CRISC Risk Response and Mitigation Practice Question
A risk practitioner is reviewing the organization's risk response plan for a database containing personally identifiable information (PII). The plan states that the database will be encrypted at rest, access will be restricted to authorized personnel, and regular backups will be performed. Which risk response strategy is being applied?
⚠ Common exam trap
The trap here is overthinking and selecting risk transfer because backups might seem like insurance, but they are actually a mitigation control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
Implementing encryption, access controls, and backups are all mitigation actions that reduce the likelihood or impact of a breach. The organization is actively managing the risk rather than avoiding, transferring, or accepting it. Therefore, the risk response strategy is mitigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk mitigation
Why this is correct
The plan includes encryption, access restrictions, and backups, all of which are controls designed to reduce the likelihood and impact of a data breach. These actions are characteristic of risk mitigation, where the organization takes steps to lower risk to an acceptable level while continuing the business activity. The strategy is clearly mitigation.
- ✗
Risk transfer
Why it's wrong here
Risk transfer involves shifting the financial consequences to a third party, such as through insurance or outsourcing. The described controls are implemented internally and do not transfer risk; they reduce it directly. No third party is mentioned as bearing the risk, so transfer is incorrect.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance would involve eliminating the database or the processing of PII altogether. The plan instead implements controls to protect the database, indicating that the organization continues to accept the activity but with safeguards. Avoidance is not the strategy here because the risk is being managed, not eliminated.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance means no action is taken to reduce the risk. Here, multiple controls are being applied, so the organization is not simply accepting the risk. Acceptance would be appropriate only if the risk were within appetite and no further action was deemed necessary, which is not the case.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.