CRISC Risk Response and Mitigation Practice Question
A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?
⚠ Common exam trap
Test-takers frequently confuse risk transfer (insurance) as a primary solution for high downtime costs, overlooking that insurance does not prevent the operational impact and lost revenue during the outage itself, which is the core concern in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk reduction by implementing redundant systems
Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk avoidance by decommissioning the system
Why it's wrong here
Decommissioning removes the capability the business depends on, which contradicts the BIA showing extreme downtime cost. It is tempting because avoidance eliminates the risk outright, and it would be correct where the system's function can be discontinued or replaced without material business loss.
- ✗
Risk transfer through cyber insurance
Why it's wrong here
Insurance compensates financial loss after an outage but does not reduce the downtime itself, which the BIA identifies as the dominant cost. It is tempting because transfer shifts financial exposure, and it would be correct where the primary impact is monetary rather than operational continuity.
- ✓
Risk reduction by implementing redundant systems
Why this is correct
Redundant systems directly address the extreme downtime cost identified in the business impact analysis by eliminating single points of failure. Failover to a standby component maintains availability during hardware or service faults, reducing the probability and duration of outages. This satisfies the mitigation objective where downtime losses outweigh the cost of duplicate infrastructure.
- ✗
Risk acceptance because mitigation is too costly
Why it's wrong here
Acceptance leaves the high-cost downtime exposure unaddressed, which the BIA explicitly rules out. It is tempting because mitigation cost may exceed some risks, and acceptance would be correct where the potential loss is low relative to the cost of controls.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.