The answer is a phased risk-based approach that prioritizes monitoring of high-risk areas such as privileged accounts and sensitive patient data. This is correct because it directly addresses the constraint of improving monitoring with limited resources by focusing effort where the greatest potential for harm exists, rather than attempting to cover everything equally. On the CRISC exam, this scenario tests your understanding of risk treatment and resource optimization under the Risk Response and Mitigation domain, where you must balance control effectiveness against operational constraints like budget and staff hours. A common trap is to choose full automation, but that ignores the cost reality, while outsourcing can introduce data privacy risks with protected health information. Remember the memory tip: “High risk, high focus—don’t spread thin, dig in.”
CRISC Risk and Control Monitoring and Reporting Practice Question
This CRISC practice question tests your understanding of risk and control monitoring and reporting. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A healthcare organization operates a legacy electronic health record (EHR) system that is manually monitored for access anomalies by a small IT team. The organization is planning to migrate to a new cloud-based EHR with integrated logging and monitoring. However, due to budget constraints, the migration will take two years. In the interim, the risk manager wants to improve monitoring for unauthorized access to patient data. The current manual process involves weekly log reviews, but recent audits have identified instances of delayed detection (up to two weeks) and missed incidents. The IT team can dedicate only 10 additional hours per week for monitoring. What is the best approach to enhance monitoring during the transition period?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a phased risk-based approach, prioritizing monitoring of high-risk areas such as privileged accounts and sensitive patient data.
A phased approach focusing on high-risk areas (e.g., privileged accounts, sensitive data) optimizes limited resources. Full automation (A) is too costly; outsourcing (C) may have data privacy issues; accepting the state (D) is irresponsible given audit findings.
Key principle: Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Outsource the monitoring to a third-party managed security service provider.
Why it's wrong here
Healthcare data privacy regulations may restrict outsourcing; also costly.
✗
Implement a full automation suite for access monitoring immediately.
Why it's wrong here
Too expensive and complex for interim period; budget constraints are a key factor.
✓
Use a phased risk-based approach, prioritizing monitoring of high-risk areas such as privileged accounts and sensitive patient data.
Why this is correct
Targets the highest risks with limited resources; feasible and effective.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Authentication checks who the user is.
✗
Accept the current monitoring state as adequate given the upcoming migration.
Why it's wrong here
Audit findings show clear deficiencies; acceptance is not a valid option.
Common exam traps
Common exam trap: authentication is not authorization
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Trap categories for this question
Command / output trap
Audit findings show clear deficiencies; acceptance is not a valid option.
Detailed technical explanation
How to think about this question
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
KKey Concepts to Remember
Authentication checks who the user is.
Authorization controls what the user is allowed to do after login.
Privilege levels affect access to EXEC and configuration commands.
AAA, TACACS+ and RADIUS can separate login success from command access.
TExam Day Tips
→Do not assume successful login means full administrative access.
→Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
→Separate login problems from permission problems before choosing the answer.
Key takeaway
Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related CRISC questions on access control and AAA configuration.
Risk and Control Monitoring and Reporting — This question tests Risk and Control Monitoring and Reporting — Authentication checks who the user is..
What is the correct answer to this question?
The correct answer is: Use a phased risk-based approach, prioritizing monitoring of high-risk areas such as privileged accounts and sensitive patient data. — A phased approach focusing on high-risk areas (e.g., privileged accounts, sensitive data) optimizes limited resources. Full automation (A) is too costly; outsourcing (C) may have data privacy issues; accepting the state (D) is irresponsible given audit findings.
What should I do if I get this CRISC question wrong?
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related CRISC questions on access control and AAA configuration.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Authentication checks who the user is.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.