CRISC Risk Response and Mitigation Practice Test 2 — 15 Questions

Question 1

GlobalTech Inc., a multinational corporation, is planning to migrate its customer data to a new cloud platform. The migration involves transferring sensitive personally identifiable information (PII) from an on-premises database to a cloud-based CRM. The risk manager conducted a risk assessment and identified several risks, including unauthorized access during transit and residual data exposure due to misconfiguration. Mitigation controls include encryption in transit, encryption at rest, and strict access controls. The residual risk after mitigation is assessed as medium. The risk appetite statement defines that 'No data breach incidents resulting in regulatory fines exceeding $1 million are acceptable.' The estimated potential fine from a breach is $5 million with a likelihood of 2% after controls. The cost of additional controls to reduce likelihood to 0.5% is $500,000. The migrating team proposes to purchase cyber insurance with a $3 million coverage for $200,000 annual premium. The board of directors prefers to accept the residual risk to avoid additional costs. What should the risk manager do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advise the board to avoid the migration until all risks are eliminated.. The residual risk after mitigation still exceeds the risk appetite: the potential fine of $5 million exceeds the $1 million threshold, and neither the proposed insurance (which covers only $3 million and does not reduce the residual risk) nor additional controls (cost $500,000 to reduce likelihood to 0.5%, but the expected loss of $25,000 is still below $1 million? Actually, the expected loss after additional controls would be $5M * 0.5% = $25,000, which is within appetite; however, the board prefers to accept the residual risk, but the risk manager must align with the risk appetite statement. The board's preference conflicts with the risk appetite; therefore, the risk manager should advise avoidance (not migrate until risks are eliminated) as it is the only option that ensures no breach exceeds the $1M fine threshold. Options B and C leave the risk above appetite, and D is costly and may not fully eliminate the risk of a breach exceeding $1M, so avoidance is the most prudent choice.

Answer

Recommend purchasing cyber insurance to transfer the risk.

Answer

Accept the board's decision since the residual risk is medium.

Answer

Recommend implementing additional controls to reduce likelihood to 0.5%.

Question 2

Refer to the exhibit. Given the organization's risk appetite is Low, which risk response is most appropriate?

Accepted Answer

Implement additional monitoring to reduce residual risk to Low.. With a Low risk appetite, the organization requires residual risk to be Low. Option D proposes implementing additional monitoring to reduce the Medium residual risk to Low, which aligns with the risk appetite. This is a corrective response that mitigates the risk without unnecessary business disruption.

Answer

Accept the current residual risk because it is Medium.

Answer

Avoid the risk by discontinuing operations.

Answer

Transfer the risk via insurance.

Question 3

A multinational corporation has recently experienced a significant increase in phishing attacks targeting its employees. The attacks have caused several data breaches, resulting in regulatory fines and reputational damage. The organization has implemented security awareness training for all employees, but the number of successful attacks remains high. Additionally, the organization's risk appetite for cybersecurity incidents is Low. The CRO has asked you to recommend a risk response. You have the following options:

A. Accept the risk because the training has reduced the likelihood, and further controls are too expensive.
B. Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).
C. Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.
D. Avoid the risk by discontinuing the use of email for business communications.

Which course of action is most appropriate given the organization's risk appetite and the current situation?

Accepted Answer

Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.. Implementing technical controls like advanced email filtering (e.g., SPF, DKIM, DMARC validation) and multi-factor authentication (MFA) directly reduces both the likelihood and impact of phishing attacks. Given the organization's low risk appetite for cybersecurity incidents, this risk mitigation approach aligns with the need to lower residual risk to an acceptable level, especially since training alone has proven insufficient.

Answer

Avoid the risk by discontinuing the use of email for business communications.

Answer

Accept the risk because the training has reduced the likelihood, and further controls are too expensive.

Answer

Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).

Question 4

A risk practitioner is reviewing the organization's risk response plan for a critical business process. The plan includes several controls to address identified risks. Which of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing multi-factor authentication for all remote access.. Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk. Redundant data centers and multi-factor authentication are both controls that reduce risk while allowing the business process to continue. Insurance is transference, discontinuing a product is avoidance, and accepting and monitoring is acceptance. Thus, the correct answers are the redundant data center and MFA.

Answer

Deciding to discontinue a product line that poses significant liability risks.

Answer

Accepting the risk and monitoring it without further action.

Answer

Purchasing an insurance policy to cover potential financial losses.

Question 5

A healthcare organization is implementing a new electronic health record (EHR) system. The risk committee has approved a risk treatment plan that includes a requirement for multi-factor authentication (MFA) for all clinical staff. During implementation, the vendor states that MFA is not supported for the emergency department's rapid login workflow. The project manager asks the risk practitioner to recommend the MOST appropriate action.

Accepted Answer

Implement a compensating control such as proximity badges with PIN for the emergency department and document the residual risk.. A compensating control allows the organization to meet the intent of the risk treatment plan while accommodating the emergency department's need for rapid access. Proximity badges with PIN provide two-factor authentication and can be implemented without disrupting patient care. Documenting residual risk ensures that leadership is aware of and accepts any remaining exposure.

Answer

Escalate to the risk committee to accept the risk of not having MFA in the emergency department.

Answer

Document an exception for the emergency department and proceed with the implementation.

Answer

Reject the vendor's limitation and mandate that MFA be enabled for all users, including emergency department staff.

Question 6

A healthcare organization is implementing a new electronic health record (EHR) system. The risk practitioner is identifying controls to mitigate risks related to unauthorized access to patient data. Which TWO of the following are examples of preventive controls? (Choose two.)

Accepted Answer

Role-based access control (RBAC) restricting access to patient records based on job function.. Preventive controls aim to stop unauthorized access before it happens. Role-based access control limits access based on job roles, and encryption protects data confidentiality. Both directly reduce the likelihood of unauthorized access to patient data. Audit logging and incident response are detective and corrective, respectively, while security awareness training is preventive but less directly tied to the technical access controls for EHR data.

Answer

Incident response plan for data breaches.

Answer

Security awareness training for all staff on phishing and data handling.

Answer

Audit logging of all access to patient records with regular review of logs.

Question 7

A multinational bank is designing its risk response for a new online lending platform. The platform will process loan applications and store sensitive customer financial data. The risk committee wants to ensure that risk mitigation controls are both preventive and detective. Which TWO of the following controls BEST meet this requirement? (Choose two.)

Accepted Answer

Encrypting customer financial data at rest using AES-256.. The requirement is for one preventive and one detective control. Encryption at rest is preventive because it protects data confidentiality, while a SIEM with real-time alerts is detective because it identifies incidents as they occur. Together they provide layered mitigation that reduces both likelihood and impact for the online lending platform.

Answer

Requiring annual security awareness training for all employees.

Answer

Conducting a penetration test once every three years.

Answer

Using a web application firewall (WAF) in blocking mode.

Question 8

A risk practitioner is evaluating controls to mitigate the risk of data leakage from employee laptops. Which TWO of the following are examples of preventive controls? (Choose two.)

Accepted Answer

Full disk encryption. Preventive controls aim to stop an incident from occurring. Full disk encryption and DLP software both act to prevent unauthorized access or exfiltration of data, directly reducing the likelihood of data leakage. The other options are detective (log monitoring) or corrective (backups), or administrative (training) and do not directly prevent the event.

Answer

Log monitoring for unauthorized access

Answer

Security awareness training

Answer

Regular data backups

Question 9

A financial services firm is evaluating risk responses for a newly identified risk: the potential failure of a critical third-party payment processor. The risk owner is considering various options. Which TWO of the following are examples of risk mitigation strategies? (Choose two.)

Accepted Answer

Implementing a redundant payment gateway from a different provider to ensure continuity.. Risk mitigation involves taking actions to reduce the likelihood or impact of a risk. In this scenario, implementing a redundant payment gateway reduces the impact of a processor failure by providing an alternative, while conducting regular vulnerability assessments and penetration testing reduces the likelihood of a failure due to security weaknesses. Purchasing insurance is risk transfer, accepting the risk is risk acceptance, and an SLA with penalties is a contractual deterrent rather than a direct mitigation measure. Thus, the two mitigation strategies are the redundant gateway and the vulnerability assessments.

Answer

Deciding to accept the risk because the payment processor has a strong track record.

Answer

Purchasing an insurance policy that covers financial losses from payment processor outages.

Answer

Establishing a service level agreement (SLA) with the payment processor that includes penalties for downtime.

Question 10

A retail company experiences a data breach where customer credit card information is stolen. The risk manager is reviewing the incident response and wants to implement controls to reduce the impact of future breaches. Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Implementing tokenization for credit card data to replace sensitive information with non-sensitive equivalents.. The correct answers are tokenization and security awareness training. Both are mitigation controls because they reduce the likelihood or impact of a data breach. Tokenization minimizes the value of stolen data, while training reduces the chance of successful attacks. These align with CRISC's definition of mitigation as implementing controls to reduce risk.

Answer

Outsourcing payment processing to a third-party provider.

Answer

Accepting the risk because the cost of controls exceeds potential losses.

Answer

Purchasing cyber insurance to cover financial losses from future breaches.

Question 11

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Accepted Answer

Re-evaluate risk treatment options with the risk owner. When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Answer

Escalate directly to the board

Answer

Update the risk register to reflect the residual risk

Answer

Accept the residual risk

Question 12

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Accepted Answer

Risk reduction by implementing redundant systems. Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Answer

Risk avoidance by decommissioning the system

Answer

Risk transfer through cyber insurance

Answer

Risk acceptance because mitigation is too costly

Question 13

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Accepted Answer

Risk transfer. Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Answer

Risk reduction

Answer

Risk acceptance

Answer

Risk avoidance

Question 14

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Accepted Answer

Communicate the risk exposure to senior management. The risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 15

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness. Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates