CRISC Risk Response and Mitigation Practice Test 4 — 15 Questions

Question 1

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tune the system to reduce false positives. B is correct because tuning the system involves adjusting detection thresholds, rules, or machine learning models to reduce false positives while maintaining sensitivity to actual fraud. This directly addresses the root cause—poorly calibrated detection logic—without sacrificing the system's primary function or incurring unsustainable costs.

Answer

Accept the false positives as a cost of doing business

Answer

Remove the monitoring system to focus on other controls

Answer

Hire additional analysts to review all alerts

Question 2

Which TWO of the following are examples of risk mitigation controls?

Accepted Answer

Implementing a firewall. Implementing a firewall is a risk mitigation control because it reduces the likelihood and impact of unauthorized network access by enforcing access control policies based on source/destination IP addresses, ports, and protocols. Firewalls operate at Layers 3 and 4 (and sometimes Layer 7) of the OSI model to filter traffic, thereby directly reducing the attack surface and preventing exploitation of vulnerabilities.

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Answer

Discontinuing a high-risk service

Question 3

Which THREE of the following are key considerations when selecting a risk response option?

Accepted Answer

Cost-benefit analysis of controls. A cost-benefit analysis of controls (Option A) is a key consideration because it ensures that the cost of implementing a risk response (e.g., a technical control like an intrusion prevention system or encryption) does not exceed the value of the asset being protected or the expected reduction in risk. This aligns with the principle of cost-effective risk mitigation, where the residual risk must be acceptable relative to the investment.

Answer

Impact of the risk without controls

Answer

Current control effectiveness

Question 4

A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:

Accepted Answer

Risk Mitigation. Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Acceptance

Question 5

An organization purchases cyber insurance to cover potential losses from data breaches. This is an example of:

Accepted Answer

Risk Transfer. Purchasing cyber insurance transfers the financial risk of a data breach to the insurer, making it a classic example of risk transfer. In risk management, transfer shifts the impact of a loss to a third party (e.g., an insurance carrier) without eliminating the underlying threat or vulnerability. This aligns with the CRISC domain of Risk Response and Mitigation, where transfer is a distinct response strategy.

Answer

Risk Avoidance

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 6

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 7

A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:

Accepted Answer

Risk Mitigation. Implementing manual overrides and additional monitoring reduces the probability or impact of the legacy system failure without eliminating the risk entirely. This is the definition of risk mitigation, as it applies controls to lower the residual risk to an acceptable level while the system remains in operation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 8

An organization has a policy requiring all sensitive data to be encrypted at rest. During an audit, it is found that encryption keys are stored in plaintext on the same server. Which risk response is MOST appropriate?

Accepted Answer

Mitigate by encrypting the key file. Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.

Answer

Avoid by removing the data

Answer

Accept the risk because encryption is still applied

Answer

Transfer the risk to a cloud provider

Question 9

A company faces a risk of data loss due to untrained staff. They implement mandatory training and quarterly phishing simulations. This is:

Accepted Answer

Risk Mitigation. Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Answer

Risk Avoidance

Answer

Risk Acceptance

Answer

Risk Transfer

Question 10

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Accepted Answer

Risk Avoidance. Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 11

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 12

Which TWO of the following are examples of risk transfer? (Select TWO.)

Accepted Answer

Outsourcing IT operations to a third party. Option A (Outsourcing IT operations to a third party) is correct because risk transfer shifts the financial and operational impact of a risk to another entity via a contractual agreement, such as an SLA or MSA, where the vendor assumes responsibility for the outsourced functions. Option D (Buying cyber insurance) is correct because insurance is the classic form of risk transfer, where the insurer agrees to compensate the organization for covered losses in exchange for premiums, moving the financial consequence of the risk to the insurer. Option B (Implementing encryption) is a risk mitigation or reduction control that lowers the likelihood or impact of a data breach rather than transferring it. Option C (Accepting residual risk) is risk acceptance, where the organization retains the remaining risk after other treatments. Option E (Conducting security training) is also risk mitigation, reducing human error and improving security awareness rather than shifting risk to a third party.

Answer

Implementing encryption

Answer

Accepting residual risk

Answer

Conducting security training

Question 13

Which TWO of the following are examples of risk avoidance? (Select TWO.)

Accepted Answer

Deciding not to enter a new market. Risk avoidance involves taking action to eliminate the risk entirely by not engaging in the activity that introduces it. Option C, 'Deciding not to enter a new market,' avoids all associated market, regulatory, and competitive risks by simply not pursuing that business opportunity. Option E, 'Discontinuing a risky product line,' removes the risk by ceasing the activity that generates it, such as halting production of a product with known safety or compliance issues.

Answer

Accepting the risk

Answer

Installing a firewall

Answer

Purchasing insurance

Question 14

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Accepted Answer

Firewall. A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Answer

Outsourcing IT helpdesk

Answer

Cyber insurance

Question 15

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

Accepted Answer

Risk Mitigation. The firewall rule denies inbound traffic on TCP port 443 (HTTPS) from any source to any destination. This directly reduces the attack surface by blocking a specific protocol, which is a classic risk mitigation action. By implementing a technical control to reduce the likelihood or impact of a threat, the organization is applying risk mitigation, not transferring, accepting, or avoiding the risk entirely.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance