hardMultiple ChoiceObjective-mapped

CRISC Practice Question: Based on the exhibit, what control monitoring…

Exhibit

Refer to the exhibit.

---
Data Loss Prevention Policy (JSON snippet)
{
  "policyName": "PCI-DSS Policy",
  "rules": [
    {
      "ruleId": 1,
      "condition": "data.type == 'credit_card' && data.destination == 'external_email'",
      "action": "block",
      "alert": true
    },
    {
      "ruleId": 2,
      "condition": "data.type == 'credit_card' && data.size > 1000",
      "action": "block",
      "alert": true
    }
  ],
  "monitoring": {
    "alertDestination": "security_team@company.com",
    "logRetentionDays": 90
  }
}
---

Based on the exhibit, what control monitoring deficiency is evident in the DLP policy?

⚠ Common exam trap

It's easy for candidates to assume the DLP policy is comprehensive because it covers webmail and FTP, but they fail to notice the omission of cloud storage applications, which is a classic control monitoring deficiency tested in CRISC.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).

The DLP policy shown in the exhibit only includes rules for monitoring and blocking credit card data exfiltration via webmail (Gmail, Yahoo Mail) and FTP. It completely omits any rule for cloud storage applications such as Dropbox or OneDrive, which are common vectors for data exfiltration. This is a control monitoring deficiency because the policy fails to cover a significant risk surface, leaving the organization blind to unauthorized transfers of sensitive data through these channels.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).
Why this is correct
Missing coverage for common data loss vectors.
✗
Alerts are not sent to the appropriate team.
Why it's wrong here
Alerts are sent to security team as configured.
✗
Log retention is insufficient for forensic analysis.
Why it's wrong here
90 days is a typical retention period; not a monitoring deficiency.
✗
The rules are too broadly defined and may cause false positives.
Why it's wrong here
Rules are specific to credit card data and size.

Go deeper

CRISC Practice Question: Based on the exhibit, what control monitoring…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question