CRISC Risk Response and Mitigation Practice Question
An organization has a policy requiring all sensitive data to be encrypted at rest. During an audit, it is found that encryption keys are stored in plaintext on the same server. Which risk response is MOST appropriate?
⚠ Common exam trap
The trap here is that candidates mistakenly believe that simply having encryption applied (option C) is sufficient, overlooking the critical requirement that encryption keys must be protected separately from the data they encrypt—a fundamental principle of cryptographic security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate by encrypting the key file
Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avoid by removing the data
Why it's wrong here
Avoid would mean eliminating the underlying business need for that data altogether — removing data the organization has already determined it needs to keep (per the policy requiring it be encrypted at rest) doesn't address the actual defect, which is that the encryption keys are exposed. Encrypting the keys (Mitigate) directly fixes that specific control gap without removing a retained business asset.
- ✓
Mitigate by encrypting the key file
Why this is correct
Encrypting the keys protects them, reducing the risk of unauthorized decryption.
- ✗
Accept the risk because encryption is still applied
Why it's wrong here
The keys are exposed, so encryption can be bypassed; accepting is not appropriate.
- ✗
Transfer the risk to a cloud provider
Why it's wrong here
Transfer is not directly relevant; the organization owns the server.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.