hardMultiple Choice

CRISC Practice Question: Based on the exhibit, what control monitoring…

Exhibit

Refer to the exhibit.

---
Data Loss Prevention Policy (JSON snippet)
{
  "policyName": "PCI-DSS Policy",
  "rules": [
    {
      "ruleId": 1,
      "condition": "data.type == 'credit_card' && data.destination == 'external_email'",
      "action": "block",
      "alert": true
    },
    {
      "ruleId": 2,
      "condition": "data.type == 'credit_card' && data.size > 1000",
      "action": "block",
      "alert": true
    }
  ],
  "monitoring": {
    "alertDestination": "security_team@company.com",
    "logRetentionDays": 90
  }
}
---

Based on the exhibit, what control monitoring deficiency is evident in the DLP policy?

⚠ Common exam trap

It's easy for candidates to assume the DLP policy is comprehensive because it covers webmail and FTP, but they fail to notice the omission of cloud storage applications, which is a classic control monitoring deficiency tested in CRISC.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).

The DLP policy shown in the exhibit only includes rules for monitoring and blocking credit card data exfiltration via webmail (Gmail, Yahoo Mail) and FTP. It completely omits any rule for cloud storage applications such as Dropbox or OneDrive, which are common vectors for data exfiltration. This is a control monitoring deficiency because the policy fails to cover a significant risk surface, leaving the organization blind to unauthorized transfers of sensitive data through these channels.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy does not monitor or block credit card data exfiltration via cloud storage applications (e.g., Dropbox, OneDrive).
Why this is correct
The DLP policy inspects email and endpoint channels but omits cloud storage applications, so credit card data can leave via Dropbox or OneDrive undetected. That coverage gap is the monitoring deficiency, since exfiltration through those sanctioned apps is neither blocked nor logged.
✗
Alerts are not sent to the appropriate team.
Why it's wrong here
Notification routing is a genuine monitoring control, but the exhibit's deficiency lies in the rule scope or detection logic, not the recipient list. This would be correct if alerts fired correctly yet reached an unmonitored mailbox or wrong distribution group.
✗
Log retention is insufficient for forensic analysis.
Why it's wrong here
Retention length is a storage-duration setting, not a monitoring gap visible in the exhibit's alerting or rule configuration. It would be the right answer if the stem showed logs expiring before an investigation window, rather than a policy that fails to detect or notify.
✗
The rules are too broadly defined and may cause false positives.
Why it's wrong here
Broad rule definitions causing false positives is a tuning concern, not the monitoring deficiency the exhibit demonstrates; the stem's evidence points to detection or alerting failure. Overly broad rules would be the answer if the exhibit showed excessive benign matches overwhelming analysts.

Go deeper

CRISC Practice Question: Based on the exhibit, what control monitoring…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question