CGRC Continuous Monitoring Strategy Quiz

1. What is the relationship between continuous monitoring and incident response?

Continuous monitoring detects issues that trigger incident response

They serve completely separate functions

Incident response eliminates the need for monitoring

They only apply to external threats

2. Which outcome best demonstrates a mature continuous monitoring program?

Rapid detection and remediation of issues with measurable risk reduction

Elimination of all security incidents

Reduction of all compliance audits

Complete automation requiring no human oversight

3. What is the role of dashboards in continuous monitoring programs?

Visualizing key metrics and control status for stakeholders

Replacing detailed technical documentation

Eliminating the need for risk assessments

Simplifying organizational governance structures

4. How does continuous monitoring support compliance reporting?

By providing real-time evidence of control effectiveness and compliance status

By eliminating the need for documented policies

By reducing audit frequency

By replacing external auditors

5. In continuous monitoring, what does 'tuning' refer to?

Adjusting detection rules and thresholds to reduce false positives

Replacing all monitoring systems

Eliminating security controls

Conducting annual training sessions

6. Which of the following is a challenge in implementing continuous monitoring?

Managing large volumes of data and maintaining alert accuracy

Lack of available technology

Excessive simplicity of the process

Absence of regulatory requirements

7. How should continuous monitoring address third-party or vendor risks?

By monitoring vendor systems and compliance with contractual obligations

By ignoring external vendor activities

By only reviewing vendor contracts annually

By eliminating all vendor relationships

8. What is the purpose of establishing KPIs in continuous monitoring?

To measure control performance and identify trends

To eliminate all organizational risks

To reduce IT staffing requirements

To simplify compliance documentation

9. Which governance framework typically incorporates continuous monitoring?

NIST, ISO 27001, and COBIT

Only ISO 9001

Only annual audit standards

Marketing best practices

10. In continuous monitoring, what does 'control testing' validate?

Whether security controls are functioning as intended

Only the existence of documented policies

Employee compliance with email policies

Vendor pricing agreements

11. What is the primary objective of continuous monitoring in a governance framework?

To detect and respond to risks and compliance violations in real time

To eliminate all organizational risk

To replace traditional annual audits entirely

To reduce IT infrastructure costs

12. Which data source is typically used in continuous monitoring?

System logs, network traffic, and configuration files

Annual risk assessments only

Vendor marketing materials

Employee satisfaction surveys

13. What is a key benefit of implementing continuous monitoring?

Faster detection and remediation of security issues

Elimination of all compliance violations

Reduction of all operational costs

Guaranteed prevention of all breaches

14. How does continuous monitoring differ from traditional periodic assessments?

It provides ongoing visibility versus snapshot-in-time reviews

It is less thorough than annual audits

It eliminates the need for governance policies

It focuses only on external compliance requirements

15. In the context of continuous monitoring, what is 'anomaly detection'?

Identifying unusual patterns or deviations from normal behavior

Detecting only external cyber attacks

Finding errors in compliance documentation

Monitoring employee attendance records

16. Which of the following best describes risk-based continuous monitoring?

Monitoring all systems with equal intensity

Focusing monitoring efforts on high-risk assets and processes

Monitoring only financial systems

Monitoring external threats exclusively

17. What role do automated tools play in continuous monitoring?

They eliminate the need for human judgment

They enable real-time data collection, analysis, and alerting

They replace compliance frameworks

They reduce the need for security policies

18. Which monitoring metric best indicates control effectiveness?

Number of vulnerabilities identified

Percentage of controls operating within defined parameters

Total IT budget spent on security

Frequency of security training sessions

19. In continuous monitoring, what does 'baselining' refer to?

Establishing a standard state against which changes are measured

Creating audit trails for all system activities

Implementing security patches monthly

Documenting all vendor relationships

20. Which of the following is a key component of a continuous monitoring program?

Automated data collection and analysis

Monthly executive briefings only

Quarterly risk assessments

Annual compliance certifications