CRISC Risk Response and Mitigation Practice Test 2 — 15 Questions

Question 1

Match each risk response strategy to its definition.

Question 2

Match each risk management term to its definition.

Question 3

Match each risk management process step to its activity.

Question 4

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

Accepted Answer

Acceptance. Option B is correct because acceptance is the appropriate response when the risk is low impact and cannot be mitigated or transferred easily. Option A is wrong because avoidance would mean decommissioning the application which is not necessary. Option C is wrong because transfer would require insurance or outsourcing which is not cost-effective. Option D is wrong because mitigation would involve patching which is not possible.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation

Question 5

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Accepted Answer

Escalate to senior management. Option C is correct because the first step is to escalate to senior management as residual risk exceeding appetite requires their approval. Option A is wrong because updating the risk register does not address the issue. Option B is wrong because increasing controls may not be feasible. Option D is wrong because reducing appetite without addressing risk is not appropriate.

Answer

Update the risk register

Answer

Implement additional controls

Answer

Reduce the risk appetite

Question 6

An organization's security team recommends implementing a web application firewall (WAF) to protect against SQL injection attacks. The risk manager evaluates the cost of the WAF and the likelihood of a successful attack. This evaluation is BEST described as:

Accepted Answer

Cost-benefit analysis. Option D is correct because cost-benefit analysis compares the cost of controls against the expected loss. Option A is wrong because risk acceptance is a decision. Option B is wrong because residual risk exists after controls. Option C is wrong because inherent risk is before controls.

Answer

Residual risk calculation

Answer

Inherent risk assessment

Answer

Risk acceptance

Question 7

A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?

Accepted Answer

Include security requirements in the contract and perform regular vendor audits. Option A is correct because contractually requiring the vendor to adhere to security standards and performing audits is a common risk mitigation approach. Option B is wrong as transferring via insurance doesn't reduce the actual risk. Option C is wrong as avoidance by not using the system may be too drastic. Option D is wrong as denial is not a risk response.

Answer

Deny the existence of the risk

Answer

Purchase cyber insurance to cover potential losses

Answer

Avoid using the cloud CRM system

Question 8

A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?

Accepted Answer

Risk mitigation. Option C is correct because mitigation involves reducing risk through controls like redundancy. Option A is wrong because avoidance would mean moving the primary data center. Option B is wrong because transfer would involve insurance. Option D is wrong because acceptance would mean doing nothing.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 9

After implementing a set of controls, the risk owner calculates the residual risk and finds it is still above the risk tolerance. However, the cost to further reduce the risk exceeds the potential loss. What is the MOST appropriate next step?

Accepted Answer

Formally accept the residual risk. Option B is correct because when additional mitigation is cost-prohibitive, acceptance with formal sign-off is appropriate. Option A is wrong as implementing further controls is not cost-effective. Option C is wrong because reducing controls would increase risk. Option D is wrong because re-assessing inherent risk doesn't change the situation.

Answer

Re-assess the inherent risk

Answer

Reduce current controls to lower costs

Answer

Implement additional controls despite the cost

Question 10

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

Accepted Answer

Avoid by keeping IT support in-house. Option D is correct because the most effective response is to avoid by not outsourcing if compliance cannot be ensured. Option A is wrong because transferring via contract may not be sufficient. Option B is wrong because mitigation through monitoring may not ensure compliance. Option C is wrong because acceptance is not appropriate when regulatory non-compliance is possible.

Answer

Mitigate by regularly monitoring the provider

Answer

Transfer the risk through the outsourcing contract

Answer

Accept the risk because the provider is cheaper

Question 11

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

Accepted Answer

Tune the system to reduce false positives. Option C is correct because tuning the system reduces false positives, improving effectiveness. Option A is wrong as removal would leave the bank exposed. Option B is wrong as hiring more analysts does not fix the root cause. Option D is wrong as ignoring false positives would increase risk.

Answer

Accept the false positives as a cost of doing business

Answer

Remove the monitoring system to focus on other controls

Answer

Hire additional analysts to review all alerts

Question 12

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to sign standard contractual clauses and encrypt all data. Option A is correct because GDPR requires adequate safeguards; contractual clauses and data encryption can mitigate the risk. Option B is wrong as insurance does not cover regulatory fines. Option C is wrong as acceptance may lead to non-compliance. Option D is wrong as avoidance may not be practical if the vendor is the best option.

Answer

Avoid by choosing a vendor in a country with strong data protection laws

Answer

Accept the risk because the vendor offers the best price

Answer

Purchase cyber insurance to cover potential fines

Question 13

Which TWO of the following are examples of risk mitigation controls?

Accepted Answer

Implementing a firewall. Option A and D are correct. A firewall is a preventive control to mitigate network threats. Encryption protects data. Option B is wrong because insurance is a risk transfer. Option C is wrong because accepting risk is not mitigation. Option E is wrong because avoiding risk means not engaging in the activity.

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Answer

Discontinuing a high-risk service

Question 14

Which THREE of the following are key considerations when selecting a risk response option?

Accepted Answer

Cost-benefit analysis of controls. Options A, C, and D are correct. Risk appetite determines acceptable level. Cost of control vs benefit is essential. Regulatory requirements cannot be ignored. Option B is wrong because current controls are not a selection criterion but part of assessment. Option E is wrong because impact without likelihood gives incomplete view.

Answer

Impact of the risk without controls

Answer

Current control effectiveness

Question 15

Which TWO of the following are valid reasons to accept a risk rather than mitigate it?

Accepted Answer

The risk level is within the risk appetite. Options A and E are correct. If mitigation cost exceeds potential loss, acceptance is cost-effective. If risk is within appetite, acceptance is appropriate. Option B is wrong because lack of awareness is not valid. Option C is wrong because avoidance is a different response. Option D is wrong because regulatory risk should be mitigated or avoided.

Answer

Management is not aware of the risk

Answer

The risk relates to regulatory non-compliance

Answer

The organization wants to avoid the risk entirely