The correct answer is to reduce the risk by implementing the cloud-based DDoS protection service, accepting the cost increase. This is the best risk treatment decision because the current on-premise appliance, with a 10 Gbps capacity, is fundamentally inadequate against modern DDoS attacks that routinely exceed 100 Gbps, leaving the e-commerce company exposed to catastrophic downtime and revenue loss. Migrating to a cloud-based service that scales elastically to 200 Gbps directly reduces the risk to a level that aligns with the company’s moderate risk appetite for availability, and the 40% cost increase is a justified investment compared to the potential losses from a successful attack. On the CRISC exam, this scenario tests your ability to prioritize risk reduction over cost avoidance when the residual risk from an inadequate control exceeds the organization’s risk appetite. A common trap is choosing to accept or transfer the risk based solely on cost concerns, but the key is recognizing that an on-premise solution cannot match the elastic scalability of cloud-based DDoS protection. Memory tip: think “Scale or Fail”—if your defense can’t match the attack volume, you must reduce the risk, not just accept it.
CRISC IT Risk Assessment Practice Question
This CRISC practice question tests your understanding of it risk assessment. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A large e-commerce company is assessing the risk of a distributed denial-of-service (DDoS) attack on its web applications. The company has experienced three DDoS attacks in the past year, each causing significant downtime and revenue loss. The current mitigation strategy relies on an on-premise appliance that can handle up to 10 Gbps of attack traffic. Recent industry reports indicate that DDoS attacks are growing in volume and sophistication, with some exceeding 100 Gbps. The company's risk appetite for availability is moderate. The security team has proposed migrating to a cloud-based DDoS protection service that scales to 200 Gbps, but it will increase annual operational costs by 40%. The business is concerned about the cost increase. Which of the following is the BEST risk treatment decision?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reduce the risk by implementing the cloud-based DDoS protection service, accepting the cost increase.
Option C is correct because the current on-premise appliance (10 Gbps capacity) is insufficient against modern DDoS attacks that can exceed 100 Gbps, as noted in industry reports. Migrating to a cloud-based DDoS protection service that scales to 200 Gbps directly reduces the risk to a level aligned with the company's moderate risk appetite for availability, despite the 40% cost increase. The business concern about cost is secondary to the necessity of mitigating a risk that could cause catastrophic revenue loss, and the cloud service provides elastic scalability that an on-premise upgrade cannot match.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Transfer the risk by purchasing business interruption insurance that covers revenue loss during outages.
Why it's wrong here
Insurance does not prevent reputational damage.
✗
Accept the risk because the company has survived previous attacks and the cost of mitigation is high.
Why it's wrong here
Acceptance ignores increasing threat landscape.
✓
Reduce the risk by implementing the cloud-based DDoS protection service, accepting the cost increase.
Why this is correct
Scalable solution matches risk appetite.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Reduce the risk by upgrading the on-premise appliance to handle up to 50 Gbps, which is within budget.
Why it's wrong here
50 Gbps may still be insufficient for large attacks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may choose Option D (upgrading to 50 Gbps) because it appears to be a cost-effective risk reduction, but they overlook that it still leaves the organization exposed to attacks exceeding 50 Gbps, which is a common scenario given the trend toward 100+ Gbps attacks, and fails to meet the moderate risk appetite for availability.
Detailed technical explanation
How to think about this question
Cloud-based DDoS protection services (e.g., AWS Shield Advanced, Cloudflare, Akamai) use anycast routing to distribute attack traffic across multiple global scrubbing centers, absorbing volumetric attacks that would overwhelm a single on-premise appliance. The 10 Gbps appliance likely uses a stateful inspection engine that can be exhausted by SYN floods or UDP amplification attacks, whereas cloud services can filter traffic at Layers 3-7 using rate limiting, IP reputation, and behavioral analysis. In practice, a 50 Gbps on-premise upgrade would still require significant capital expenditure and cannot dynamically scale beyond its fixed capacity, unlike cloud services that can handle multi-terabit attacks by leveraging distributed infrastructure.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CRISC exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
IT Risk Assessment — This question tests IT Risk Assessment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Reduce the risk by implementing the cloud-based DDoS protection service, accepting the cost increase. — Option C is correct because the current on-premise appliance (10 Gbps capacity) is insufficient against modern DDoS attacks that can exceed 100 Gbps, as noted in industry reports. Migrating to a cloud-based DDoS protection service that scales to 200 Gbps directly reduces the risk to a level aligned with the company's moderate risk appetite for availability, despite the 40% cost increase. The business concern about cost is secondary to the necessity of mitigating a risk that could cause catastrophic revenue loss, and the cloud service provides elastic scalability that an on-premise upgrade cannot match.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.