CRISC Risk Response and Mitigation — 30 Questions

Question 1

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Accepted Answer

Deploying network segmentation. Deploying network segmentation (D) reduces the likelihood of a ransomware attack by limiting lateral movement. If an endpoint is compromised, segmentation using VLANs or firewall rules (e.g., 802.1Q, ACLs) prevents the ransomware from spreading to critical systems, thereby reducing the attack surface and the probability of widespread encryption. User awareness training (E) directly reduces likelihood by teaching users to recognize phishing emails and malicious attachments, which are the primary initial vectors for ransomware delivery.

Answer

Installing intrusion detection systems

Answer

Conducting periodic vulnerability scans

Answer

Regularly backing up critical data

Question 2

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 3

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Accepted Answer

Require manual approval for all orders above a threshold. Option D is correct because requiring manual approval for orders above a threshold is a compensating control: it does not fix the vulnerable matching engine code but reduces the likelihood and impact of exploitation by inserting a human review step before high-value transactions are processed. Option E is correct because rate limiting on order submissions is also a compensating control: it constrains how quickly an attacker (or malformed automated traffic) can exercise the vulnerability, limiting abuse without modifying the underlying code. Option A is not a compensating control but a remediation/root-cause fix, since rewriting the engine in a memory-safe language eliminates the vulnerability itself. Option B is not appropriate here because a WAF protects HTTP/application-layer web traffic and cannot meaningfully inspect or block malicious payloads directed at an internal order matching engine's native protocol. Option C is not a compensating control because detailed logging is a detective control that records activity for auditing and forensics; it does not prevent, block, or reduce the impact of exploitation.

Answer

Rewrite the order matching engine in a memory-safe language

Answer

Deploy a Web Application Firewall (WAF) to block malicious payloads

Answer

Enable detailed logging for all order matching transactions

Question 4

Match each risk management process step to its activity.

Accepted Answer

Risk Identification: The process of finding, recognizing, and documenting risks.. The risk management process steps are distinct: Risk Identification finds risks, Risk Assessment evaluates them, and Risk Response addresses them. Common confusions involve swapping these definitions.

Answer

Risk Identification: The process of determining the probability and impact of identified risks.

Answer

Risk Assessment: The process of finding, recognizing, and documenting risks.

Question 5

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

Accepted Answer

Avoid by keeping IT support in-house. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements, which represents a high-severity compliance risk that cannot be effectively mitigated through monitoring alone. Avoiding the risk by keeping IT support in-house eliminates the exposure entirely, making it the best response when the risk level exceeds the organization's risk appetite and cannot be reduced to an acceptable level through other strategies.

Answer

Mitigate by regularly monitoring the provider

Answer

Transfer the risk through the outsourcing contract

Answer

Accept the risk because the provider is cheaper

Question 6

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to sign standard contractual clauses and encrypt all data. Standard Contractual Clauses (SCCs) are a GDPR-approved transfer mechanism that legally binds the vendor to EU data protection standards, even in a weak-law jurisdiction. Combined with encryption of all data at rest and in transit, this provides both a legal and technical safeguard, reducing the risk of non-compliance to an acceptable level without abandoning the vendor.

Answer

Avoid by choosing a vendor in a country with strong data protection laws

Answer

Accept the risk because the vendor offers the best price

Answer

Purchase cyber insurance to cover potential fines

Question 7

Which TWO of the following are valid reasons to accept a risk rather than mitigate it?

Accepted Answer

The risk level is within the risk appetite. Accepting a risk is appropriate when the residual risk level falls within the organization's defined risk appetite. Risk appetite represents the amount of risk the organization is willing to accept in pursuit of its objectives, and risks within that threshold do not require additional mitigation controls. This aligns with the CRISC principle that risk acceptance is a valid response when the risk is within tolerance levels.

Answer

Management is not aware of the risk

Answer

The risk relates to regulatory non-compliance

Answer

The organization wants to avoid the risk entirely

Question 8

Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?

Accepted Answer

SSH protocol version 1.0 on 192.168.1.10. SSH protocol version 1.0 is critically vulnerable to multiple security flaws, including session key recovery and man-in-the-middle attacks, due to weak integrity checks and lack of strong cryptographic algorithms. Unlike the other options, which represent misconfigurations or outdated software that can be mitigated with patches or configuration changes, SSHv1.0 is a deprecated protocol with known, easily exploitable vulnerabilities that directly compromise confidentiality and integrity of administrative access. This makes it the most critical risk to address first, as it exposes the core management interface of the asset.

Answer

RDP with weak encryption on 192.168.1.20

Answer

SMB signing not required on 192.168.1.20

Answer

Apache HTTP Server 2.2.3 on 192.168.1.10

Question 9

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

Accepted Answer

HTTP traffic is permitted from any source to any destination. Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.

Answer

The final rule denies all traffic

Answer

HTTPS traffic is permitted to any destination

Answer

SSH access is only allowed from internal network

Question 10

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 11

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

Accepted Answer

Conduct a tabletop exercise with the updated plan. A tabletop exercise validates the updated incident response plan by simulating a realistic scenario, allowing the response team to practice their roles and identify gaps in the new procedures. This directly addresses the root cause—the plan was outdated and the team failed to execute it correctly—by ensuring the plan is current and the team is familiar with its execution. Without this validation, the updated plan remains untested and the same failure mode could recur.

Answer

Add more detective controls

Answer

Update the risk register

Answer

Increase insurance coverage

Question 12

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 13

An organization assesses a risk of intellectual property theft through email exfiltration. They decide to enforce DLP controls, purchase a cyber liability policy, and officially accept the residual risk after controls. Which THREE risk response options are demonstrated?

Accepted Answer

Mitigate. Enforcing DLP controls directly reduces the likelihood of intellectual property theft by monitoring and blocking unauthorized email exfiltration, which is a classic risk mitigation (reduce) action. Purchasing a cyber liability policy transfers the financial impact of a breach to an insurer, demonstrating risk transfer. Formally accepting the residual risk after controls acknowledges that some risk remains, which is risk acceptance.

Answer

Avoid

Answer

Reduce

Question 14

Refer to the exhibit. Based on the risk register, which risk response is applied to the risk with the highest inherent risk?

Accepted Answer

Transfer. The risk with the highest inherent risk (Risk A, with a score of 25) involves a critical database server lacking encryption at rest. The risk response chosen is 'Transfer,' which is implemented by purchasing a cyber insurance policy that specifically covers data breach costs and regulatory fines. This shifts the financial impact of the risk to the insurer without altering the technical vulnerability or likelihood of the event.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 15

Refer to the exhibit. A risk manager reviews the vulnerability scan output. According to the policy, what is the required risk response?

Accepted Answer

Mitigate by patching or compensating controls. The vulnerability scan output indicates a critical remote code execution vulnerability in the Apache Struts2 framework (CVE-2017-5638). According to policy, the required risk response is to mitigate by patching or implementing compensating controls because the vulnerability has a known exploit and high severity, making acceptance or transfer inappropriate without remediation.

Answer

Accept the risk

Answer

Transfer the risk

Answer

Avoid by disabling the service

Question 16

GlobalTech Inc., a multinational corporation, is planning to migrate its customer data to a new cloud platform. The migration involves transferring sensitive personally identifiable information (PII) from an on-premises database to a cloud-based CRM. The risk manager conducted a risk assessment and identified several risks, including unauthorized access during transit and residual data exposure due to misconfiguration. Mitigation controls include encryption in transit, encryption at rest, and strict access controls. The residual risk after mitigation is assessed as medium. The risk appetite statement defines that 'No data breach incidents resulting in regulatory fines exceeding $1 million are acceptable.' The estimated potential fine from a breach is $5 million with a likelihood of 2% after controls. The cost of additional controls to reduce likelihood to 0.5% is $500,000. The migrating team proposes to purchase cyber insurance with a $3 million coverage for $200,000 annual premium. The board of directors prefers to accept the residual risk to avoid additional costs. What should the risk manager do?

Accepted Answer

Advise the board to avoid the migration until all risks are eliminated.. The residual risk after mitigation still exceeds the risk appetite: the potential fine of $5 million exceeds the $1 million threshold, and neither the proposed insurance (which covers only $3 million and does not reduce the residual risk) nor additional controls (cost $500,000 to reduce likelihood to 0.5%, but the expected loss of $25,000 is still below $1 million? Actually, the expected loss after additional controls would be $5M * 0.5% = $25,000, which is within appetite; however, the board prefers to accept the residual risk, but the risk manager must align with the risk appetite statement. The board's preference conflicts with the risk appetite; therefore, the risk manager should advise avoidance (not migrate until risks are eliminated) as it is the only option that ensures no breach exceeds the $1M fine threshold. Options B and C leave the risk above appetite, and D is costly and may not fully eliminate the risk of a breach exceeding $1M, so avoidance is the most prudent choice.

Answer

Recommend purchasing cyber insurance to transfer the risk.

Answer

Accept the board's decision since the residual risk is medium.

Answer

Recommend implementing additional controls to reduce likelihood to 0.5%.

Question 17

Refer to the exhibit. Given the organization's risk appetite is Low, which risk response is most appropriate?

Accepted Answer

Implement additional monitoring to reduce residual risk to Low.. With a Low risk appetite, the organization requires residual risk to be Low. Option D proposes implementing additional monitoring to reduce the Medium residual risk to Low, which aligns with the risk appetite. This is a corrective response that mitigates the risk without unnecessary business disruption.

Answer

Accept the current residual risk because it is Medium.

Answer

Avoid the risk by discontinuing operations.

Answer

Transfer the risk via insurance.

Question 18

A multinational corporation has recently experienced a significant increase in phishing attacks targeting its employees. The attacks have caused several data breaches, resulting in regulatory fines and reputational damage. The organization has implemented security awareness training for all employees, but the number of successful attacks remains high. Additionally, the organization's risk appetite for cybersecurity incidents is Low. The CRO has asked you to recommend a risk response. You have the following options:

A. Accept the risk because the training has reduced the likelihood, and further controls are too expensive.
B. Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).
C. Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.
D. Avoid the risk by discontinuing the use of email for business communications.

Which course of action is most appropriate given the organization's risk appetite and the current situation?

Accepted Answer

Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.. Implementing technical controls like advanced email filtering (e.g., SPF, DKIM, DMARC validation) and multi-factor authentication (MFA) directly reduces both the likelihood and impact of phishing attacks. Given the organization's low risk appetite for cybersecurity incidents, this risk mitigation approach aligns with the need to lower residual risk to an acceptable level, especially since training alone has proven insufficient.

Answer

Avoid the risk by discontinuing the use of email for business communications.

Answer

Accept the risk because the training has reduced the likelihood, and further controls are too expensive.

Answer

Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).

Question 19

A risk practitioner is reviewing the organization's risk response plan for a critical business process. The plan includes several controls to address identified risks. Which of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing multi-factor authentication for all remote access.. Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk. Redundant data centers and multi-factor authentication are both controls that reduce risk while allowing the business process to continue. Insurance is transference, discontinuing a product is avoidance, and accepting and monitoring is acceptance. Thus, the correct answers are the redundant data center and MFA.

Answer

Deciding to discontinue a product line that poses significant liability risks.

Answer

Accepting the risk and monitoring it without further action.

Answer

Purchasing an insurance policy to cover potential financial losses.

Question 20

A healthcare organization is implementing a new electronic health record (EHR) system. The risk committee has approved a risk treatment plan that includes a requirement for multi-factor authentication (MFA) for all clinical staff. During implementation, the vendor states that MFA is not supported for the emergency department's rapid login workflow. The project manager asks the risk practitioner to recommend the MOST appropriate action.

Accepted Answer

Implement a compensating control such as proximity badges with PIN for the emergency department and document the residual risk.. A compensating control allows the organization to meet the intent of the risk treatment plan while accommodating the emergency department's need for rapid access. Proximity badges with PIN provide two-factor authentication and can be implemented without disrupting patient care. Documenting residual risk ensures that leadership is aware of and accepts any remaining exposure.

Answer

Escalate to the risk committee to accept the risk of not having MFA in the emergency department.

Answer

Document an exception for the emergency department and proceed with the implementation.

Answer

Reject the vendor's limitation and mandate that MFA be enabled for all users, including emergency department staff.