CRISC Risk and Control Monitoring and Reporting 2

Question 1

What does a risk dashboard primarily provide to stakeholders?

Accepted Answer

A real-time or near-real-time visual summary of the organization's risk posture and KRI status

Answer

A risk dashboard aggregates KRIs and risk metrics into a visual format that enables quick understanding of the current risk posture without requiring detailed analysis.

Question 2

What is the purpose of tracking risk trends over time?

Accepted Answer

To identify whether risks are increasing, decreasing, or stable so that responses can be adjusted accordingly

Answer

Trend analysis reveals the direction risk is moving, enabling proactive adjustments to risk responses before situations deteriorate beyond acceptable thresholds.

Question 3

Which of the following is a typical trigger for updating the risk register?

Accepted Answer

A significant change in the business environment, technology, or threat landscape

Answer

Material changes in the environment — such as new systems, mergers, emerging threats, or regulatory changes — should trigger an update to the risk register to keep it current.

Question 4

What is the significance of establishing control thresholds in risk monitoring?

Accepted Answer

Thresholds define the acceptable performance range for controls, triggering alerts when breached

Answer

Control thresholds define the boundary of acceptable performance; when a metric crosses the threshold, it signals that human review and potential escalation are needed.

Question 5

What is the purpose of a lessons-learned review after a security incident?

Accepted Answer

To analyze what happened, why controls failed, and how to prevent recurrence

Answer

Lessons-learned reviews close the risk management loop by identifying root causes, control weaknesses, and improvements to prevent the same incident from recurring.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Risk and Control Monitoring and Reporting 2