mediumMultiple Choice

CRISC Policy evaluation order Practice Question

Exhibit

Refer to the exhibit.
{
  "policies": [
    {"sid": "AllowRead", "effect": "Allow", "principal": "*", "action": ["s3:GetObject"], "resource": "arn:aws:s3:::critical-data/*", "condition": {"IpAddress": {"aws:SourceIp": "10.0.0.0/8"}}},
    {"sid": "DenyAll", "effect": "Deny", "principal": "*", "action": ["s3:*"], "resource": "arn:aws:s3:::critical-data/*"}
  ]
}

An access control policy includes a default deny rule (DenyAll) and an explicit allow rule. During a monitoring review, the risk practitioner notices that the DenyAll rule is never evaluated because the explicit allow matches first. What is the MOST likely monitoring gap?

⚠ Common exam trap

The trap is that candidates assume a deny-all rule is always effective because it is present, but they overlook that policy evaluation order and first-match semantics can cause an allow rule to be evaluated first, making the deny-all rule inert unless its effectiveness is validated through testing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No automated test validates that the DenyAll policy is effective

The default deny rule is overridden by the explicit allow rule, making the deny ineffective. Without an automated test to validate that the deny rule is actually enforced, the monitoring gap is that the control is assumed to work but is not verified. This is a classic control monitoring failure where the existence of a policy is confused with its effectiveness.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
No KRI is defined for unauthorized access attempts
Why it's wrong here
KRIs are indicators used to monitor risk, but the gap here is not about defining KRIs; it is about testing the policy enforcement.
✗
Server-side encryption is not enabled
Why it's wrong here
Encryption protects data at rest, but the issue is about access control policy effectiveness, not encryption.
✓
No automated test validates that the DenyAll policy is effective
Why this is correct
Without automated testing, the effectiveness of the DenyAll policy is not verified, leaving a monitoring gap.
✗
User access reviews are not performed quarterly
Why it's wrong here
Quarterly user access reviews are important for access management, but they do not address real-time policy enforcement testing.

Go deeper

CRISC Policy evaluation order Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question