CRISC Risk Response and Mitigation Practice Question
A multinational corporation is deploying a new IoT-based inventory management system across its warehouses. The risk practitioner identifies that the IoT devices use default administrative credentials and unencrypted communication protocols. The vendor states that a firmware update to address these issues will not be available for six months. The business cannot delay the deployment due to competitive pressures. Which risk response strategy is MOST appropriate in this situation?
⚠ Common exam trap
The trap here is assuming that risk transfer through insurance or avoidance is always preferable, when in fact business constraints often necessitate risk acceptance with compensating controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accept the risk and proceed with deployment, documenting the decision and implementing compensating controls such as network segmentation and monitoring.
Given the business imperative to deploy and the unavailability of a timely patch, risk acceptance with compensating controls is the most appropriate response. This approach acknowledges the residual risk while reducing it through segmentation and monitoring. It also documents the decision for future review, aligning with CRISC principles of balancing risk and business objectives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Accept the risk and proceed with deployment, documenting the decision and implementing compensating controls such as network segmentation and monitoring.
Why this is correct
When a risk cannot be avoided or mitigated immediately due to business constraints, acceptance with compensating controls is appropriate. Network segmentation and monitoring reduce the likelihood and impact of exploitation. Documenting the decision ensures accountability and provides a basis for future risk reassessment once the firmware update is available.
- ✗
Transfer the risk by purchasing cyber insurance that covers IoT-related breaches.
Why it's wrong here
Risk transfer via insurance does not eliminate the underlying vulnerability. Insurance may cover financial losses but does not prevent breaches or address the default credentials and unencrypted protocols. The business still faces operational and reputational damage. Transfer is not the most appropriate primary response when compensating controls can reduce risk to an acceptable level.
- ✗
Avoid the risk by canceling the IoT deployment and continuing with the existing manual inventory process.
Why it's wrong here
Avoidance would eliminate the risk but is not feasible because the business cannot delay deployment due to competitive pressures. Avoidance is typically used when the risk is unacceptable and no compensating controls can reduce it. Here, the business has decided to proceed, so avoidance contradicts the business requirement and is not the most appropriate strategy.
- ✗
Mitigate the risk by immediately replacing the IoT devices with a different vendor's products that have better security features.
Why it's wrong here
Replacing devices may not be feasible due to cost, time, or contractual obligations, and the scenario does not indicate that an alternative vendor is readily available. Mitigation through replacement is ideal but impractical here. The most realistic response is to accept the risk with compensating controls until the firmware update can be applied.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.