CGRC Security Control Assessment Quiz

1. What is the primary purpose of control monitoring?

To reduce organizational expenses

To ensure controls continue operating effectively

To eliminate all security incidents

To replace manual processes with automation

2. What should be done when control assessment reveals significant gaps?

Ignore them and continue operations

Develop a remediation plan and monitor progress

Immediately shut down the affected system

Report only to external auditors

3. Which stakeholder is typically responsible for control assessment?

External customers

Internal audit or risk management function

Marketing department

IT help desk only

4. What is the difference between control testing and control monitoring?

Testing is one-time; monitoring is ongoing

Monitoring is performed by auditors only

Testing eliminates the need for monitoring

They are synonymous terms

5. How should control assessment results be documented?

Informally in emails

Formally with evidence and findings

Only if deficiencies are found

In the annual financial report only

6. What is compensating control in risk management?

A control that replaces a primary control when it fails

A control that increases operational efficiency

A control that reduces the cost of compliance

A control that is temporary and always in place

7. Which assessment approach involves examining documentation and records?

Observation only

Inquiry and inspection

System penetration testing

Employee surveys

8. What is a control deficiency?

A control that costs too much to maintain

A control that is not designed or operating effectively

A control that is outdated technology

A control that requires excessive documentation

9. Which framework provides guidance on control objectives and implementation?

NIST Cybersecurity Framework

ISO/IEC 27001

COBIT

All of the above

10. In control assessment, what does 'operating effectiveness' mean?

The control is cost-efficient

The control operates as designed and achieves its objective

The control is the newest technology available

The control reduces IT staff requirements

11. What is the primary objective of security control assessment?

Determine if controls are designed and operating effectively

Identify the cost of implementing new controls

Replace all existing security systems

Reduce the number of security policies

12. How often should operational controls typically be assessed?

Once every five years

During annual audit only

Continuously or at regular intervals

Only when a breach occurs

13. What is a control gap in the context of assessment?

A delay between control implementation and testing

A difference between required and existing controls

The time between risk identification and response

A gap in the organization's security budget

14. Which of the following is a characteristic of an effective control?

It operates without human involvement

It prevents all possible incidents

It is measurable and provides evidence of operation

It eliminates the need for risk management

15. What is the relationship between risk and control assessment?

Risk assessment is unrelated to control assessment

Controls are assessed based on identified risks

Risk assessment eliminates the need for controls

Controls determine the organization's risk tolerance

16. In control assessment, what does 'design testing' evaluate?

Whether the control is actually executed daily

If the control is designed to address the risk

The financial cost of implementation

Employee compliance rates

17. Which metric is used to measure control effectiveness?

Control Effectiveness Rating (CER)

Return on Investment (ROI)

Mean Time to Repair (MTTR)

Network bandwidth utilization

18. What is a key difference between preventive and detective controls?

Preventive controls stop incidents; detective controls identify them

Detective controls are always more effective

Preventive controls cost less to maintain

Detective controls eliminate all risk

19. Control assessment typically occurs at which stage(s) of the control lifecycle?

Design phase only

Implementation and operation

At retirement only

During budget review

20. Which assessment method involves testing controls in a live production environment?

Design review

Testing in isolation

Operational testing

Theoretical analysis