CRISC Risk Response and Reporting Practice Question
An organization is implementing continuous monitoring for its critical systems. Which TWO of the following are examples of continuous monitoring techniques? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Continuous vulnerability scanning
Option A (Continuous vulnerability scanning) is correct because it is an automated, ongoing process that repeatedly identifies new vulnerabilities as systems and threat data change, which is a core continuous monitoring technique. Option C (Automated SIEM rules to detect anomalies) is correct because SIEM correlation rules and alerting run continuously against real-time log and event streams, providing ongoing detection rather than point-in-time assessment. Option B (Weekly review of access logs by a manager) is a periodic, manual review, so it is not continuous. Option D (Annual penetration testing) is a point-in-time, typically yearly assessment, not continuous monitoring. Option E (Quarterly control testing by internal audit) is periodic assurance performed on a quarterly cycle, not continuous monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Continuous vulnerability scanning
Why this is correct
Continuous vulnerability scanning automatically and repeatedly identifies new weaknesses across critical systems, providing the ongoing, real-time assurance that continuous monitoring demands. Periodic manual reviews or annual assessments lack the automation and frequency the technique requires.
- ✗
Weekly review of access logs by a manager
Why it's wrong here
Weekly manual log review leaves six-day blind spots and depends on human attention, so it is periodic, not continuous. It tempts because reviewing access logs genuinely detects anomalies, and weekly review suits low-volume, low-risk systems, but continuous monitoring requires automated, ongoing collection and alerting.
- ✓
Automated SIEM rules to detect anomalies
Why this is correct
Automated SIEM rules continuously correlate log events and raise alerts on anomalous activity, providing ongoing detective monitoring rather than periodic review. This satisfies the continuous monitoring requirement by detecting control failures and threats in near real time across critical systems.
- ✗
Annual penetration testing
Why it's wrong here
Annual penetration testing is a point-in-time assessment with a twelve-month gap, so it cannot continuously monitor critical systems. It tempts because penetration testing does reveal exploitable weaknesses, and annual testing suits compliance-driven assurance cycles, but continuous monitoring demands automated, near-real-time detection rather than yearly snapshots.
- ✗
Quarterly control testing by internal audit
Why it's wrong here
Quarterly testing is periodic, leaving gaps between assessments, so it cannot provide continuous monitoring. It tempts because control testing genuinely verifies control effectiveness, and quarterly testing suits low-risk, stable environments, but continuous monitoring requires automated, ongoing data collection rather than scheduled point-in-time reviews.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.