CRISC Risk Response and Mitigation Practice Test 5 — 15 Questions

Question 1

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Accepted Answer

Risk of data exposure; apply a deny rule to restrict access. The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.

Answer

Risk of cost; set a budget alert

Answer

Risk of availability; implement backup

Answer

No risk; the policy is standard

Question 2

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Accepted Answer

Transfer. Purchasing a business continuity insurance policy transfers the financial impact of the risk to a third party (the insurer), which is the definition of the transfer response. The vendor's robust controls address some risk, but the geopolitical risk remains and is being shifted via insurance. This is a classic example of risk transfer through insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 3

A new privacy regulation requires that all personal data be encrypted at rest. The current systems lack encryption. The cost to implement encryption is moderate, and the risk of non-compliance is high. Which risk response is most appropriate?

Accepted Answer

Mitigate by implementing encryption. Mitigating the risk by implementing encryption is the most appropriate response because the cost is moderate and the risk of non-compliance is high. Encryption directly addresses the regulatory requirement and reduces the risk to an acceptable level. This aligns with risk management principles where high-impact risks with feasible controls should be mitigated.

Answer

Accept the risk

Answer

Avoid by discontinuing data processing

Answer

Transfer via cyber insurance

Question 4

After implementing security controls, a risk assessment shows a residual risk of data exfiltration with a probability of 5% and potential loss of $10 million. The organization's risk appetite allows a maximum acceptable risk level of 3% probability for such impact. The cost of further mitigation is $1 million. What is the best risk response?

Accepted Answer

Implement additional controls to reduce probability to 2%. The residual risk has a probability of 5% and a potential loss of $10 million, resulting in an expected loss of $500,000. The organization's risk appetite allows a maximum probability of 3% for such an impact, so the current risk exceeds the acceptable threshold. Implementing additional controls for $1 million to reduce the probability to 2% brings the risk within the risk appetite (expected loss of $200,000) and is cost-effective because the reduction in expected loss ($300,000) is less than the control cost, but the primary driver is compliance with risk appetite, not pure cost-benefit.

Answer

Accept the residual risk

Answer

Purchase cybersecurity insurance

Answer

Discontinue the process

Question 5

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

Accepted Answer

Implement additional monitoring and restrictions. Implementing additional monitoring and restrictions (Option B) is the most appropriate risk response because it allows the organization to gather more evidence of the suspected insider threat while immediately reducing the attack surface. This aligns with the risk mitigation strategy, as it directly addresses the observed anomalous behavior—accessing systems outside normal hours—without prematurely escalating the situation. In a financial data environment, this could involve enabling enhanced audit logging, restricting access to specific IP ranges or times, and deploying user and entity behavior analytics (UEBA) to detect deviations from baseline activity.

Answer

Terminate the employee immediately

Answer

Accept the risk as the employee is trusted

Answer

Transfer via fidelity insurance

Question 6

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Applying the vendor-released patch directly reduces the likelihood and impact of the SQL injection vulnerability, which is the definition of risk mitigation. Since a patch exists and the application is critical, mitigation is both feasible and the most appropriate response — it addresses the root cause rather than avoiding, accepting, or transferring the consequence.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 7

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Accepted Answer

Implement compensating controls. When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 8

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. When the cost of a control exceeds the ALE and the risk is already within the organization's risk appetite, accepting the risk is the economically justified response. Spending $500k to mitigate a $300k annualized loss is not cost-effective, and the risk is tolerable by definition.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk

Question 9

For a risk with very low likelihood and low impact, what is the typical risk response?

Accepted Answer

Accept. When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 10

A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?

Accepted Answer

Avoid by terminating the contract. The vendor's refusal to remediate high-risk findings directly violates the contract's security standards clause, and the organization's low risk appetite for third-party risk means that accepting or mitigating the residual risk is unacceptable. Terminating the contract (avoidance) is the only response that eliminates the risk entirely, aligning with the principle that when a third party cannot or will not meet required security controls, the relationship should be severed to prevent potential data breaches or compliance violations.

Answer

Mitigate by reducing data shared

Answer

Transfer via insurance

Answer

Accept the risk and monitor

Question 11

A company has a critical production system with a known vulnerability. Due to the system's age, the vendor no longer supports it. The company decides to implement network segmentation and purchase cyber insurance to cover potential losses. Which TWO risk response options are they applying?

Accepted Answer

Transfer. Network segmentation reduces the attack surface by isolating the vulnerable system, which is a classic risk mitigation technique. Purchasing cyber insurance transfers the financial risk of residual losses to a third party, making 'Transfer' the correct second option. Together, these actions address the risk without removing the vulnerability.

Answer

Accept

Answer

Avoid

Answer

Ignore

Question 12

A risk assessment identifies a high likelihood of a data breach due to insecure APIs. The risk team proposes disabling the APIs until they are secured, implementing a WAF, and purchasing breach insurance. Which THREE risk response options are being considered?

Accepted Answer

Transfer. (Transfer) is correct because purchasing breach insurance transfers the financial risk of a data breach to an insurance provider. Option C (Avoid) is correct because disabling the APIs until they are secured eliminates the risk entirely by removing the vulnerable component. Option D (Mitigate) is correct because implementing a Web Application Firewall (WAF) reduces the likelihood or impact of an API-based attack without removing the API.

Answer

Remediate

Answer

Accept

Question 13

Which THREE of the following are key components of an effective risk response plan?

Accepted Answer

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept). A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.

Answer

Detailed implementation timeline

Answer

Regulatory impact analysis

Question 14

A small e-commerce company has identified a high-risk vulnerability in its payment processing system that could expose customer credit card data. The IT team recommends immediately patching the system, but the patch requires a 4-hour downtime during peak sales hours. The risk manager proposes accepting the risk until the next scheduled maintenance window in two weeks. The CEO is concerned about potential fines from PCI DSS non-compliance. What is the BEST course of action?

Accepted Answer

Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.. The best course of action balances risk mitigation, business continuity, and compliance. Implementing a compensating control such as a web application firewall reduces the immediate exposure of the vulnerability while allowing the patch to be scheduled during off-peak hours within a short timeframe (48 hours), avoiding both peak-hour downtime and prolonged exposure. This aligns with CRISC's emphasis on risk response options that are proportionate and timely, and it addresses the CEO's PCI DSS compliance concern by reducing the window of non-compliance.

Answer

Delay the patch until the next maintenance window but document the risk acceptance with CEO sign-off.

Answer

Accept the risk and schedule the patch during the next maintenance window as originally planned.

Answer

Apply the patch immediately during peak hours, accepting the revenue loss from downtime.

Question 15

A multinational corporation has adopted a risk mitigation strategy for its key suppliers by requiring them to maintain ISO 27001 certification. During an audit, the risk manager discovers that one critical supplier lost its certification six months ago but did not report it, as contractually required. The supplier still has adequate security controls in place, and the relationship is strategically important. The CEO wants to avoid contract termination. What is the MOST appropriate risk response?

Accepted Answer

Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.. The most appropriate risk response is to issue a corrective action plan with a deadline and monitoring, because it directly addresses the control gap (lapsed certification) while preserving the strategic relationship. ISO 27001 certification is a contractual requirement and a key risk mitigation control; its loss increases risk even if other controls exist. A corrective action plan is a targeted risk treatment that restores compliance and provides assurance through monthly reviews, aligning with CRISC's emphasis on balancing risk and business objectives.

Answer

Transfer the risk to the supplier's cyber liability insurance policy.

Answer

Accept the risk because the supplier still has effective controls, and update the risk register.

Answer

Terminate the contract immediately and find an alternative supplier.