CGRC Practice Question: Which THREE of the following are necessary to establish a 'Continuous Control Monitoring'…
Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?
⚠ Common exam trap
CGRC often tests the distinction between continuous automated monitoring and periodic manual review — the trap is selecting a manual or quarterly activity that sounds thorough but is not continuous.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automated notification workflows for failed controls.
Continuous Control Monitoring (CCM) requires automated, near-real-time evaluation of controls, so option A (automated notification workflows for failed controls) is correct because alerts must fire when a control breaches its threshold so remediation can be triggered promptly. Option C (defined thresholds for 'Pass' or 'Fail' conditions) is correct because CCM cannot evaluate a control without explicit, measurable criteria that determine compliance versus non-compliance. Option D (automated data extraction from IT assets) is correct because CCM depends on continuous, machine-driven collection of telemetry and configuration data from systems rather than periodic human sampling. Option B is not required because daily physical site visits are a manual, point-in-time activity that contradicts the continuous, automated nature of CCM, and option E is not required because a quarterly manual spreadsheet is periodic and manual, which is the opposite of continuous monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Automated notification workflows for failed controls.
Why this is correct
Automated notification workflows satisfy the real-time alerting constraint by pushing failure events to responsible owners the moment a control drifts, rather than waiting for periodic review. Without this feedback loop, monitoring detects nothing actionable, so remediation stalls and the program degrades into static reporting.
- ✗
A physical audit team performing site visits daily.
Why it's wrong here
Daily physical site visits address only physical controls, whereas CCM requires automated, continuous telemetry across all control domains. It is tempting because physical inspection genuinely validates environmental and facility safeguards, and would be the right approach for a physical security audit programme.
- ✓
Defined thresholds for 'Pass' or 'Fail' conditions.
Why this is correct
CCM requires measurable pass or fail criteria so control states can be evaluated continuously and consistently. Defining thresholds satisfies the stem's need for a program that determines compliance status automatically, without which monitoring produces no actionable result.
- ✓
Automated data extraction from IT assets.
Why this is correct
CCM depends on machine-readable data pulled directly from IT assets, replacing manual evidence collection. Automated extraction satisfies the stem's requirement for continuous monitoring, since periodic human sampling cannot deliver the real-time control visibility the program demands.
- ✗
A manual spreadsheet that is updated every quarter.
Why it's wrong here
A quarterly manual spreadsheet cannot deliver continuous monitoring; CCM requires automated, near-real-time data feeds against defined metrics. Its appeal lies in low cost and familiarity for periodic compliance reporting, such as annual SOC 2 evidence collection, where quarterly snapshots satisfy the audit window rather than ongoing control assurance.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A GRC analyst at a software company is building the organization's risk register for the first time. The CISO asks which…
- The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk excepti…
- Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?
- When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?
- The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.