CRISC Risk Response and Mitigation — 10 Questions

Question 1

Which TWO of the following are examples of risk transfer? (Select TWO.)

Accepted Answer

Outsourcing IT operations to a third party. Outsourcing IT operations to a third party transfers the operational risk and associated liabilities to the external provider via a contractual agreement. The third party assumes responsibility for managing and securing the IT infrastructure, shifting the financial and reputational impact of failures or breaches away from the organization. This is a classic risk transfer mechanism, distinct from risk mitigation or acceptance.

Answer

Implementing encryption

Answer

Accepting residual risk

Answer

Conducting security training

Question 2

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Accepted Answer

Risk of data exposure; apply a deny rule to restrict access. The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.

Answer

Risk of cost; set a budget alert

Answer

Risk of availability; implement backup

Answer

No risk; the policy is standard

Question 3

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Accepted Answer

Re-evaluate risk treatment options with the risk owner. When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Answer

Escalate directly to the board

Answer

Update the risk register to reflect the residual risk

Answer

Accept the residual risk

Question 4

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Accepted Answer

Risk reduction by implementing redundant systems. Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Answer

Risk avoidance by decommissioning the system

Answer

Risk transfer through cyber insurance

Answer

Risk acceptance because mitigation is too costly

Question 5

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Accepted Answer

Risk transfer. Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Answer

Risk reduction

Answer

Risk acceptance

Answer

Risk avoidance

Question 6

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Accepted Answer

Communicate the risk exposure to senior management. The risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 7

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness. Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 8

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Accepted Answer

Deploying network segmentation. Deploying network segmentation (D) reduces the likelihood of a ransomware attack by limiting lateral movement. If an endpoint is compromised, segmentation using VLANs or firewall rules (e.g., 802.1Q, ACLs) prevents the ransomware from spreading to critical systems, thereby reducing the attack surface and the probability of widespread encryption. User awareness training (E) directly reduces likelihood by teaching users to recognize phishing emails and malicious attachments, which are the primary initial vectors for ransomware delivery.

Answer

Installing intrusion detection systems

Answer

Conducting periodic vulnerability scans

Answer

Regularly backing up critical data

Question 9

Which THREE of the following are key components of an effective risk treatment plan?

Accepted Answer

Assigned responsibilities. Assigned responsibilities are a key component of an effective risk treatment plan because they ensure accountability for implementing specific risk mitigation actions. Without clear ownership, tasks may be delayed or overlooked, undermining the plan's execution. This aligns with the CRISC framework's emphasis on defining roles to operationalize risk response.

Answer

The risk owner's signature

Answer

A detailed budget

Question 10

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet