hardMultiple ChoiceObjective-mapped
CRISC Practice Question: The exhibit shows a warning from a control…
Exhibit
Refer to the exhibit. ``` Syslog Alert from Monitoring Tool Sep 15 10:23:45 server01 monitor[1234]: WARNING: ControlID C-0451 - Transaction Approval Limit exceeded. Threshold: 50000 USD Actual: 52300 USD User: user_id=jsmith, department=Finance Approver: not assigned Timestamp: 2024-09-15 10:23:45 ```
The exhibit shows a warning from a control monitoring system. Based on the log, which of the following is the MOST likely control deficiency?
⚠ Common exam trap
The trap here is that candidates may focus on the user's authority or the threshold value, but the core control deficiency is the missing approver assignment, which is a common oversight in segregation of duties controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is no approver assigned for transactions exceeding the limit
The log indicates that a transaction exceeding the 50,000 USD threshold was initiated by user JSmith but no approval was recorded. The control deficiency is the absence of an assigned approver for transactions that exceed the limit, which directly violates the segregation of duties principle. Without a designated approver, the control fails to prevent or detect unauthorized high-value transactions, making this the most likely root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
There is no approver assigned for transactions exceeding the limit
Why this is correct
The 'Approver: not assigned' indicates a control failure in the approval process.
- ✗
The threshold of 50000 USD is set too high
Why it's wrong here
The threshold triggered at 52300, which is above the limit, so it is working as designed.
- ✗
The monitoring system is generating false positives
Why it's wrong here
The alert is accurate because the limit was exceeded without an approver.
- ✗
The user JSmith should not have authority to initiate such transactions
Why it's wrong here
The log does not indicate whether JSmith has authority; the issue is lack of approval.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.