mediumMultiple SelectObjective-mapped
CRISC Practice Question: Which TWO of the following are essential…
Which TWO of the following are essential components of an effective control monitoring program?
⚠ Common exam trap
Many exam-takers confuse 'control inventory' (Option B) with 'monitoring program components,' or assume that all control failures must trigger real-time alerts (Option D), when in fact effective monitoring prioritizes based on risk and uses baselines to reduce noise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A defined baseline for normal system behavior.
A defined baseline for normal system behavior is essential because it provides the reference point against which monitoring tools can detect anomalies, deviations, or potential control failures. Without a baseline, it is impossible to distinguish routine activity from suspicious or unauthorized changes, rendering monitoring alerts meaningless. This baseline is typically established through statistical modeling, threshold tuning, or historical analysis of logs and metrics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A defined baseline for normal system behavior.
Why this is correct
Baselines help identify deviations.
- ✗
A comprehensive list of all controls in the organization.
Why it's wrong here
Monitoring should focus on key controls, not all.
- ✗
A manual checklist for each control reviewed daily.
Why it's wrong here
Manual checklists are not essential; automation is often used.
- ✗
Real-time alerting for all control failures.
Why it's wrong here
Real-time alerting is not always feasible or necessary.
- ✓
Clearly defined roles and responsibilities for monitoring activities.
Why this is correct
Accountability is crucial for effective monitoring.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.