CRISC Risk Response and Mitigation Practice Question
A small e-commerce company has identified a high-risk vulnerability in its payment processing system that could expose customer credit card data. The IT team recommends immediately patching the system, but the patch requires a 4-hour downtime during peak sales hours. The risk manager proposes accepting the risk until the next scheduled maintenance window in two weeks. The CEO is concerned about potential fines from PCI DSS non-compliance. What is the BEST course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.
The best course of action because implementing a compensating control (such as a web application firewall) immediately reduces the risk of data exposure while the patch is scheduled during off-peak hours within 48 hours, addressing PCI DSS compliance concerns without incurring significant revenue loss. Option A is wrong because accepting the risk without immediate mitigation violates PCI DSS requirements and exposes the company to fines. Option B is wrong because simply accepting the risk until the next maintenance window does not address the high-risk vulnerability and compliance obligations. Option C is wrong because applying the patch during peak hours causes excessive revenue loss and customer impact, whereas the compensating control approach provides a balanced risk response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delay the patch until the next maintenance window but document the risk acceptance with CEO sign-off.
Why it's wrong here
Delaying leaves high risk exposed and does not address PCI DSS requirements.
- ✗
Accept the risk and schedule the patch during the next maintenance window as originally planned.
Why it's wrong here
Accepting the risk disregards PCI DSS non-compliance fines.
- ✗
Apply the patch immediately during peak hours, accepting the revenue loss from downtime.
Why it's wrong here
Immediate patching during peak hours causes significant revenue loss; a less disruptive approach is better.
- ✓
Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.
Why this is correct
Compensating controls reduce risk while allowing a timely patch without peak-hour disruption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.