CRISC Risk Response and Mitigation Practice Test 2 — 15 Questions

Question 1

Sequence the steps for implementing a new control based on risk assessment findings.

Accepted Answer

Design the control, then Procure/Build the control, then Test the control, then Deploy the control, then Monitor the control.. Control implementation involves design, procurement/build, testing, deployment, and monitoring.

Answer

Procure/Build the control, then Design the control, then Test the control, then Deploy the control, then Monitor the control.

Answer

Design the control, then Test the control, then Procure/Build the control, then Deploy the control, then Monitor the control.

Answer

Design the control, then Procure/Build the control, then Deploy the control, then Test the control, then Monitor the control.

Question 2

Put the steps for performing a control self-assessment (CSA) in order.

Accepted Answer

Define scope, then identify controls, then assess effectiveness, then identify gaps, then report results. CSA involves defining scope, identifying controls, assessing effectiveness, gap identification, and reporting.

Answer

Define scope, then assess effectiveness, then identify controls, then identify gaps, then report results

Answer

Identify controls, then define scope, then assess effectiveness, then identify gaps, then report results

Answer

Define scope, then identify controls, then identify gaps, then assess effectiveness, then report results

Question 3

Match each risk response strategy to its definition.

Accepted Answer

Avoid: Identifying a risk and making the decision to no longer perform the activity that gives rise to the risk.. The correct matches are: Avoid – decision to not perform the activity; Accept – formal acceptance of risk; Mitigate – reduce likelihood/impact; Transfer – shift to another party. Common confusions include mixing transfer with avoidance and acceptance with mitigation.

Answer

Avoid: Shifting the risk to another party.

Answer

Accept: Actions taken to reduce the likelihood or impact of a risk.

Question 4

Match each risk management term to its definition.

Accepted Answer

Risk: The effect of uncertainty on objectives.. The correct matches are Risk with 'effect of uncertainty on objectives', Threat with 'circumstance/event that can adversely impact', and Vulnerability with 'weakness that can be exploited'. Common confusions include swapping definitions between these terms.

Answer

Risk: A weakness that could be exploited.

Answer

Threat: The effect of uncertainty on objectives.

Answer

Vulnerability: Any circumstance or event with potential to adversely impact.

Question 5

Match each risk management process step to its activity.

Accepted Answer

Risk Identification: The process of finding, recognizing, and documenting risks.. The risk management process steps are distinct: Risk Identification finds risks, Risk Assessment evaluates them, and Risk Response addresses them. Common confusions involve swapping these definitions.

Answer

Risk Identification: The process of determining the probability and impact of identified risks.

Answer

Risk Assessment: The process of finding, recognizing, and documenting risks.

Question 6

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

Accepted Answer

Acceptance. Acceptance is the most appropriate response because the vulnerability exists in a legacy application that supports a non-critical business process and is used by a small number of users. The cost and operational impact of patching or replacing the application outweigh the risk, making it acceptable to operate with the known vulnerability under formal risk acceptance.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation

Question 7

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Accepted Answer

Escalate to senior management. When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Answer

Update the risk register

Answer

Implement additional controls

Answer

Reduce the risk appetite

Question 8

An organization's security team recommends implementing a web application firewall (WAF) to protect against SQL injection attacks. The risk manager evaluates the cost of the WAF and the likelihood of a successful attack. This evaluation is BEST described as:

Accepted Answer

Cost-benefit analysis. The risk manager is comparing the cost of implementing the WAF against the likelihood and potential impact of a SQL injection attack. This direct comparison of mitigation cost to risk reduction benefit is the essence of a cost-benefit analysis, which determines whether the control is economically justified. It is not a calculation of residual or inherent risk, nor is it an acceptance decision.

Answer

Residual risk calculation

Answer

Inherent risk assessment

Answer

Risk acceptance

Question 9

A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?

Accepted Answer

Include security requirements in the contract and perform regular vendor audits. Including security requirements in the contract and conducting regular vendor audits ensures the vendor meets the company's security standards, effectively mitigating the risk. Option A is incorrect because denying the existence of the risk is not a valid risk response. Option B is incorrect because purchasing cyber insurance transfers the financial impact but does not reduce the actual risk. Option C is incorrect because avoiding the CRM system may be too drastic and could hinder business operations.

Answer

Deny the existence of the risk

Answer

Purchase cyber insurance to cover potential losses

Answer

Avoid using the cloud CRM system

Question 10

A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?

Accepted Answer

Risk mitigation. Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 11

After implementing a set of controls, the risk owner calculates the residual risk and finds it is still above the risk tolerance. However, the cost to further reduce the risk exceeds the potential loss. What is the MOST appropriate next step?

Accepted Answer

Formally accept the residual risk. When the residual risk remains above the risk tolerance but the cost of further mitigation exceeds the potential loss, the most appropriate step is to formally accept the residual risk. This decision is based on a cost-benefit analysis showing that additional controls are not economically justified. The risk owner documents the acceptance, acknowledging the remaining exposure within the organization's risk appetite framework.

Answer

Re-assess the inherent risk

Answer

Reduce current controls to lower costs

Answer

Implement additional controls despite the cost

Question 12

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

Accepted Answer

Avoid by keeping IT support in-house. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements, which represents a high-severity compliance risk that cannot be effectively mitigated through monitoring alone. Avoiding the risk by keeping IT support in-house eliminates the exposure entirely, making it the best response when the risk level exceeds the organization's risk appetite and cannot be reduced to an acceptable level through other strategies.

Answer

Mitigate by regularly monitoring the provider

Answer

Transfer the risk through the outsourcing contract

Answer

Accept the risk because the provider is cheaper

Question 13

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

Accepted Answer

Tune the system to reduce false positives. B is correct because tuning the system involves adjusting detection thresholds, rules, or machine learning models to reduce false positives while maintaining sensitivity to actual fraud. This directly addresses the root cause—poorly calibrated detection logic—without sacrificing the system's primary function or incurring unsustainable costs.

Answer

Accept the false positives as a cost of doing business

Answer

Remove the monitoring system to focus on other controls

Answer

Hire additional analysts to review all alerts

Question 14

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to sign standard contractual clauses and encrypt all data. Standard Contractual Clauses (SCCs) are a GDPR-approved transfer mechanism that legally binds the vendor to EU data protection standards, even in a weak-law jurisdiction. Combined with encryption of all data at rest and in transit, this provides both a legal and technical safeguard, reducing the risk of non-compliance to an acceptable level without abandoning the vendor.

Answer

Avoid by choosing a vendor in a country with strong data protection laws

Answer

Accept the risk because the vendor offers the best price

Answer

Purchase cyber insurance to cover potential fines

Question 15

Which TWO of the following are examples of risk mitigation controls?

Accepted Answer

Implementing a firewall. Implementing a firewall is a risk mitigation control because it reduces the likelihood and impact of unauthorized network access by enforcing access control policies based on source/destination IP addresses, ports, and protocols. Firewalls operate at Layers 3 and 4 (and sometimes Layer 7) of the OSI model to filter traffic, thereby directly reducing the attack surface and preventing exploitation of vulnerabilities.

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Answer

Discontinuing a high-risk service