Control Design and Implementation CRISC Practice Questions (Page 9)

Questions 41–42

1. 41expert · hard

   A company is designing a control to mitigate the risk of data exfiltration from its cloud storage. The risk appetite is low, but the business requires rapid data sharing with external partners. The control must balance security with operational efficiency. Which control design is most appropriate?

   • AImplement a DLP solution that allows external sharing but flags and reviews suspicious activity, with automated alerts for high-risk patterns
   • BImplement a control that requires all external sharing to be done through a manual process with no automation
   • CImplement a control that only logs all external sharing without any review
   • DImplement a strict data loss prevention (DLP) solution that blocks all external sharing and requires manual approval for each request
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company has a control that requires all financial transactions above $5,000 to be approved by a manager. During a review, the risk team finds that the control is being applied inconsistently: some transactions are approved by a supervisor, not a manager. What is the most appropriate analysis of this situation?

   • AThe control has a design gap because the approval authority is not clearly defined
   • BThe control is operating effectively because supervisors have the same authority
   • CThe control is effective because approvals are still being obtained
   • DThe control is a detective control and does not require consistency
   Reveal Solution Discussion Select an answer first