CRISC Risk Response and Mitigation Practice Question
A financial institution is implementing a new online banking platform. The risk assessment identified that the platform will handle sensitive customer data and must comply with GDPR and local banking regulations. The project team proposes encrypting all data at rest and in transit, implementing multi-factor authentication (MFA), and conducting quarterly penetration tests. However, the risk owner is concerned about the residual risk of a sophisticated phishing attack that could bypass MFA. The board has a low risk appetite. What is the BEST way to address this residual risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.
It addresses the specific residual risk with a targeted control (phishing simulations and training) without overcomplicating the project. Option A is wrong because purchasing insurance does not reduce the likelihood of an attack. Option C is wrong because stopping the project is a disproportionate response to a manageable risk. Option D is wrong because accepting the residual risk conflicts with the board's low risk appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Purchase cyber insurance to transfer the financial impact of a potential phishing attack.
Why it's wrong here
Purchasing cyber insurance transfers the financial impact but does not reduce the likelihood of a phishing attack.
- ✓
Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.
Why this is correct
It directly addresses the residual risk of sophisticated phishing by implementing phishing-resistant MFA and employee training, which aligns with the board's low risk appetite.
- ✗
Reduce the project scope to exclude online banking and revert to a less risky channel.
Why it's wrong here
Reducing project scope is a disproportionate response that may not be necessary given the targeted controls available.
- ✗
Accept the residual risk because the existing controls (encryption, MFA, pen tests) already provide reasonable assurance.
Why it's wrong here
Accepting the residual risk conflicts with the board's stated low risk appetite.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.