CRISC Risk Response and Mitigation Practice Question
A risk practitioner is working with the IT team to design controls for a new cloud-based human resources system. The team proposes using encryption for data at rest and in transit, role-based access controls, and regular backups. The risk practitioner notes that these controls address confidentiality, integrity, and availability. Which of the following should the risk practitioner recommend to ensure the controls remain effective over time?
⚠ Common exam trap
The trap here is opting for periodic assessments like annual risk assessments or audits, which do not provide the timely detection needed for dynamic cloud environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a continuous monitoring program that includes automated alerts for control failures.
Continuous monitoring with automated alerts ensures that controls are consistently effective by detecting failures or deviations quickly. In a cloud environment, where changes are frequent, periodic assessments or audits are insufficient. Continuous monitoring provides ongoing assurance and supports timely risk response, aligning with CRISC best practices for maintaining risk within appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Document the controls in the risk register and review them during the next audit.
Why it's wrong here
Documenting controls and reviewing them during an audit is a passive approach and does not provide timely detection of control failures. Audits are typically annual or less frequent, so issues could go unnoticed for extended periods. Continuous monitoring is a more proactive and effective recommendation.
- ✗
Perform a penetration test after the system goes live and then every two years.
Why it's wrong here
Penetration testing is a point-in-time assessment and does not ensure ongoing control effectiveness. Testing every two years is insufficient, especially for a cloud system that may change frequently. While useful, it should be part of a broader monitoring program, not the primary recommendation.
- ✗
Conduct an annual risk assessment to re-evaluate the risks and controls.
Why it's wrong here
An annual risk assessment is too infrequent for a dynamic cloud environment where threats and configurations change rapidly. While periodic assessments are valuable, they do not provide the ongoing assurance needed to ensure controls remain effective. Continuous monitoring is more appropriate to detect issues in a timely manner.
- ✓
Implement a continuous monitoring program that includes automated alerts for control failures.
Why this is correct
Continuous monitoring ensures that controls remain effective by providing real-time or near-real-time visibility into control performance. Automated alerts can notify the team of failures or deviations, enabling prompt remediation. This is a proactive approach to maintain risk at acceptable levels and is a key recommendation for sustaining control effectiveness in dynamic environments like cloud systems.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.