CRISC Risk and Control Monitoring and Reporting — Timed 30 Questions

Question 1

A security analyst notices that the number of failed login attempts has significantly increased over the past week. The SIEM alerts are not being triggered because the threshold was set too high. What is the MOST effective immediate action to improve monitoring?

Accepted Answer

Lower the threshold for failed login alerts in the SIEM.. B is correct because the immediate issue is that the SIEM alert threshold is set too high, causing failed login attempts to go undetected. Lowering the threshold directly addresses the monitoring gap by ensuring that the SIEM generates alerts for anomalous failed login activity, enabling timely incident response without requiring a system overhaul.

Answer

Implement a new authentication system with biometrics.

Answer

Enable all SIEM rules to capture every event.

Answer

Review logs manually each day to identify anomalies.

Question 2

A risk manager is reviewing the control monitoring reports and finds that a key control's effectiveness rating has dropped from 'effective' to 'partially effective' due to increased errors in manual data entry. Which of the following is the BEST course of action?

Accepted Answer

Conduct a root cause analysis to identify why errors increased.. A root cause analysis (RCA) is the best course of action because it systematically identifies the underlying reasons for the increased manual data entry errors, such as inadequate training, unclear procedures, or system interface issues. Without understanding the root cause, any corrective action (like automation or additional staff) may address symptoms rather than the actual problem, leading to wasted resources or recurring control failures. This aligns with the CRISC principle that control effectiveness must be restored by addressing the fundamental cause of degradation, not just the symptoms.

Answer

Immediately implement an automated data entry solution.

Answer

Increase the frequency of monitoring to detect errors sooner.

Answer

Assign additional staff to double-check data entries.

Question 3

A company has implemented a new control to detect unauthorized access attempts. What is the PRIMARY purpose of monitoring this control?

Accepted Answer

To confirm the control is working effectively.. The primary purpose of monitoring a detective control, such as one that detects unauthorized access attempts, is to confirm that the control is operating effectively as designed. Monitoring provides ongoing assurance that the control is correctly identifying and logging unauthorized access events, which is essential for maintaining the security posture and for timely incident response.

Answer

To provide evidence for regulatory audits.

Answer

To reduce the number of unauthorized access attempts.

Answer

To calculate the residual risk level.

Question 4

A risk practitioner is designing a monitoring dashboard for senior management. Which key performance indicator (KPI) would be MOST useful for tracking control effectiveness over time?

Accepted Answer

Percentage of controls passing automated tests.. Option D is correct because the percentage of controls passing automated tests directly measures the effectiveness of controls over time. A trend of increasing or stable high percentages indicates that controls are functioning as intended, while a decline signals degradation. This KPI is specifically designed for control monitoring, unlike metrics that measure activity or outcomes.

Answer

Number of security incidents reported.

Answer

Number of transactions processed per hour.

Answer

Value at Risk (VaR) for operational risk.

Question 5

A company has multiple business units each using different risk assessment methodologies. The risk committee wants consistent monitoring reports. What is the BEST approach to achieve consistency?

Accepted Answer

Develop and mandate a standardized risk assessment methodology.. Option A is correct because mandating a standardized risk assessment methodology ensures that all business units apply the same criteria, scales, and processes for identifying, analyzing, and evaluating risks. This eliminates methodological inconsistencies at the source, enabling the risk committee to produce truly comparable and reliable monitoring reports across the enterprise.

Answer

Aggregate risks at the enterprise level using a common taxonomy.

Answer

Require each business unit to adopt the same risk scoring scale.

Answer

Create a centralized reporting template with predefined fields.

Question 6

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. Option D is correct because high false positives can cause alert fatigue, leading to missed real incidents. Option A is a secondary effect. Option B is not directly caused by false positives. Option C is a possible result but not the most significant.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 7

A risk officer is evaluating the effectiveness of a control that prevents unauthorized changes to configuration files. The control has not detected any unauthorized changes in the past year. What does this indicate?

Accepted Answer

Further testing is needed to determine control effectiveness.. The absence of detected unauthorized changes does not automatically confirm control effectiveness; it could also indicate that the control is not properly configured to detect changes (e.g., missing file integrity monitoring rules, incorrect baseline, or disabled logging). Further testing—such as manually introducing a test change or reviewing audit logs—is required to verify that the control can actually detect violations. This aligns with CRISC best practices for validating control effectiveness through testing rather than relying solely on absence of alerts.

Answer

The control is unnecessary because no changes occurred.

Answer

The control is not configured correctly to detect changes.

Answer

The control is operating effectively and no violations occurred.

Question 8

A large organization is implementing a continuous monitoring program for its critical systems. Which of the following is the MOST important factor for the program's success?

Accepted Answer

Integration with automated incident response workflows.. Integration with automated incident response workflows is the most important factor because continuous monitoring is only effective if detected anomalies or threats can be acted upon in near real-time. Without automated response, alerts may be ignored or delayed, rendering the monitoring program ineffective. This aligns with the CRISC focus on reducing risk through timely remediation, not just detection.

Answer

Use of advanced analytics and machine learning.

Answer

Support from senior management.

Answer

Clear definition of monitoring scope and objectives.

Question 9

A control owner reports that a preventive control is operating as designed, but the risk owner is concerned that residual risk remains high. What should the risk practitioner do NEXT?

Accepted Answer

Perform a control effectiveness test to validate the control.. The risk practitioner must first validate the control's effectiveness before taking any further action. Even though the control owner reports the preventive control is operating as designed, the risk owner's concern about high residual risk suggests the control may not be adequately mitigating the risk. Performing a control effectiveness test (D) provides objective evidence to determine whether the control is actually reducing risk to an acceptable level, which is the necessary next step before updating the risk register, recommending compensating controls, or escalating.

Answer

Update the risk register to reflect the high residual risk.

Answer

Recommend additional compensating controls.

Answer

Escalate the issue to the risk committee.

Question 10

A company's risk monitoring report shows that a key risk indicator (KRI) has exceeded the threshold for three consecutive months. What is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis and implement corrective actions.. A KRI that has exceeded its threshold for three consecutive months indicates a persistent risk condition, not a transient anomaly. The most appropriate action is to conduct a root cause analysis to identify the underlying issue and implement corrective actions to bring the risk back within acceptable levels. This aligns with the CRISC domain of Risk and Control Monitoring and Reporting, which emphasizes proactive remediation over passive observation or threshold manipulation.

Answer

Wait for the KRI to return to normal on its own.

Answer

Raise the threshold to avoid future breaches.

Answer

Implement temporary manual controls.

Question 11

A risk practitioner is reviewing the results of a control self-assessment (CSA) and finds that the control owner rated a control as 'effective' but an independent audit found control weaknesses. What is the BEST explanation for this discrepancy?

Accepted Answer

The control owner may have a biased perception of control effectiveness.. The control owner's self-assessment is inherently subjective and may be influenced by personal bias, lack of objectivity, or a desire to report favorable results. An independent audit provides an objective, evidence-based evaluation, so a discrepancy where the owner rates a control as 'effective' while the audit finds weaknesses strongly suggests the owner's perception is skewed. This is the most direct and common explanation for such a conflict in control self-assessment (CSA) results.

Answer

The CSA was conducted too long ago.

Answer

The control owner did not understand the control objectives.

Answer

The audit used a different definition of 'effective'.

Question 12

Which TWO of the following are primary objectives of control monitoring?

Accepted Answer

To provide assurance to stakeholders that controls are functioning.. Control monitoring's primary objectives are to provide assurance to stakeholders that controls are functioning as intended and to verify that controls are operating effectively on an ongoing basis. This aligns with the CRISC framework's emphasis on continuous assurance over control performance, not just periodic assessment.

Answer

To calculate the financial impact of control failures.

Answer

To determine the design adequacy of controls.

Answer

To identify new risks that were not previously assessed.

Question 13

Which THREE of the following are key components of an effective risk reporting framework?

Accepted Answer

Consistent risk metrics across the organization.. Consistent risk metrics across the organization (Option B) are a key component of an effective risk reporting framework because they ensure that risk data is comparable and aggregated meaningfully across different business units and systems. Without standardized metrics, reports would be inconsistent, making it impossible to assess overall risk posture or identify trends reliably.

Answer

Automated collection of risk data from all sources.

Answer

Statistical models for predicting future risks.

Question 14

Which TWO of the following are examples of detective controls?

Accepted Answer

Review of access logs for unauthorized access.. A is correct because reviewing access logs for unauthorized access is a detective control. It involves examining historical records of system access events to identify security incidents or policy violations after they have occurred. This is a classic example of monitoring and analysis, not prevention or correction.

Answer

Backup and recovery procedures.

Answer

Firewall rules blocking unauthorized traffic.

Answer

Separation of duties in financial systems.

Question 15

Which THREE of the following are characteristics of leading key risk indicators (KRIs)?

Accepted Answer

They are predictive in nature.. Leading key risk indicators (KRIs) are predictive in nature because they track forward-looking metrics that signal potential future risk events before they occur. Unlike lagging indicators that measure past outcomes, leading KRIs use trend analysis and threshold monitoring to forecast changes in risk exposure, enabling organizations to anticipate and address issues proactively.

Answer

They are based on historical data.

Answer

They measure past events and losses.

Question 16

Refer to the exhibit. The SIEM alert triggered, but the security team did not respond because they were investigating another incident. What is the BEST way to prevent such monitoring gaps in the future?

Accepted Answer

Configure automatic escalation to a secondary response team if the alert is not acknowledged within a set time.. Option D is correct because it directly addresses the monitoring gap caused by analyst unavailability. By configuring automatic escalation to a secondary response team if an alert is not acknowledged within a set time, the organization ensures that no alert is left unattended even when the primary team is occupied. This is a standard operational resilience control in SIEM workflows, often implemented via playbook automation or SOAR integration.

Answer

Implement a ticketing system to track alert handling.

Answer

Hire additional security analysts to handle peak loads.

Answer

Increase the threshold to reduce false positives.

Question 17

Refer to the exhibit. The control test failed because unauthorized access attempts were detected. The remediation plan suggests additional logging. Is this remediation appropriate?

Accepted Answer

No, the remediation should focus on strengthening access controls.. Option D is correct because the control test failure was due to unauthorized access attempts, which indicates a weakness in preventive controls. Adding logging (a detective control) does not address the root cause; the remediation should focus on strengthening access controls (e.g., tightening authentication, authorization, or firewall rules) to prevent unauthorized access in the first place. Logging alone would only record future incidents without reducing their likelihood.

Answer

No, the control test methodology is flawed.

Answer

Yes, because the control is detective in nature.

Answer

Yes, additional logging will help detect future attempts.

Question 18

Refer to the exhibit. What action should the risk practitioner recommend FIRST?

Accepted Answer

Initiate a patch management process to apply critical patches.. The exhibit shows that critical vulnerabilities have been identified with a high risk score, and the current patch management process is not addressing them in a timely manner. The risk practitioner should first initiate a patch management process to apply critical patches, as this directly reduces the exposure to known exploits and aligns with the principle of treating the highest risks immediately. Delaying action or adjusting thresholds without remediation would leave the organization vulnerable.

Answer

Escalate to the board of directors.

Answer

Adjust the threshold to 10%.

Answer

Schedule a root cause analysis for next month.

Question 19

A multinational financial services company has implemented a continuous monitoring program for its trading systems. The program uses automated scripts to check system configurations against a baseline every hour. Recently, the company experienced a significant security incident where a malicious actor exploited a misconfigured firewall rule to exfiltrate sensitive customer data. Post-incident analysis revealed that the misconfiguration had been present for 72 hours before detection. The monitoring scripts did not detect the change because the baseline had been updated two weeks prior to include the misconfiguration as part of a planned change that was later reversed without updating the baseline. The company's change management process requires that all configuration changes be approved and documented, but the reversal of the change was not documented. The incident response team was only alerted when a customer reported suspicious activity. The risk practitioner is tasked with recommending improvements to prevent recurrence. Which of the following is the BEST course of action?

Accepted Answer

Implement a change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates.. Option B is correct because the root cause is that the baseline was updated to include the misconfiguration, and the subsequent reversal was not documented or reflected in the baseline. A change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates, directly addresses this by ensuring that only approved changes are in the baseline and any unapproved deviation (including reversals) triggers an alert. This prevents the monitoring system from accepting unauthorized changes as normal.

Answer

Enhance incident response procedures to include notification of customers within 24 hours.

Answer

Increase the frequency of monitoring scripts to every 30 minutes.

Answer

Require manual review of all configuration changes by a second analyst.

Question 20

A retail company has a risk monitoring program that tracks key risk indicators (KRIs) for its e-commerce platform. One KRI measures the number of failed payment transactions as a percentage of total transactions. The threshold is set at 2%. Over the past quarter, the KRI has been fluctuating between 1.8% and 2.5%, breaching the threshold several times. Each time the KRI exceeded the threshold, the risk owner performed a manual investigation and found that the failures were due to transient network issues that resolved on their own. The risk owner has now requested that the threshold be raised to 3% to avoid unnecessary investigations. The risk practitioner is evaluating this request. What should the risk practitioner do?

Accepted Answer

Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change.. Option C is correct because the recurring network issues causing threshold breaches indicate an underlying problem that needs to be addressed, not just a threshold adjustment. Raising the threshold without understanding the root cause could mask a significant risk to transaction integrity and revenue. A root cause analysis (RCA) would identify whether the transient network issues stem from infrastructure, configuration, or external dependencies, enabling a proper control response.

Answer

Approve the threshold increase since investigations have not found any significant issues.

Answer

Suggest implementing automated remediation for network issues instead of raising the threshold.

Answer

Reject the request and require investigation of every breach.