CRISC Risk Response and Mitigation Practice Test 1 — 15 Questions

Question 1

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Accepted Answer

Deploying network segmentation. Deploying network segmentation (D) reduces the likelihood of a ransomware attack by limiting lateral movement. If an endpoint is compromised, segmentation using VLANs or firewall rules (e.g., 802.1Q, ACLs) prevents the ransomware from spreading to critical systems, thereby reducing the attack surface and the probability of widespread encryption. User awareness training (E) directly reduces likelihood by teaching users to recognize phishing emails and malicious attachments, which are the primary initial vectors for ransomware delivery.

Answer

Installing intrusion detection systems

Answer

Conducting periodic vulnerability scans

Answer

Regularly backing up critical data

Question 2

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 3

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Accepted Answer

Require manual approval for all orders above a threshold. Option D is correct because requiring manual approval for orders above a threshold is a compensating control: it does not fix the vulnerable matching engine code but reduces the likelihood and impact of exploitation by inserting a human review step before high-value transactions are processed. Option E is correct because rate limiting on order submissions is also a compensating control: it constrains how quickly an attacker (or malformed automated traffic) can exercise the vulnerability, limiting abuse without modifying the underlying code. Option A is not a compensating control but a remediation/root-cause fix, since rewriting the engine in a memory-safe language eliminates the vulnerability itself. Option B is not appropriate here because a WAF protects HTTP/application-layer web traffic and cannot meaningfully inspect or block malicious payloads directed at an internal order matching engine's native protocol. Option C is not a compensating control because detailed logging is a detective control that records activity for auditing and forensics; it does not prevent, block, or reduce the impact of exploitation.

Answer

Rewrite the order matching engine in a memory-safe language

Answer

Deploy a Web Application Firewall (WAF) to block malicious payloads

Answer

Enable detailed logging for all order matching transactions

Question 4

Match each risk management process step to its activity.

Accepted Answer

Risk Identification: The process of finding, recognizing, and documenting risks.. The risk management process steps are distinct: Risk Identification finds risks, Risk Assessment evaluates them, and Risk Response addresses them. Common confusions involve swapping these definitions.

Answer

Risk Identification: The process of determining the probability and impact of identified risks.

Answer

Risk Assessment: The process of finding, recognizing, and documenting risks.

Question 5

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

Accepted Answer

Avoid by keeping IT support in-house. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements, which represents a high-severity compliance risk that cannot be effectively mitigated through monitoring alone. Avoiding the risk by keeping IT support in-house eliminates the exposure entirely, making it the best response when the risk level exceeds the organization's risk appetite and cannot be reduced to an acceptable level through other strategies.

Answer

Mitigate by regularly monitoring the provider

Answer

Transfer the risk through the outsourcing contract

Answer

Accept the risk because the provider is cheaper

Question 6

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to sign standard contractual clauses and encrypt all data. Standard Contractual Clauses (SCCs) are a GDPR-approved transfer mechanism that legally binds the vendor to EU data protection standards, even in a weak-law jurisdiction. Combined with encryption of all data at rest and in transit, this provides both a legal and technical safeguard, reducing the risk of non-compliance to an acceptable level without abandoning the vendor.

Answer

Avoid by choosing a vendor in a country with strong data protection laws

Answer

Accept the risk because the vendor offers the best price

Answer

Purchase cyber insurance to cover potential fines

Question 7

Which TWO of the following are valid reasons to accept a risk rather than mitigate it?

Accepted Answer

The risk level is within the risk appetite. Accepting a risk is appropriate when the residual risk level falls within the organization's defined risk appetite. Risk appetite represents the amount of risk the organization is willing to accept in pursuit of its objectives, and risks within that threshold do not require additional mitigation controls. This aligns with the CRISC principle that risk acceptance is a valid response when the risk is within tolerance levels.

Answer

Management is not aware of the risk

Answer

The risk relates to regulatory non-compliance

Answer

The organization wants to avoid the risk entirely

Question 8

Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?

Accepted Answer

SSH protocol version 1.0 on 192.168.1.10. SSH protocol version 1.0 is critically vulnerable to multiple security flaws, including session key recovery and man-in-the-middle attacks, due to weak integrity checks and lack of strong cryptographic algorithms. Unlike the other options, which represent misconfigurations or outdated software that can be mitigated with patches or configuration changes, SSHv1.0 is a deprecated protocol with known, easily exploitable vulnerabilities that directly compromise confidentiality and integrity of administrative access. This makes it the most critical risk to address first, as it exposes the core management interface of the asset.

Answer

RDP with weak encryption on 192.168.1.20

Answer

SMB signing not required on 192.168.1.20

Answer

Apache HTTP Server 2.2.3 on 192.168.1.10

Question 9

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

Accepted Answer

HTTP traffic is permitted from any source to any destination. Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.

Answer

The final rule denies all traffic

Answer

HTTPS traffic is permitted to any destination

Answer

SSH access is only allowed from internal network

Question 10

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 11

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

Accepted Answer

Conduct a tabletop exercise with the updated plan. A tabletop exercise validates the updated incident response plan by simulating a realistic scenario, allowing the response team to practice their roles and identify gaps in the new procedures. This directly addresses the root cause—the plan was outdated and the team failed to execute it correctly—by ensuring the plan is current and the team is familiar with its execution. Without this validation, the updated plan remains untested and the same failure mode could recur.

Answer

Add more detective controls

Answer

Update the risk register

Answer

Increase insurance coverage

Question 12

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 13

An organization assesses a risk of intellectual property theft through email exfiltration. They decide to enforce DLP controls, purchase a cyber liability policy, and officially accept the residual risk after controls. Which THREE risk response options are demonstrated?

Accepted Answer

Mitigate. Enforcing DLP controls directly reduces the likelihood of intellectual property theft by monitoring and blocking unauthorized email exfiltration, which is a classic risk mitigation (reduce) action. Purchasing a cyber liability policy transfers the financial impact of a breach to an insurer, demonstrating risk transfer. Formally accepting the residual risk after controls acknowledges that some risk remains, which is risk acceptance.

Answer

Avoid

Answer

Reduce

Question 14

Refer to the exhibit. Based on the risk register, which risk response is applied to the risk with the highest inherent risk?

Accepted Answer

Transfer. The risk with the highest inherent risk (Risk A, with a score of 25) involves a critical database server lacking encryption at rest. The risk response chosen is 'Transfer,' which is implemented by purchasing a cyber insurance policy that specifically covers data breach costs and regulatory fines. This shifts the financial impact of the risk to the insurer without altering the technical vulnerability or likelihood of the event.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 15

Refer to the exhibit. A risk manager reviews the vulnerability scan output. According to the policy, what is the required risk response?

Accepted Answer

Mitigate by patching or compensating controls. The vulnerability scan output indicates a critical remote code execution vulnerability in the Apache Struts2 framework (CVE-2017-5638). According to policy, the required risk response is to mitigate by patching or implementing compensating controls because the vulnerability has a known exploit and high severity, making acceptance or transfer inappropriate without remediation.

Answer

Accept the risk

Answer

Transfer the risk

Answer

Avoid by disabling the service