CRISC Risk Response and Mitigation Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?

Accepted Answer

SSH protocol version 1.0 on 192.168.1.10. Option A is correct because SSH version 1.0 is a critical vulnerability and should be prioritized. Option B is wrong because Apache 2.2.3 is high but not as critical. Option C is wrong because RDP weak encryption is medium. Option D is wrong because SMB signing is medium.

Answer

RDP with weak encryption on 192.168.1.20

Answer

SMB signing not required on 192.168.1.20

Answer

Apache HTTP Server 2.2.3 on 192.168.1.10

Question 2

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

Accepted Answer

HTTP traffic is permitted from any source to any destination. Option D is correct because the rule permit tcp any any eq 80 allows unrestricted HTTP access from any source, increasing exposure to web attacks. Option A is wrong because SSH is restricted to internal network. Option B is wrong because HTTPS is needed for web traffic. Option C is wrong because the deny all rule is proper.

Answer

The final rule denies all traffic

Answer

HTTPS traffic is permitted to any destination

Answer

SSH access is only allowed from internal network

Question 3

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. Option C is correct because the duplicate entry error for 'admin' combined with successful login suggests a brute-force or credential stuffing attack where an attacker tries multiple passwords. Option A is wrong because SQL injection would show different errors. Option B is wrong because XSS appears in output. Option D is wrong because CSRF lacks session manipulation.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 4

A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:

Accepted Answer

Risk Mitigation. Option A is correct because deploying a WAF reduces the likelihood of exploitation, which is a risk mitigation strategy.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Acceptance

Question 5

An organization purchases cyber insurance to cover potential losses from data breaches. This is an example of:

Accepted Answer

Risk Transfer. Purchasing cyber insurance transfers the financial risk of a data breach to the insurer, making it a classic example of risk transfer. In risk management, transfer shifts the impact of a loss to a third party (e.g., an insurance carrier) without eliminating the underlying threat or vulnerability. This aligns with the CRISC domain of Risk Response and Mitigation, where transfer is a distinct response strategy.

Answer

Risk Avoidance

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 6

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. Option C is correct because eliminating the use of the service removes the risk entirely, which is avoidance.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 7

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

Accepted Answer

Conduct a tabletop exercise with the updated plan. Option D is correct because conducting a tabletop exercise validates the updated plan and helps prepare the team.

Answer

Add more detective controls

Answer

Update the risk register

Answer

Increase insurance coverage

Question 8

A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:

Accepted Answer

Risk Mitigation. Option A is correct because implementing controls reduces the risk, which is mitigation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 9

An organization has a policy requiring all sensitive data to be encrypted at rest. During an audit, it is found that encryption keys are stored in plaintext on the same server. Which risk response is MOST appropriate?

Accepted Answer

Mitigate by encrypting the key file. Option B is correct because encrypting the key file directly addresses the vulnerability, which is mitigation.

Answer

Avoid by removing the data

Answer

Accept the risk because encryption is still applied

Answer

Transfer the risk to a cloud provider

Question 10

A company faces a risk of data loss due to untrained staff. They implement mandatory training and quarterly phishing simulations. This is:

Accepted Answer

Risk Mitigation. Option C is correct because training reduces the likelihood of human error, which is a mitigation technique.

Answer

Risk Avoidance

Answer

Risk Acceptance

Answer

Risk Transfer

Question 11

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Accepted Answer

Risk Avoidance. Option D is correct because decommissioning the system eliminates the risk entirely, which is avoidance.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 12

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. Option A is correct because the risk is accepted formally as it is within an acceptable range after controls.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 13

Which TWO of the following are examples of risk transfer? (Select TWO.)

Accepted Answer

Outsourcing IT operations to a third party. Options A and B are correct because outsourcing and insurance both shift financial or operational risk to another party.

Answer

Implementing encryption

Answer

Accepting residual risk

Answer

Conducting security training

Question 14

Which TWO of the following are examples of risk avoidance? (Select TWO.)

Accepted Answer

Deciding not to enter a new market. Options C and D are correct because discontinuing a product and not entering a market both eliminate the risk by avoiding the activity.

Answer

Accepting the risk

Answer

Installing a firewall

Answer

Purchasing insurance

Question 15

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Accepted Answer

Firewall. A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Answer

Outsourcing IT helpdesk

Answer

Cyber insurance

CRISC Risk Response and Mitigation Practice Test 3 — 15 Questions

Exhibit

CRISC Risk Response and Mitigation Practice Test 3 — 15 Questions

Exhibit