CRISC Risk Response and Mitigation Practice Test 3 — 15 Questions

Question 1

Which THREE of the following are key considerations when selecting a risk response option?

Accepted Answer

Cost-benefit analysis of controls. A cost-benefit analysis of controls (Option A) is a key consideration because it ensures that the cost of implementing a risk response (e.g., a technical control like an intrusion prevention system or encryption) does not exceed the value of the asset being protected or the expected reduction in risk. This aligns with the principle of cost-effective risk mitigation, where the residual risk must be acceptable relative to the investment.

Answer

Impact of the risk without controls

Answer

Current control effectiveness

Question 2

Which TWO of the following are valid reasons to accept a risk rather than mitigate it?

Accepted Answer

The risk level is within the risk appetite. Accepting a risk is appropriate when the residual risk level falls within the organization's defined risk appetite. Risk appetite represents the amount of risk the organization is willing to accept in pursuit of its objectives, and risks within that threshold do not require additional mitigation controls. This aligns with the CRISC principle that risk acceptance is a valid response when the risk is within tolerance levels.

Answer

Management is not aware of the risk

Answer

The risk relates to regulatory non-compliance

Answer

The organization wants to avoid the risk entirely

Question 3

Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?

Accepted Answer

SSH protocol version 1.0 on 192.168.1.10. SSH protocol version 1.0 is critically vulnerable to multiple security flaws, including session key recovery and man-in-the-middle attacks, due to weak integrity checks and lack of strong cryptographic algorithms. Unlike the other options, which represent misconfigurations or outdated software that can be mitigated with patches or configuration changes, SSHv1.0 is a deprecated protocol with known, easily exploitable vulnerabilities that directly compromise confidentiality and integrity of administrative access. This makes it the most critical risk to address first, as it exposes the core management interface of the asset.

Answer

RDP with weak encryption on 192.168.1.20

Answer

SMB signing not required on 192.168.1.20

Answer

Apache HTTP Server 2.2.3 on 192.168.1.10

Question 4

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

Accepted Answer

HTTP traffic is permitted from any source to any destination. Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.

Answer

The final rule denies all traffic

Answer

HTTPS traffic is permitted to any destination

Answer

SSH access is only allowed from internal network

Question 5

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 6

A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:

Accepted Answer

Risk Mitigation. Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Acceptance

Question 7

An organization purchases cyber insurance to cover potential losses from data breaches. This is an example of:

Accepted Answer

Risk Transfer. Purchasing cyber insurance transfers the financial risk of a data breach to the insurer, making it a classic example of risk transfer. In risk management, transfer shifts the impact of a loss to a third party (e.g., an insurance carrier) without eliminating the underlying threat or vulnerability. This aligns with the CRISC domain of Risk Response and Mitigation, where transfer is a distinct response strategy.

Answer

Risk Avoidance

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 8

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 9

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

Accepted Answer

Conduct a tabletop exercise with the updated plan. A tabletop exercise validates the updated incident response plan by simulating a realistic scenario, allowing the response team to practice their roles and identify gaps in the new procedures. This directly addresses the root cause—the plan was outdated and the team failed to execute it correctly—by ensuring the plan is current and the team is familiar with its execution. Without this validation, the updated plan remains untested and the same failure mode could recur.

Answer

Add more detective controls

Answer

Update the risk register

Answer

Increase insurance coverage

Question 10

A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:

Accepted Answer

Risk Mitigation. Implementing manual overrides and additional monitoring reduces the probability or impact of the legacy system failure without eliminating the risk entirely. This is the definition of risk mitigation, as it applies controls to lower the residual risk to an acceptable level while the system remains in operation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 11

An organization has a policy requiring all sensitive data to be encrypted at rest. During an audit, it is found that encryption keys are stored in plaintext on the same server. Which risk response is MOST appropriate?

Accepted Answer

Mitigate by encrypting the key file. Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.

Answer

Avoid by removing the data

Answer

Accept the risk because encryption is still applied

Answer

Transfer the risk to a cloud provider

Question 12

A company faces a risk of data loss due to untrained staff. They implement mandatory training and quarterly phishing simulations. This is:

Accepted Answer

Risk Mitigation. Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Answer

Risk Avoidance

Answer

Risk Acceptance

Answer

Risk Transfer

Question 13

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Accepted Answer

Risk Avoidance. Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 14

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 15

Which TWO of the following are examples of risk avoidance? (Select TWO.)

Accepted Answer

Deciding not to enter a new market. Risk avoidance involves taking action to eliminate the risk entirely by not engaging in the activity that introduces it. Option C, 'Deciding not to enter a new market,' avoids all associated market, regulatory, and competitive risks by simply not pursuing that business opportunity. Option E, 'Discontinuing a risky product line,' removes the risk by ceasing the activity that generates it, such as halting production of a product with known safety or compliance issues.

Answer

Accepting the risk

Answer

Installing a firewall

Answer

Purchasing insurance