CRISC Risk Response and Mitigation Practice Test 6 — 15 Questions

Question 1

A financial institution is implementing a new online banking platform. The risk assessment identified that the platform will handle sensitive customer data and must comply with GDPR and local banking regulations. The project team proposes encrypting all data at rest and in transit, implementing multi-factor authentication (MFA), and conducting quarterly penetration tests. However, the risk owner is concerned about the residual risk of a sophisticated phishing attack that could bypass MFA. The board has a low risk appetite. What is the BEST way to address this residual risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.. The residual risk is a sophisticated phishing attack that could bypass MFA, and the board has a low risk appetite, so the risk must be reduced rather than transferred or accepted. Implementing phishing-resistant MFA such as FIDO2/WebAuthn (hardware security keys or passkeys) removes the shared-secret and OTP weaknesses that phishing kits exploit, and pairing it with ongoing phishing simulation training hardens the human layer. This directly addresses the specific residual risk while preserving the business value of the online banking platform.

Answer

Purchase cyber insurance to transfer the financial impact of a potential phishing attack.

Answer

Reduce the project scope to exclude online banking and revert to a less risky channel.

Answer

Accept the residual risk because the existing controls (encryption, MFA, pen tests) already provide reasonable assurance.

Question 2

A healthcare organization is migrating its electronic health records (EHR) system to a cloud provider. The risk assessment shows that the cloud provider has strong security certifications (e.g., SOC 2 Type II, ISO 27001). However, the organization's legal team is concerned about data sovereignty laws that require patient data to remain within the country. The cloud provider's data centers are located in three regions: one in-country, and two outside. The project manager proposes using only the in-country data center. The IT director warns that this will increase latency and reduce redundancy. The risk manager must propose a response. Which is the BEST option?

Accepted Answer

Configure the EHR system to store primary data in the in-country data center, and use the other two centers for disaster recovery with data residency controls ensuring data does not leave the country unless encrypted and with legal approval.. It balances compliance with data sovereignty laws (using the in-country data center for primary storage) and maintains redundancy for disaster recovery with data residency controls. Option A is wrong because simply accepting the legal risk based on certifications is not sufficient; data sovereignty laws are regulatory requirements that must be adhered to, and the certifications do not override those laws. Option B is wrong because automatic failover to data centers outside the country would violate data sovereignty laws by allowing patient data to leave the country without proper controls. Option D is wrong because using only one data center increases availability risk and does not address the legal concerns properly; it avoids the legal risk but introduces high operational risk.

Answer

Accept the legal risk because the cloud provider's certifications are sufficient, and document the decision.

Answer

Use all three data centers with automatic failover, and rely on the cloud provider's contractual guarantees of data residency.

Answer

Use only the in-country data center and accept the increased availability risk.

Question 3

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 4

A financial services firm has a critical web application that must remain available 24/7. The risk assessment indicates that a distributed denial-of-service (DDoS) attack could cause significant downtime. The risk owner decides to implement a cloud-based DDoS mitigation service that scrubs traffic before it reaches the application. Which risk response strategy does this represent?

Accepted Answer

Risk mitigation. Implementing a DDoS mitigation service is a classic example of risk mitigation because it reduces the likelihood or impact of a threat. The risk is not avoided (the service continues), not transferred (the firm retains responsibility), and not accepted (action is taken). Mitigation controls are designed to bring residual risk within the organization's risk appetite.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transference

Question 5

A multinational corporation has a risk register entry for a potential data breach of customer information. The risk owner has decided to purchase cyber insurance to cover financial losses from a breach. Which of the following BEST describes the residual risk after this risk response?

Accepted Answer

The residual risk remains, but the financial impact is partially transferred to the insurer.. Cyber insurance transfers a portion of the financial risk to the insurer, but the organization retains residual risk, including non-financial impacts and any uncovered losses. The residual risk is not eliminated or reduced to zero; it remains but with a lower financial exposure. This is a key concept in risk response: transference does not remove all risk.

Answer

The residual risk is reduced to zero because the risk has been transferred.

Answer

The residual risk is increased because the insurance policy may not cover all breach scenarios.

Answer

The residual risk is eliminated because the insurance covers all financial losses.

Question 6

A financial services company's risk register shows that a critical vulnerability in its online banking application has a high likelihood of exploitation and a high impact. The risk owner decides to implement a web application firewall (WAF) and conduct monthly penetration tests. Which risk response strategy is being applied?

Accepted Answer

Risk mitigation. The organization is reducing the likelihood and impact of the vulnerability by adding a WAF and performing regular penetration tests. These actions are classic risk mitigation controls that lower residual risk. Avoidance would mean discontinuing the online banking service, transfer would involve insurance, and acceptance would mean no action.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 7

A financial services firm operates a high-volume transaction processing platform. During a risk assessment, the risk owner determines that the residual risk of database corruption exceeds the risk appetite. The database vendor offers a patch that reduces the vulnerability but requires a 12-hour outage. Business stakeholders refuse the outage. The risk practitioner is asked to recommend a risk response that aligns with the risk appetite without disrupting operations. Which of the following is the BEST recommendation?

Accepted Answer

Implement database replication to a secondary node and fail over during a maintenance window, then apply the patch.. The best response reduces residual risk to within appetite while respecting the business constraint against a 12-hour outage. Database replication provides a compensating control that enables patching with minimal downtime, effectively mitigating the vulnerability. Acceptance, transfer, and avoidance either leave risk above appetite or introduce unacceptable business disruption.

Answer

Avoid the risk by decommissioning the transaction platform and migrating to a new solution.

Answer

Accept the residual risk and document it in the risk register with a review date in six months.

Answer

Transfer the risk by purchasing cyber liability insurance that covers data corruption events.

Question 8

A financial services firm has identified that its primary data center is located in a region prone to hurricanes. The risk manager proposes purchasing business interruption insurance to cover potential losses from a catastrophic event. Which risk response strategy does this represent?

Accepted Answer

Risk transfer. Purchasing insurance is a classic example of risk transfer, where the financial impact of a risk is shifted to an insurance provider. The risk event (hurricane) still occurs, but the firm is compensated for losses, protecting its financial stability. This strategy is appropriate when the risk is high-impact but low-frequency, and the cost of insurance is justified.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 9

A financial services firm has a risk register entry for a core banking application with an inherent risk score of 9 (high). The risk owner implements a new database activity monitoring tool and role-based access reviews. After implementation, the residual risk score is reassessed at 6 (medium). The risk owner now wants to formally document that the risk has been reduced to an acceptable level. Which action should the risk practitioner recommend NEXT?

Accepted Answer

Update the risk register to reflect the new residual risk score and obtain risk owner sign-off.. After implementing risk mitigation controls, the risk practitioner must ensure the risk register is updated with the new residual risk score and that the risk owner formally accepts the remaining risk. This confirms that the risk treatment has been effective and that the residual risk is within the defined risk appetite. Documentation and sign-off are essential for auditability and governance.

Answer

Escalate the residual risk to the board of directors for approval.

Answer

Initiate a new risk assessment to identify any remaining vulnerabilities.

Answer

Perform a penetration test to validate the effectiveness of the new controls.

Question 10

A healthcare organization is required by regulation to retain patient records for seven years. The risk manager is evaluating a new cloud storage solution that offers encryption at rest but stores data in multiple jurisdictions. Which of the following is the MOST critical risk consideration when selecting this solution?

Accepted Answer

The legal and regulatory requirements for data residency in each jurisdiction. For a healthcare organization, regulatory compliance is paramount. Storing patient records in multiple jurisdictions can breach data residency laws, resulting in severe penalties. While encryption, physical security, and availability are relevant, they do not address the legal risk of unauthorized cross-border data storage. The risk manager must prioritize compliance with data residency requirements before other technical controls.

Answer

The encryption algorithm used by the cloud provider

Answer

The availability of the cloud service and its uptime guarantees

Answer

The physical security of the cloud provider's data centers

Question 11

A hospital's risk team has documented that its infusion pump fleet runs an unsupported operating system, creating a high risk of compromise. Replacing the pumps requires capital approval that will take 18 months, and the pumps cannot be taken offline in the interim. Which risk response is MOST appropriate for the risk practitioner to recommend?

Accepted Answer

Implement compensating controls such as network segmentation and strict access controls until the pumps are replaced.. The best response is to reduce risk through compensating controls while the long-term replacement is planned. Because the pumps cannot be removed and replacement is 18 months away, the risk practitioner should recommend interim mitigation that lowers exposure without disrupting patient care. This aligns with the CRISC principle of selecting a response proportionate to risk and maintaining operations.

Answer

Avoid the risk by immediately decommissioning all infusion pumps and switching to manual dosing.

Answer

Accept the risk and log it in the risk register for the next annual review.

Answer

Transfer the risk by purchasing cyber liability insurance that covers medical device incidents.

Question 12

A multinational corporation is deploying a new IoT-based inventory management system across its warehouses. The risk practitioner identifies that the IoT devices use default administrative credentials and unencrypted communication protocols. The vendor states that a firmware update to address these issues will not be available for six months. The business cannot delay the deployment due to competitive pressures. Which risk response strategy is MOST appropriate in this situation?

Accepted Answer

Accept the risk and proceed with deployment, documenting the decision and implementing compensating controls such as network segmentation and monitoring.. Given the business imperative to deploy and the unavailability of a timely patch, risk acceptance with compensating controls is the most appropriate response. This approach acknowledges the residual risk while reducing it through segmentation and monitoring. It also documents the decision for future review, aligning with CRISC principles of balancing risk and business objectives.

Answer

Transfer the risk by purchasing cyber insurance that covers IoT-related breaches.

Answer

Avoid the risk by canceling the IoT deployment and continuing with the existing manual inventory process.

Answer

Mitigate the risk by immediately replacing the IoT devices with a different vendor's products that have better security features.

Question 13

A financial services firm has a risk register entry for a critical trading application. The business owner proposes adding a redundant data center to reduce downtime risk. The risk practitioner notes that the redundancy will cost $2 million annually and reduce expected annual loss from $3 million to $500,000. Which factor is MOST important for the risk practitioner to evaluate before recommending approval?

Accepted Answer

Whether the redundant data center aligns with the firm's risk appetite and tolerance.. Before recommending a risk response, the practitioner must confirm alignment with the organization's risk appetite and tolerance. The cost-benefit analysis supports the redundancy, but appetite alignment ensures the response is consistent with governance and strategic objectives. Evaluating appetite and tolerance is the overarching criterion that determines whether a control is appropriate, not merely whether it is affordable or technically feasible.

Answer

Whether the redundant data center will eliminate all downtime risk for the trading application.

Answer

Whether the business owner has the authority to approve the $2 million annual expenditure.

Answer

Whether the $2 million annual cost is lower than the $3 million expected annual loss.

Question 14

A retail company has a risk register that includes a risk of inventory shrinkage due to employee theft. The risk manager decides to implement a new surveillance system and conduct background checks on all new hires. Which risk response strategy is being applied?

Accepted Answer

Risk mitigation. Implementing surveillance and background checks are preventive controls that reduce the likelihood of employee theft. This is a classic risk mitigation strategy, as the company is taking direct action to lower the risk rather than accepting, avoiding, or transferring it. Mitigation is appropriate when the risk is significant and controls can cost-effectively reduce it.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 15

A financial services firm has determined that a critical trading application cannot be patched for a known remote code execution vulnerability because the vendor no longer supports the platform. The risk manager decides to deploy a web application firewall (WAF) with virtual patching and network segmentation to isolate the application from the internal network. Which risk response strategy does this represent?

Accepted Answer

Risk mitigation. The organization is actively reducing the likelihood and impact of a vulnerability by deploying a WAF and network segmentation. These compensating controls are classic risk mitigation actions. Risk mitigation is the appropriate strategy when an organization chooses to implement controls to bring residual risk within appetite rather than accepting, transferring, or avoiding the risk entirely.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk avoidance