CRISC Risk Response and Mitigation Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Accepted Answer

Firewall. A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Answer

Outsourcing IT helpdesk

Answer

Cyber insurance

Question 2

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

Accepted Answer

Risk Mitigation. The firewall rule denies inbound traffic on TCP port 443 (HTTPS) from any source to any destination. This directly reduces the attack surface by blocking a specific protocol, which is a classic risk mitigation action. By implementing a technical control to reduce the likelihood or impact of a threat, the organization is applying risk mitigation, not transferring, accepting, or avoiding the risk entirely.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 3

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 4

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Accepted Answer

Transfer. Purchasing insurance transfers the financial risk to the insurer. Options B, C, and D do not describe transfer via insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 5

A new privacy regulation requires that all personal data be encrypted at rest. The current systems lack encryption. The cost to implement encryption is moderate, and the risk of non-compliance is high. Which risk response is most appropriate?

Accepted Answer

Mitigate by implementing encryption. (Mitigate by implementing encryption) is the most appropriate risk response because it directly addresses the risk of non-compliance with the privacy regulation by applying a moderate-cost control. The high risk of non-compliance makes acceptance (B) unsuitable; avoidance (C) by discontinuing processing is overly drastic and not cost-effective; and transfer (D) via insurance does not fulfill the regulatory requirement to encrypt at rest.

Answer

Accept the risk

Answer

Avoid by discontinuing data processing

Answer

Transfer via cyber insurance

Question 6

After implementing security controls, a risk assessment shows a residual risk of data exfiltration with a probability of 5% and potential loss of $10 million. The organization's risk appetite allows a maximum acceptable risk level of 3% probability for such impact. The cost of further mitigation is $1 million. What is the best risk response?

Accepted Answer

Implement additional controls to reduce probability to 2%. The residual risk has a probability of 5% and a potential loss of $10 million, resulting in an expected loss of $500,000. The organization's risk appetite allows a maximum probability of 3% for such an impact, so the current risk exceeds the acceptable threshold. Implementing additional controls for $1 million to reduce the probability to 2% brings the risk within the risk appetite (expected loss of $200,000) and is cost-effective because the reduction in expected loss ($300,000) is less than the control cost, but the primary driver is compliance with risk appetite, not pure cost-benefit.

Answer

Accept the residual risk

Answer

Purchase cybersecurity insurance

Answer

Discontinue the process

Question 7

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

Accepted Answer

Implement additional monitoring and restrictions. Implementing additional monitoring and restrictions (Option B) is the most appropriate risk response because it allows the organization to gather more evidence of the suspected insider threat while immediately reducing the attack surface. This aligns with the risk mitigation strategy, as it directly addresses the observed anomalous behavior—accessing systems outside normal hours—without prematurely escalating the situation. In a financial data environment, this could involve enabling enhanced audit logging, restricting access to specific IP ranges or times, and deploying user and entity behavior analytics (UEBA) to detect deviations from baseline activity.

Answer

Terminate the employee immediately

Answer

Accept the risk as the employee is trusted

Answer

Transfer via fidelity insurance

Question 8

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 9

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Accepted Answer

Implement compensating controls. When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 10

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. When the cost of the control ($500k) exceeds the annualized loss expectancy (ALE) of $300k and the risk is within the organization's risk appetite, it is more cost-effective to accept the risk rather than implement a costly control.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk

Question 11

For a risk with very low likelihood and low impact, what is the typical risk response?

Accepted Answer

Accept. When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 12

A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?

Accepted Answer

Avoid by terminating the contract. The vendor's refusal to remediate high-risk findings directly violates the contract's security standards clause, and the organization's low risk appetite for third-party risk means that accepting or mitigating the residual risk is unacceptable. Terminating the contract (avoidance) is the only response that eliminates the risk entirely, aligning with the principle that when a third party cannot or will not meet required security controls, the relationship should be severed to prevent potential data breaches or compliance violations.

Answer

Mitigate by reducing data shared

Answer

Transfer via insurance

Answer

Accept the risk and monitor

Question 13

A company has a critical production system with a known vulnerability. Due to the system's age, the vendor no longer supports it. The company decides to implement network segmentation and purchase cyber insurance to cover potential losses. Which TWO risk response options are they applying?

Accepted Answer

Transfer. Network segmentation reduces the attack surface by isolating the vulnerable system, which is a classic risk mitigation technique. Purchasing cyber insurance transfers the financial risk of residual losses to a third party, making 'Transfer' the correct second option. Together, these actions address the risk without removing the vulnerability.

Answer

Accept

Answer

Avoid

Answer

Ignore

Question 14

An organization assesses a risk of intellectual property theft through email exfiltration. They decide to enforce DLP controls, purchase a cyber liability policy, and officially accept the residual risk after controls. Which THREE risk response options are demonstrated?

Accepted Answer

Mitigate. Enforcing DLP controls directly reduces the likelihood of intellectual property theft by monitoring and blocking unauthorized email exfiltration, which is a classic risk mitigation (reduce) action. Purchasing a cyber liability policy transfers the financial impact of a breach to an insurer, demonstrating risk transfer. Formally accepting the residual risk after controls acknowledges that some risk remains, which is risk acceptance.

Answer

Avoid

Answer

Reduce

Question 15

A risk assessment identifies a high likelihood of a data breach due to insecure APIs. The risk team proposes disabling the APIs until they are secured, implementing a WAF, and purchasing breach insurance. Which THREE risk response options are being considered?

Accepted Answer

Transfer. (Transfer) is correct because purchasing breach insurance transfers the financial risk of a data breach to an insurance provider. Option C (Avoid) is correct because disabling the APIs until they are secured eliminates the risk entirely by removing the vulnerable component. Option D (Mitigate) is correct because implementing a Web Application Firewall (WAF) reduces the likelihood or impact of an API-based attack without removing the API.

Answer

Remediate

Answer

Accept