compliance officers within 24 hours.

Answer

Replace batch processing with a fully real-time system for all transactions.

Answer

Increase batch processing frequency from daily to hourly.

Question 2

When reporting risk and control monitoring results to the board of directors, which of the following formats is MOST effective?

Accepted Answer

Visual dashboards with key metrics and trend indicators.. Option C is correct because visual dashboards with trend lines and color coding quickly convey risk status. Option A is wrong because raw data is overwhelming. Option B is wrong because narrative only lacks context. Option D is wrong because verbal only may not be retained.

Answer

Narrative reports describing findings in paragraphs.

Answer

Oral summary without supporting documentation.

Answer

Detailed spreadsheets with raw data for each control.

Question 3

An internal audit found that a control designed to prevent duplicate payments was bypassed in 5% of transactions. The control owner argues that the control is still effective because the bypass rate is low. What is the BEST response from a risk perspective?

Accepted Answer

Investigate why bypasses occur and implement compensating controls.. Option B is correct because the root cause of bypasses must be addressed to ensure control reliability. Option A is wrong because accepting the bypass rate may increase risk. Option C is wrong because 95% effectiveness may not meet policy. Option D is wrong because re-classifying is not addressing the issue.

Answer

Accept the bypass rate as within acceptable tolerance.

Answer

Document that the control is 95% effective and close the finding.

Answer

Re-classify the control as a detective control instead of preventive.

Question 4

A company's control monitoring shows that a detective control has been 100% effective for the past year. However, a recent incident revealed that a data breach went undetected for three months. What is the MOST likely cause?

Accepted Answer

The control was not designed to detect the type of breach that occurred.. Option D is correct because the control may not have covered the specific scenario of the breach. Option A is wrong if no logs. Option B is wrong because 100% suggests no failures. Option C is wrong because if monitoring was correct, it would have caught.

Answer

The control failure occurred but was not recorded.

Answer

The monitoring frequency was insufficient to detect the breach.

Answer

The control monitoring logs were tampered with.

Question 5

An organization defines its risk appetite as 'no more than one major security incident per year.' During the year, a major incident occurs. The monitoring team reports this to the risk committee. What should be the NEXT step?

Accepted Answer

Review the incident to determine if risk appetite needs adjustment.. Option C is correct because the risk committee should review the incident and consider whether to adjust risk appetite or implement additional controls. Option A is wrong because reporting to board is premature without analysis. Option B is wrong because accepting without analysis is passive. Option D is wrong because change may not be needed; appetite may be reaffirmed.

Answer

Immediately change the risk appetite to tolerate two incidents per year.

Answer

Report the breach to the board of directors.

Answer

Accept the incident and continue with current controls.

Question 6

A company uses a third-party vendor to process customer data. The vendor's security control monitoring reports show no issues. However, the company's internal monitoring detects anomalies in vendor response times. What is the BEST interpretation?

Accepted Answer

The anomalies may indicate a control gap in the vendor's environment.. Option D is correct because the internal monitoring may have detected a control weakness not covered by vendor reports. Option A is wrong because response time anomaly is a signal. Option B is wrong because vendor reports may be incomplete. Option C is wrong because external monitoring is equally important.

Answer

The vendor's monitoring is accurate; the anomalies are false positives.

Answer

The internal monitoring should be disabled to avoid confusion.

Answer

The vendor's monitoring is more reliable than internal monitoring.

Question 7

An organization is considering moving from periodic control testing to continuous monitoring for its critical financial controls. What is the PRIMARY benefit of this transition?

Accepted Answer

Faster identification of control failures.. Option A is correct because continuous monitoring allows for faster detection and response to control failures. Option B is wrong because continuous monitoring often requires more resources. Option C is wrong because control failures are still possible but detected sooner. Option D is wrong because continuous monitoring is often more complex.

Answer

Simplification of the control environment.

Answer

Reduction in monitoring costs.

Answer

Elimination of all control failures.

Question 8

Which TWO of the following are characteristics of an effective key risk indicator (KRI)?

Accepted Answer

Leading indicators that provide early warning.. Option A and D are correct because KRIs should be leading (predictive) and measurable. Option B is wrong because lagging indicators are not predictive (though may be used). Option C is wrong because too many KRIs cause overload. Option E is wrong because qualitative measures are sometimes needed but quantitative is preferred.

Answer

Large number of indicators to cover all risks.

Answer

Lagging indicators that confirm past events.

Answer

Qualitative assessments based on expert opinion.

Question 9

Which THREE of the following are best practices for reporting risk and control monitoring results to stakeholders?

Accepted Answer

Tailor the report to the audience's level of understanding.. Option B, D, and E are correct. Option A is wrong because detailed technical information may not be appropriate for all. Option C is wrong because reporting should be consistent, not ad hoc.

Answer

Include detailed technical logs for each control.

Answer

Provide reports only when issues occur.

Question 10

Which TWO of the following factors should be considered when determining the frequency of control monitoring?

Accepted Answer

The criticality of the control to risk mitigation.. Option A and C are correct because risk level and control criticality drive frequency. Option B is wrong because monitoring frequency should align with risk, not necessarily cost savings. Option D is wrong because it's about control, not IT projects. Option E is wrong because auditor recommendations are secondary.

Answer

The cost of monitoring relative to control cost.

Answer

The number of IT projects in progress.

Answer

The preferences of the external auditor.

Question 11

Refer to the exhibit. A security analyst reviews firewall logs and sees repeated authentication failures for VPN tunnel attempts between two IP addresses. What is the MOST appropriate action?

Accepted Answer

Block the source IP (203.0.113.5) at the firewall.. Option B is correct because repeated authentication failures indicate a potential brute-force attack or misconfiguration. Blocking the source IP can prevent further attempts. Option A is wrong because ignoring may allow continued attack. Option C is wrong because updating policy for all sources is too broad. Option D is wrong because contacting the destination without investigation is premature.

Answer

Contact the destination IP owner to verify credentials.

Answer

Update the VPN policy to allow all authentication methods.

Answer

Ignore the logs as routine failed attempts.

Question 12

Refer to the exhibit. A risk analyst is reviewing an AWS S3 bucket policy. What is the MOST significant control monitoring gap in this policy?

Accepted Answer

The policy lacks auditing or logging of access attempts.. Option D is correct because the policy only restricts to internal IP range and requires HTTPS, but it does not log access attempts. Without logging, unauthorized attempts cannot be monitored. Option A is wrong because HTTPS is required. Option B is wrong because internal IP range is allowed. Option C is wrong because Deny for non-HTTPS is present, but logging is missing.

Answer

The policy does not restrict access to specific internal IPs.

Answer

The policy allows HTTPS access from any internal IP.

Answer

The policy denies non-HTTPS access but does not enforce encryption for allowed access.

Question 13

Refer to the exhibit. A SIEM correlation rule 'Brute_Force_SSH' has fired excessively due to traffic from internal monitoring servers. What is the BEST course of action?

Accepted Answer

Add an exception in the rule to exclude internal monitoring server IPs.. Option C is correct because the rule is generating false positives from legitimate monitoring servers; tuning the rule to exclude known monitoring sources will reduce noise. Option A is wrong because disabling the rule removes detection for real brute force. Option B is wrong because not addressing false positives may lead to alert fatigue. Option D is wrong because the traffic is from known servers, not suspicious.

Answer

Disable the correlation rule to stop false alerts.

Answer

Increase the threshold to reduce false positives.

Answer

Investigate the monitoring servers for compromise.

Question 14

A risk manager notices that a key risk indicator (KRI) has been consistently above the threshold for three months. What should be the first action?

Accepted Answer

Review the KRI definition and data source for accuracy.. Before escalating, it is important to verify the accuracy of the KRI data and definition. Option B is correct because data integrity issues are a common cause of false alarms. Option A is premature without verification. Option C incorrectly adjusts the threshold. Option D is reactive without understanding the root cause.

Answer

Adjust the threshold to a higher value.

Answer

Implement additional controls immediately.

Answer

Escalate to senior management immediately.

Question 15

After a major system upgrade, the control testing team reports that a critical automated control failed intermittently. The control owner states it's a temporary glitch. What is the best course of action?

Accepted Answer

Perform a root cause analysis before deeming it effective.. Intermittent failures require root cause analysis to determine if the control is truly effective. Option B is correct. Option A accepts risk prematurely. Option C replaces without analysis. Option D increases frequency but does not address the failure.

Answer

Replace the control with a manual one.

Answer

Increase frequency of monitoring.

Answer

Accept the risk and document the finding.