CRISC Risk Response and Mitigation Practice Question
A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?
⚠ Common exam trap
A common mix-up: candidates choose 'avoid' (Option A) as the safest response, but the CRISC exam expects you to recognize that risk can be mitigated to an acceptable level using legal and technical controls, rather than automatically avoiding the risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require the vendor to sign standard contractual clauses and encrypt all data
Standard Contractual Clauses (SCCs) are a GDPR-approved transfer mechanism that legally binds the vendor to EU data protection standards, even in a weak-law jurisdiction. Combined with encryption of all data at rest and in transit, this provides both a legal and technical safeguard, reducing the risk of non-compliance to an acceptable level without abandoning the vendor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avoid by choosing a vendor in a country with strong data protection laws
Why it's wrong here
Avoidance may not be feasible if no suitable vendor exists.
- ✓
Require the vendor to sign standard contractual clauses and encrypt all data
Why this is correct
This mitigates risk to an acceptable level under GDPR.
- ✗
Accept the risk because the vendor offers the best price
Why it's wrong here
Accepting legal risk is not advisable.
- ✗
Purchase cyber insurance to cover potential fines
Why it's wrong here
Insurance does not prevent non-compliance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.