Control Design and Implementation CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A control that is designed to stop an error or fraud from occurring is classified as which type?

   • ADetective
   • BPreventive
   • CCorrective
   • DCompensating
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a control that automatically blocks access to a system after three failed login attempts. The control is implemented in the system and does not require manual intervention. How should this control be classified, and what is the most appropriate testing method?

   • APreventive and automated; test by re-performing the failed login attempts
   • BPreventive and hybrid; test by inspection of the configuration
   • CDetective and automated; test by observing the system logs
   • DCorrective and manual; test by inquiry
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a control requiring all employees to use multi-factor authentication (MFA) for remote access. A legacy system used by the finance team does not support MFA, and the system owner requests a permanent waiver from the requirement. The risk manager must decide between granting an exemption or an exception. What is the critical factor that determines the correct classification?

   • AThe criticality of the legacy system to business operations
   • BThe duration of the waiver and whether the system will be upgraded
   • CThe number of users affected by the waiver
   • DThe cost of implementing MFA on the legacy system
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A control tester is documenting evidence that a control was tested. What is the most important characteristic of the evidence collected?

   • AThe evidence is stored in a secure location
   • BThe evidence is in electronic format
   • CThe evidence is collected by the control owner
   • DThe evidence is sufficient and appropriate to support the testing conclusion
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a common outcome of control analysis?

   • AImmediate implementation of corrective actions
   • BGuarantee that the control is effective
   • CIdentification of gaps or weaknesses in control design
   • DElimination of the need for ongoing monitoring
   Reveal Solution Discussion Select an answer first