CRISC Risk Response and Mitigation Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

Accepted Answer

Risk Mitigation. Option B is correct because the firewall rule blocks malicious traffic, which reduces risk, i.e., mitigation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 2

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. Option A is correct because implementing account lockout directly addresses the threat of brute-force attacks, which is mitigation.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 3

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Accepted Answer

Risk of data exposure; apply a deny rule to restrict access. Option A is correct because the policy allows anyone to read objects, leading to data exposure; the appropriate response is to apply a deny rule or restrict access.

Answer

Risk of cost; set a budget alert

Answer

Risk of availability; implement backup

Answer

No risk; the policy is standard

Question 4

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Accepted Answer

Transfer. Option A is correct because purchasing insurance transfers the financial risk to the insurer. Options B, C, and D do not describe transfer via insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 5

A new privacy regulation requires that all personal data be encrypted at rest. The current systems lack encryption. The cost to implement encryption is moderate, and the risk of non-compliance is high. Which risk response is most appropriate?

Accepted Answer

Mitigate by implementing encryption. Option B is correct because encryption directly mitigates the risk of non-compliance. Options A, C, and D are less effective or inappropriate.

Answer

Accept the risk

Answer

Avoid by discontinuing data processing

Answer

Transfer via cyber insurance

Question 6

After implementing security controls, a risk assessment shows a residual risk of data exfiltration with a probability of 5% and potential loss of $10 million. The organization's risk appetite allows a maximum acceptable risk level of 3% probability for such impact. The cost of further mitigation is $1 million. What is the best risk response?

Accepted Answer

Implement additional controls to reduce probability to 2%. Option C is correct because the residual risk exceeds the risk appetite, so additional mitigation is required regardless of cost-benefit. Option A is wrong because the risk is outside appetite. Option B may reduce impact but not probability; appetite is based on probability. Option D is overly disruptive.

Answer

Accept the residual risk

Answer

Purchase cybersecurity insurance

Answer

Discontinue the process

Question 7

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

Accepted Answer

Implement additional monitoring and restrictions. Option D is correct because monitoring and restrictions address the risk without premature termination. Options A, B, and C are either too harsh or insufficient.

Answer

Terminate the employee immediately

Answer

Accept the risk as the employee is trusted

Answer

Transfer via fidelity insurance

Question 8

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Option A is correct because applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 9

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Accepted Answer

Implement compensating controls. Option B is correct because compensating controls mitigate the risk without replacing the system. Options A, C, and D are either unacceptable or impractical.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 10

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. Option C is correct because accepting the risk is cost-effective when control cost exceeds ALE and risk is within appetite. Options A, B, and D are incorrect.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk

Question 11

For a risk with very low likelihood and low impact, what is the typical risk response?

Accepted Answer

Accept. Option D is correct because such risks are usually accepted as the cost of response would outweigh the benefit. Options A, B, and C are excessive.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 12

A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?

Accepted Answer

Avoid by terminating the contract. Option A is correct because avoidance by terminating the contract addresses the risk directly. Options B, C, and D do not fully resolve the risk given the low appetite.

Answer

Mitigate by reducing data shared

Answer

Transfer via insurance

Answer

Accept the risk and monitor

Question 13

A company has a critical production system with a known vulnerability. Due to the system's age, the vendor no longer supports it. The company decides to implement network segmentation and purchase cyber insurance to cover potential losses. Which TWO risk response options are they applying?

Accepted Answer

Transfer. Options C and D are correct: Mitigate via segmentation and Transfer via insurance. Options A, B, and E are not applied.

Answer

Accept

Answer

Avoid

Answer

Ignore

Question 14

An organization assesses a risk of intellectual property theft through email exfiltration. They decide to enforce DLP controls, purchase a cyber liability policy, and officially accept the residual risk after controls. Which THREE risk response options are demonstrated?

Accepted Answer

Mitigate. Options A, C, and D are correct: Accept residual risk, Transfer via insurance, Mitigate via DLP. Options B and E are not used.

Answer

Avoid

Answer

Reduce

Question 15

A risk assessment identifies a high likelihood of a data breach due to insecure APIs. The risk team proposes disabling the APIs until they are secured, implementing a WAF, and purchasing breach insurance. Which THREE risk response options are being considered?

Accepted Answer

Transfer. Options A, C, and D are correct: Avoid (disable), Mitigate (WAF), Transfer (insurance). Options B and E are not proposed.

Answer

Remediate

Answer

Accept

CRISC Risk Response and Mitigation Practice Test 4 — 15 Questions

Exhibit

CRISC Risk Response and Mitigation Practice Test 4 — 15 Questions

Exhibit