CRISC Risk Response and Mitigation Practice Test 7 — 15 Questions

Question 1

A retail company is launching a new mobile payment application. The risk practitioner is identifying risk response options for the risk of payment fraud. Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tokenization of payment card data. Tokenization and real-time fraud detection are both mitigation controls because they actively reduce the risk of payment fraud. Tokenization minimizes the value of stolen data, while fraud detection identifies and blocks suspicious transactions. The other options represent risk transfer, risk avoidance, and risk acceptance, which do not reduce the inherent risk.

Answer

Accepting the risk of fraud and monitoring it quarterly

Answer

Deciding not to offer mobile payments in certain countries

Answer

Purchasing cyber insurance to cover fraud losses

Question 2

A risk practitioner at a financial services firm is updating the risk register. For a risk involving unauthorized access to the customer database, the risk owner has decided to purchase a cyber liability insurance policy that covers breach-related costs. Which risk response option has the risk owner selected?

Accepted Answer

Risk transfer. The risk owner chose to purchase insurance, which is a financial arrangement that shifts the potential loss to an insurer. This is a textbook example of risk transfer. The other options do not match because the organization is not eliminating the activity (avoidance), not implementing controls to reduce likelihood or impact (mitigation), and not simply bearing the risk without action (acceptance).

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 3

A retail company's risk register shows that a point-of-sale system vulnerability has a high likelihood and high impact. The IT team proposes applying a vendor patch, but the patch has not been tested with the custom payment application. Which risk response strategy is being considered?

Accepted Answer

Risk mitigation. The IT team is proposing a patch to reduce the likelihood of exploitation, which is a mitigation response. Mitigation is the appropriate strategy when an organization chooses to implement controls to lower risk rather than accept, transfer, or avoid it. The untested patch introduces a secondary risk that must be managed, but the primary response strategy remains mitigation.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 4

A software development company is launching a new mobile application that will collect user location data. The risk manager identifies that the data collection could violate privacy regulations if not properly disclosed. The legal team recommends updating the privacy policy and obtaining explicit user consent. Which risk response strategy is this?

Accepted Answer

Risk mitigation. By updating the privacy policy and obtaining explicit consent, the company is implementing controls to reduce the likelihood of privacy violations. This is a mitigation strategy because it addresses the risk directly through compliance measures. Avoidance would mean not collecting data, transfer would involve shifting liability, and acceptance would mean doing nothing.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Question 5

A multinational corporation is implementing a risk treatment plan for a critical vendor that has poor security controls. The risk practitioner has recommended contract renegotiation to include security requirements, but the vendor refuses. The business unit insists on continuing the relationship due to cost savings. The risk practitioner's next step should be to:

Accepted Answer

Escalate the issue to the risk committee for a decision on risk acceptance.. The risk practitioner must escalate to the risk committee when the business unit refuses to mitigate a risk that exceeds appetite. The committee has the authority to accept the risk on behalf of the organization. Simply documenting or implementing controls without addressing the governance gap would leave the organization exposed without proper oversight.

Answer

Document the risk in the risk register and continue monitoring without escalation.

Answer

Implement compensating controls internally to reduce the vendor risk.

Answer

Terminate the vendor relationship immediately without further discussion.

Question 6

A healthcare organization's risk register shows that a critical server lacks vendor support and has a high inherent risk of failure. The risk owner proposes to implement redundant hardware and a failover cluster. The cost of the redundancy is $200,000, while the estimated annual loss from failure is $150,000. Which factor is MOST important for the risk practitioner to consider when evaluating this proposed risk response?

Accepted Answer

The cost of the control compared to the expected loss. The risk practitioner must perform a cost-benefit analysis. The proposed control costs $200,000, while the expected annual loss is $150,000, meaning the control costs more than the risk it mitigates. Unless there are intangible or regulatory factors, the response is not cost-effective. The most important factor is the comparison of control cost to expected loss, which guides whether to mitigate, accept, or seek a cheaper alternative.

Answer

The likelihood of the server failing in the next year

Answer

The risk tolerance of the IT department

Answer

The residual risk after implementing the redundancy

Question 7

A hospital's risk register identifies that a critical medical imaging server runs an unsupported operating system, creating a high likelihood of exploitation. The vendor will not release a patch, and the server cannot be taken offline because it supports active patient care. The CISO asks the risk practitioner to reduce the likelihood of exploitation without disrupting imaging services. Which risk response is MOST appropriate?

Accepted Answer

Isolate the imaging server on a dedicated network segment with strict firewall rules and deploy a host-based intrusion prevention system.. When a critical asset cannot be patched or replaced, compensating controls are the correct mitigation approach. Network segmentation limits lateral movement, and host-based IPS can detect and block exploitation attempts on the unsupported system. These measures reduce likelihood without requiring downtime, unlike acceptance, avoidance, or pure risk transfer, which do not address the technical vulnerability in this operational context.

Answer

Accept the risk because the server is essential to patient care and cannot be taken offline for replacement.

Answer

Avoid the risk by immediately decommissioning the imaging server and moving all imaging workloads to a cloud provider.

Answer

Transfer the risk by purchasing cyber insurance that covers medical device downtime and regulatory fines.

Question 8

A risk practitioner is reviewing the organization's risk register and notes that a critical web application has a high inherent risk of SQL injection. The development team proposes implementing a web application firewall (WAF) with virtual patching. The risk practitioner's primary responsibility in this scenario is to:

Accepted Answer

Evaluate whether the proposed control reduces risk to an acceptable level within the organization's risk appetite.. The risk practitioner's core duty is to evaluate risk responses, not to implement them or accept risk. In this scenario, the proposed WAF with virtual patching is a mitigation control. The practitioner must assess whether it reduces the SQL injection risk to a level consistent with the organization's risk appetite. This involves considering control effectiveness, potential residual risk, and cost-benefit. Only after this evaluation can the risk owner make an informed decision.

Answer

Immediately implement the WAF and virtual patching to address the vulnerability before any exploitation occurs.

Answer

Transfer the risk by purchasing cyber insurance that covers SQL injection attacks, since the WAF may not be fully effective.

Answer

Accept the risk because the WAF will eventually be deployed and the residual risk will be managed by the IT team.

Question 9

A multinational corporation is developing a risk treatment plan for a newly identified risk: a critical vendor's financial instability could disrupt the supply chain. The risk manager is considering several options. Which TWO of the following are examples of risk mitigation controls that directly reduce the likelihood or impact of this risk? (Choose two.)

Accepted Answer

Requiring the vendor to provide audited financial statements quarterly. Qualifying a second supplier and requiring audited financial statements are both mitigation controls. The second supplier reduces impact by providing redundancy, while financial monitoring reduces likelihood by enabling early intervention. Insurance and contract clauses transfer risk, and acceptance does nothing to reduce it, so they are not mitigation.

Answer

Accepting the risk and documenting it in the risk register

Answer

Purchasing supply chain insurance to cover losses from vendor failure

Answer

Transferring the risk to the vendor via a contract clause

Question 10

A risk manager is reviewing the organization's risk treatment plan for a critical web application. The plan includes implementing a web application firewall (WAF), conducting regular penetration tests, and purchasing cyber insurance. The risk manager notes that the residual risk after these treatments is still above the risk appetite. According to CRISC, what should the risk manager do NEXT?

Accepted Answer

Escalate the residual risk to senior management for a decision on whether to accept, further treat, or avoid the risk.. When residual risk exceeds the organization's risk appetite, it must be escalated to senior management, who are responsible for making risk-based decisions. They may choose to accept the risk, allocate resources for further mitigation, or avoid the activity. The risk manager's role is to inform and recommend, not to unilaterally decide or simply monitor.

Answer

Reassess the risk to ensure the risk assessment is accurate and adjust the risk score accordingly.

Answer

Update the risk register to reflect the residual risk and continue monitoring.

Answer

Implement additional controls immediately to reduce the residual risk to an acceptable level.

Question 11

A financial services firm is deploying a new trading platform. The risk committee has approved a risk treatment plan that includes a requirement to implement a circuit breaker that halts trading if losses exceed a predefined threshold. The project manager asks the risk practitioner to verify that the control is designed effectively before go-live. Which activity BEST validates the design of this risk mitigation control?

Accepted Answer

Review the control's technical specification and conduct a tabletop walkthrough with the trading and technology teams.. Design effectiveness testing confirms that a control, as planned, will mitigate the identified risk before it is relied upon. Reviewing specifications and walking through scenarios with stakeholders validates the logic, thresholds, and responsibilities. Live monitoring tests operating effectiveness, internal audit provides later assurance, and vendor documentation only confirms feature availability. The pre-go-live design validation is the most direct and timely way to confirm the circuit breaker will work as intended.

Answer

Monitor trading losses for the first month after go-live and confirm that the circuit breaker activates when the threshold is breached.

Answer

Confirm that the vendor's product documentation states the circuit breaker feature is included in the licensed version.

Answer

Ask the internal audit team to add the circuit breaker to the annual audit plan and review it during the next audit cycle.

Question 12

A retail company has identified that its point-of-sale (POS) terminals are running an outdated operating system that no longer receives security patches. The risk practitioner recommends upgrading the terminals to a supported OS. The cost of the upgrade is $500,000, while the estimated annual loss from a potential breach is $2,000,000 with a 30% likelihood. Which risk response strategy is being recommended?

Accepted Answer

Risk mitigation. Upgrading the POS terminals to a supported operating system is a mitigation strategy because it reduces the likelihood of a breach by addressing the unpatched vulnerability. The cost-benefit analysis ($500,000 upgrade vs. $600,000 expected annual loss) supports this action. Mitigation is appropriate when controls can reduce risk to an acceptable level.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 13

A retail company is launching a new e-commerce platform. The risk management team has identified that the platform's payment gateway integration could be exploited to intercept customer credit card data. The team proposes several controls. Which of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Encrypting payment data in transit using TLS 1.3. Risk mitigation controls reduce the likelihood or impact of a risk. Tokenization and TLS encryption both directly reduce the risk of credit card data interception by making the data unusable or unreadable to attackers. Cyber insurance transfers risk, avoiding online payments avoids risk, and outsourcing shares risk; none of these directly mitigate the technical vulnerability.

Answer

Purchasing cyber insurance to cover financial losses from a data breach

Answer

Deciding not to accept credit card payments online

Answer

Outsourcing the payment processing to a third-party provider

Question 14

A multinational bank has a risk appetite that allows for a maximum of 5% downtime for its online banking platform per quarter. The platform currently experiences 8% downtime due to frequent distributed denial-of-service (DDoS) attacks. The risk owner proposes investing in a cloud-based DDoS mitigation service. Which of the following should be the risk practitioner's PRIMARY consideration when evaluating this proposed risk response?

Accepted Answer

The expected reduction in downtime and whether it brings residual risk within the bank's risk appetite.. The risk practitioner's primary role is to evaluate whether a proposed risk response will bring residual risk within the organization's risk appetite. Here, the bank's risk appetite for downtime is 5%, but current downtime is 8%. The proposed DDoS mitigation service must be assessed for its ability to reduce downtime to 5% or less. This assessment should consider the service's effectiveness, reliability, and any residual risk. Cost, integration, and vendor reputation are secondary factors that inform the decision but do not replace the core risk-reduction evaluation.

Answer

The total cost of the service compared to the potential financial losses from downtime.

Answer

The service provider's reputation and market share in the DDoS mitigation industry.

Answer

The service provider's ability to integrate with the bank's existing incident response plan.

Question 15

A software development company uses a third-party cloud provider to host its source code repositories. The risk practitioner discovers that the provider's contract does not include a right-to-audit clause. The provider has a strong security reputation but is unwilling to add the clause. The company's risk appetite for third-party risk is low. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a risk assessment to determine the potential impact of the missing right-to-audit clause.. The first step in risk response is to assess the risk. The missing right-to-audit clause creates uncertainty about the provider's security controls, which is particularly concerning given the low risk appetite. A risk assessment will evaluate the likelihood and impact, allowing the risk practitioner to recommend an appropriate response, such as negotiating alternative assurance, accepting with compensating controls, or terminating the contract.

Answer

Terminate the contract and migrate the source code to an in-house data center.

Answer

Request that the provider provide a SOC 2 Type II report as a compensating control.

Answer

Accept the risk because the provider has a strong security reputation.