CRISC Risk Response and Mitigation Practice Question
A retail company is launching a new e-commerce platform. The risk management team has identified that the platform's payment gateway integration could be exploited to intercept customer credit card data. The team proposes several controls. Which of the following are examples of risk mitigation controls? (Choose two.)
⚠ Common exam trap
The trap here is misclassifying risk transfer or avoidance as mitigation, especially when controls like insurance or outsourcing feel like active responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypting payment data in transit using TLS 1.3
Risk mitigation controls reduce the likelihood or impact of a risk. Tokenization and TLS encryption both directly reduce the risk of credit card data interception by making the data unusable or unreadable to attackers. Cyber insurance transfers risk, avoiding online payments avoids risk, and outsourcing shares risk; none of these directly mitigate the technical vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encrypting payment data in transit using TLS 1.3
Why this is correct
Encrypting payment data in transit with TLS 1.3 is a risk mitigation control that protects the confidentiality and integrity of data as it travels between the customer and the payment gateway. It reduces the likelihood of successful interception and unauthorized access, directly addressing the risk of data compromise during transmission.
- ✗
Purchasing cyber insurance to cover financial losses from a data breach
Why it's wrong here
Cyber insurance is a risk transfer control, not a mitigation control. It shifts the financial impact of a breach to an insurer but does not reduce the likelihood or impact of the data interception itself. While valuable, it does not prevent or limit the technical exploit; it only compensates for losses after an incident.
- ✗
Deciding not to accept credit card payments online
Why it's wrong here
Deciding not to accept credit card payments online is risk avoidance, which eliminates the risk by discontinuing the activity. While it removes the risk, it is not a mitigation control because it does not reduce the risk; it avoids it entirely. The scenario asks for mitigation controls, which aim to reduce risk while continuing the business activity.
- ✗
Outsourcing the payment processing to a third-party provider
Why it's wrong here
Outsourcing payment processing is a form of risk transfer or sharing, as it shifts some risk to the third party. It is not a mitigation control because it does not directly reduce the likelihood or impact of interception; it changes who is responsible. The organization may still retain reputational and compliance risks, so it is not a pure mitigation.
- ✓
Implementing tokenization to replace sensitive card data with non-sensitive equivalents
Why this is correct
Tokenization is a risk mitigation control that reduces the impact of a data breach by replacing sensitive credit card numbers with tokens that have no intrinsic value. If the tokenized data is intercepted, it cannot be used for fraudulent transactions, thereby mitigating the risk of data theft and its consequences. This directly addresses the identified risk of interception.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.