Risk and Control Monitoring and Reporting practice questions

Implement a new authentication system with biometrics.

Why wrong: Too costly and time-consuming for immediate action.

Enable all SIEM rules to capture every event.

Why wrong: Causes alert fatigue and operational overload.

Review logs manually each day to identify anomalies.

Why wrong: Manual review is not scalable and may miss events.

Immediately implement an automated data entry solution.

Why wrong: May not address the root cause and could be costly.

Increase the frequency of monitoring to detect errors sooner.

Why wrong: Does not reduce errors; only detects them.

Assign additional staff to double-check data entries.

Why wrong: Adds cost but may not solve the problem.

To provide evidence for regulatory audits.

Why wrong: Documentation is a byproduct, not primary purpose.

To reduce the number of unauthorized access attempts.

Why wrong: Monitoring does not directly reduce attempts.

To calculate the residual risk level.

Why wrong: Risk calculation uses monitoring data but is not the primary purpose.

Number of security incidents reported.

Why wrong: Outcome metric, not control performance.

Number of transactions processed per hour.

Why wrong: Operational metric, not control effectiveness.

Value at Risk (VaR) for operational risk.

Why wrong: Risk metric, not control-specific.

Aggregate risks at the enterprise level using a common taxonomy.

Why wrong: Taxonomy helps but methodology may still differ.

Require each business unit to adopt the same risk scoring scale.

Why wrong: Scoring scale alone doesn't ensure consistent methodology.

Create a centralized reporting template with predefined fields.

Why wrong: Template doesn't enforce consistent methodology.

Loss of confidence in the control by management.

Why wrong: Important, but the operational impact is greater.

Reduced system performance due to alert processing.

Why wrong: Unlikely to be significant.

Increased cost of investigating alerts.

Why wrong: Cost is a concern, but not the most significant impact.

The control is unnecessary because no changes occurred.

Why wrong: Absence of evidence is not evidence of absence.

The control is not configured correctly to detect changes.

Why wrong: Possible but not certain.

The control is operating effectively and no violations occurred.

Why wrong: Cannot conclude without testing.

Use of advanced analytics and machine learning.

Why wrong: Helpful but not required.

Support from senior management.

Why wrong: Important but not the most critical for operational success.

Clear definition of monitoring scope and objectives.

Why wrong: Necessary but already defined before implementation.

Update the risk register to reflect the high residual risk.

Why wrong: Should be done after verification.

Recommend additional compensating controls.

Why wrong: May be needed after testing.

Escalate the issue to the risk committee.

Why wrong: Not necessary without further analysis.

Wait for the KRI to return to normal on its own.

Why wrong: Passive approach may lead to escalation.

Raise the threshold to avoid future breaches.

Why wrong: Does not address the underlying risk.

Implement temporary manual controls.

Why wrong: May be needed, but root cause analysis is primary.

The CSA was conducted too long ago.

Why wrong: Timing can be a factor but not the best explanation.

The control owner did not understand the control objectives.

Why wrong: Possible, but bias is more common.

The audit used a different definition of 'effective'.

Why wrong: Definitions are usually standardized.

To calculate the financial impact of control failures.

Why wrong: Impact analysis is separate.

To determine the design adequacy of controls.

Why wrong: Design adequacy is assessed before implementation.

To identify new risks that were not previously assessed.

Why wrong: This is part of risk identification, not monitoring.

Automated collection of risk data from all sources.

Why wrong: Data collection is a prerequisite, not a component of the framework.

Statistical models for predicting future risks.

Why wrong: Predictive analytics is advanced, not a core component.

Backup and recovery procedures.

Why wrong: Corrective control.

Firewall rules blocking unauthorized traffic.

Why wrong: Preventive control.

Separation of duties in financial systems.

Why wrong: Preventive control.

They are based on historical data.

Why wrong: Lagging indicators are historical.

They measure past events and losses.

Why wrong: Lagging indicator characteristic.

Implement a ticketing system to track alert handling.

Why wrong: Tracking alone does not enforce response.

Hire additional security analysts to handle peak loads.

Why wrong: Not immediate and may not be cost-effective.

Increase the threshold to reduce false positives.

Why wrong: Does not solve the response gap.

No, the control test methodology is flawed.

Why wrong: Test methodology is not the issue.

Yes, because the control is detective in nature.

Why wrong: The control is preventive, not detective.

Yes, additional logging will help detect future attempts.

Why wrong: Detective control does not prevent failures.

Escalate to the board of directors.

Why wrong: Not necessary yet.

Adjust the threshold to 10%.

Why wrong: Manipulating threshold is inappropriate.

Schedule a root cause analysis for next month.

Why wrong: Too slow; risk is escalating.

Enhance incident response procedures to include notification of customers within 24 hours.

Why wrong: Does not prevent the incident.

Increase the frequency of monitoring scripts to every 30 minutes.

Why wrong: Would not detect if baseline is incorrect.

Require manual review of all configuration changes by a second analyst.

Why wrong: Prone to human error and not automated.

Approve the threshold increase since investigations have not found any significant issues.

Why wrong: Ignores the pattern of failures.

Suggest implementing automated remediation for network issues instead of raising the threshold.

Why wrong: Automation is good but root cause should be addressed first.

Reject the request and require investigation of every breach.

Why wrong: May cause alert fatigue without solving root cause.