CRISC Risk Response and Mitigation Practice Question
A software development company is adopting a DevOps model and wants to accelerate deployments. The risk manager is concerned that rapid changes could introduce security vulnerabilities. The team proposes implementing automated security testing in the CI/CD pipeline. Which of the following BEST describes the risk response strategy being applied?
⚠ Common exam trap
The trap here is thinking that adding security testing to a fast-paced process is avoidance or acceptance; it is mitigation because it reduces risk while allowing the business activity to continue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
The correct answer is risk mitigation. By integrating automated security testing into the CI/CD pipeline, the company is implementing a control that reduces the likelihood of vulnerabilities reaching production. This is a proactive mitigation strategy that aligns with CRISC's emphasis on embedding risk management into business processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk mitigation
Why this is correct
Automated security testing in the CI/CD pipeline is a mitigation control because it reduces the likelihood of security vulnerabilities being introduced into production. It addresses the risk by integrating security checks early and continuously, thus lowering the probability of a breach.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance would mean not adopting DevOps or not deploying changes rapidly. The company is proceeding with DevOps but adding controls, so it is not avoiding the risk. Avoidance eliminates the activity that creates the risk.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance would mean acknowledging the risk and taking no action. The company is implementing automated testing to reduce the risk, so it is not accepting it. Acceptance is a passive response, whereas here there is an active control.
- ✗
Risk transfer
Why it's wrong here
Risk transfer involves shifting the risk to another party, such as through insurance or outsourcing. Automated security testing does not transfer the risk; it is an internal control that reduces the risk of vulnerabilities being deployed. The organization retains the risk.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.