Exam CRISC topic 1 question 484 discussion

The answer should be C. Compensating Controls.

Selected Answer: C mitigating controls are meant to reduce the chances of a threat happening while Compensating controls are put into place when specific requirements for compliance can't be met with existing controls.

C. compensating controls are in place Compensating controls refer to measures put in place to provide an equivalent level of control when primary controls are deemed ineffective or can't be implemented. If these compensating controls are present, the overall control environment may still be considered effective despite the shortcomings of certain controls. While accepting residual risk, having a control mitigation plan, or having effective risk management might be part of a larger risk management strategy, none of them inherently ensure an effective control environment when existing controls are found to be inadequate. Instead, they represent different aspects or steps within the risk management process.

should be C

Agree.

A compensating control mitigates further damages if the preventive controls are not feasible.

I would go for C. Compensating Controls

none of them. compensating controls should be in place and work effectively as well

C is the best answer. A compensating control mitigates further damages if the preventive controls are not feasible. A. a control mitigation plan is in place B. residual risk is accepted C. compensating controls are in place D. risk management is effective

Remember A is Control mitigation plan and not Risk mitigation plan is in place. And that might help in a situation where the existing controls are ineffective.

Support C

I agree with C, compensating controls also mitigate the same risk

Pls read the question again, it says "have been found to be ineffective", so could have been configured/implemented weakly hence mitigation of the control would make it effective again. For example a behavior monitoring system which is not set to alert properly now the mitigation is to set up/configure to throw right set of alerts

Since the question contains "credit cards" and "industry standards" then your reference is PCI-DSS. In this scenario your QSA wants to see compensating controls. Which supports C as the correct answer. Besides, how can the overall control environment still be "effective" if only a "plan" is in place?

Answer B

I think the answer should be B - as if the residual risk is not accepted then they have to address that first.