CRISC Risk Response and Mitigation — 40 Questions

Question 1

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Accepted Answer

Re-evaluate risk treatment options with the risk owner. When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Answer

Escalate directly to the board

Answer

Update the risk register to reflect the residual risk

Answer

Accept the residual risk

Question 2

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Accepted Answer

Risk reduction by implementing redundant systems. Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Answer

Risk avoidance by decommissioning the system

Answer

Risk transfer through cyber insurance

Answer

Risk acceptance because mitigation is too costly

Question 3

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Accepted Answer

Risk transfer. Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Answer

Risk reduction

Answer

Risk acceptance

Answer

Risk avoidance

Question 4

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Accepted Answer

Communicate the risk exposure to senior management. Option C is correct because the risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 5

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended. Option A is indirect. Option C does not verify effectiveness. Option D is too broad.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 6

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Accepted Answer

Deploying network segmentation. Deploying network segmentation (D) reduces the likelihood of a ransomware attack by limiting lateral movement. If an endpoint is compromised, segmentation using VLANs or firewall rules (e.g., 802.1Q, ACLs) prevents the ransomware from spreading to critical systems, thereby reducing the attack surface and the probability of widespread encryption. User awareness training (E) directly reduces likelihood by teaching users to recognize phishing emails and malicious attachments, which are the primary initial vectors for ransomware delivery.

Answer

Installing intrusion detection systems

Answer

Conducting periodic vulnerability scans

Answer

Regularly backing up critical data

Question 7

Which THREE of the following are key components of an effective risk treatment plan?

Accepted Answer

Assigned responsibilities. Assigned responsibilities are a key component of an effective risk treatment plan because they ensure accountability for implementing specific risk mitigation actions. Without clear ownership, tasks may be delayed or overlooked, undermining the plan's execution. This aligns with the CRISC framework's emphasis on defining roles to operationalize risk response.

Answer

The risk owner's signature

Answer

A detailed budget

Question 8

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Option A is correct because permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 9

You are a risk practitioner at a financial institution that is migrating its core banking system to a cloud provider. The migration plan includes a phased approach, with the first phase moving non-critical applications. However, during the second phase (moving customer-facing applications), the cloud provider experiences a major outage that lasts 6 hours. The outage was caused by a misconfiguration in the provider's network. The institution had conducted a risk assessment and identified cloud provider downtime as a risk, but the treatment plan only included a service level agreement (SLA) with financial penalties. The SLA does not cover the reputational damage and loss of customer trust. The risk register shows that the residual risk level was marked as 'low' before the incident. After the incident, senior management is demanding a review. Which of the following is the MOST appropriate action for the risk practitioner to take?

Accepted Answer

Reassess the risk and recommend implementing a multi-cloud architecture for critical applications. Option D is correct because the incident revealed that the existing risk treatment (SLA financial penalties) was insufficient to address the actual impact (reputational damage and loss of customer trust). The risk practitioner must reassess the risk with the new information and recommend a more robust mitigation strategy, such as multi-cloud architecture, to reduce the likelihood or impact of a single provider's outage affecting critical customer-facing applications.

Answer

Negotiate a higher penalty in the SLA

Answer

Initiate a legal claim against the provider

Answer

Update the risk register to reflect the incident and accept the residual risk

Question 10

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Accepted Answer

Require manual approval for all orders above a threshold. Option D is correct because requiring manual approval for orders above a threshold directly reduces the impact of a successful exploit by preventing large-scale financial loss, even if the underlying code vulnerability remains unpatched. This compensating control shifts the risk acceptance decision to a human operator, effectively adding a business logic layer that can catch anomalous or malicious order matching attempts. Option E is correct because rate limiting on order submissions mitigates the risk of an attacker exploiting the vulnerability to submit a high volume of malicious orders, thereby limiting the blast radius and preventing denial-of-service or market manipulation scenarios.

Answer

Rewrite the order matching engine in a memory-safe language

Answer

Deploy a Web Application Firewall (WAF) to block malicious payloads

Answer

Enable detailed logging for all order matching transactions

Question 11

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Accepted Answer

Accept the risk and continue monitoring. R-0042 is a low-likelihood, low-impact risk involving PII stored with AES-256 encryption and strict access controls. The residual risk is within the organization's risk appetite, making acceptance with continued monitoring the most appropriate response. Mitigation, transfer, or avoidance would introduce unnecessary cost or operational disruption for a risk already well-controlled.

Answer

Mitigate the risk by implementing additional encryption controls

Answer

Transfer the risk to a third-party insurer

Answer

Avoid the risk by discontinuing storage of PII

Question 12

A global manufacturing company is implementing a new ERP system across multiple regions. The project manager has identified a risk that data migration from legacy systems may cause data corruption, leading to production delays. The risk owner proposes conducting a full data reconciliation after migration. However, the IT director argues that this would be too time-consuming and suggests only sampling data for verification. The risk manager must decide on the risk response. The project timeline is tight, and the company has a low tolerance for data integrity issues. Which of the following is the BEST course of action?

Accepted Answer

Implement the full data reconciliation as proposed by the risk owner. Full data reconciliation is the correct risk response because the company has a low tolerance for data integrity issues and the risk of data corruption could cause production delays. While time-consuming, this approach directly mitigates the identified risk by ensuring all migrated data is verified, aligning with the risk appetite. Sampling would leave a margin of error unacceptable for a low-tolerance environment, and the other options either fail to address the risk or are impractical.

Answer

Accept the risk and proceed with data sampling to save time

Answer

Avoid the risk by postponing the ERP implementation

Answer

Transfer the risk by purchasing insurance for data corruption

Question 13

Order the steps for implementing a risk treatment plan.

Question 14

Sequence the steps for implementing a new control based on risk assessment findings.

Question 15

Put the steps for performing a control self-assessment (CSA) in order.

Question 16

Match each risk response strategy to its definition.

Question 17

Match each risk management term to its definition.

Question 18

Match each risk management process step to its activity.

Question 19

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

Accepted Answer

Acceptance. Option B is correct because acceptance is the appropriate response when the risk is low impact and cannot be mitigated or transferred easily. Option A is wrong because avoidance would mean decommissioning the application which is not necessary. Option C is wrong because transfer would require insurance or outsourcing which is not cost-effective. Option D is wrong because mitigation would involve patching which is not possible.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation

Question 20

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Accepted Answer

Escalate to senior management. Option C is correct because the first step is to escalate to senior management as residual risk exceeding appetite requires their approval. Option A is wrong because updating the risk register does not address the issue. Option B is wrong because increasing controls may not be feasible. Option D is wrong because reducing appetite without addressing risk is not appropriate.

Answer

Update the risk register

Answer

Implement additional controls

Answer

Reduce the risk appetite