CCNA Risk Response and Mitigation Questions

When the cost of a control exceeds the ALE and the risk is already within the organization's risk appetite, accepting the risk is the economically justified response. Spending $500k to mitigate a $300k annualized loss is not cost-effective, and the risk is tolerable by definition.

Acceptance is the most appropriate response because the vulnerability exists in a legacy application that supports a non-critical business process and is used by a small number of users. The cost and operational impact of patching or replacing the application outweigh the risk, making it acceptable to operate with the known vulnerability under formal risk acceptance.

When the residual risk remains above the risk tolerance but the cost of further mitigation exceeds the potential loss, the most appropriate step is to formally accept the residual risk. This decision is based on a cost-benefit analysis showing that additional controls are not economically justified. The risk owner documents the acceptance, acknowledging the remaining exposure within the organization's risk appetite framework.

The risk manager is comparing the cost of implementing the WAF against the likelihood and potential impact of a SQL injection attack. This direct comparison of mitigation cost to risk reduction benefit is the essence of a cost-benefit analysis, which determines whether the control is economically justified. It is not a calculation of residual or inherent risk, nor is it an acceptance decision.

Sandboxing the vulnerable library is a mitigation response because it adds a compensating control that reduces the impact of a potential exploit. Since no patch is available and downtime is not acceptable, mitigation through isolation is the most practical strategy. This approach lowers risk while maintaining product availability for customers.

The best response is to reduce risk through compensating controls while the long-term replacement is planned. Because the pumps cannot be removed and replacement is 18 months away, the risk practitioner should recommend interim mitigation that lowers exposure without disrupting patient care. This aligns with the CRISC principle of selecting a response proportionate to risk and maintaining operations.

Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.

R-0042 is a low-likelihood, low-impact risk involving PII stored with AES-256 encryption and strict access controls. The residual risk is within the organization's risk appetite, making acceptance with continued monitoring the most appropriate response. Mitigation, transfer, or avoidance would introduce unnecessary cost or operational disruption for a risk already well-controlled.

Full data reconciliation is the correct risk response because the company has a low tolerance for data integrity issues and the risk of data corruption could cause production delays. While time-consuming, this approach directly mitigates the identified risk by ensuring all migrated data is verified, aligning with the risk appetite. Sampling would leave a margin of error unacceptable for a low-tolerance environment, and the other options either fail to address the risk or are impractical.

Network segmentation reduces the attack surface by isolating the vulnerable system, which is a classic risk mitigation technique. Purchasing cyber insurance transfers the financial risk of residual losses to a third party, making 'Transfer' the correct second option. Together, these actions address the risk without removing the vulnerability.

The residual risk has a probability of 5% and a potential loss of $10 million, resulting in an expected loss of $500,000. The organization's risk appetite allows a maximum probability of 3% for such an impact, so the current risk exceeds the acceptable threshold. Implementing additional controls for $1 million to reduce the probability to 2% brings the risk within the risk appetite (expected loss of $200,000) and is cost-effective because the reduction in expected loss ($300,000) is less than the control cost, but the primary driver is compliance with risk appetite, not pure cost-benefit.

The first step in risk response is to assess the risk. The missing right-to-audit clause creates uncertainty about the provider's security controls, which is particularly concerning given the low risk appetite. A risk assessment will evaluate the likelihood and impact, allowing the risk practitioner to recommend an appropriate response, such as negotiating alternative assurance, accepting with compensating controls, or terminating the contract.

The risk practitioner must escalate to the risk committee when the business unit refuses to mitigate a risk that exceeds appetite. The committee has the authority to accept the risk on behalf of the organization. Simply documenting or implementing controls without addressing the governance gap would leave the organization exposed without proper oversight.

The risk owner chose to purchase insurance, which is a financial arrangement that shifts the potential loss to an insurer. This is a textbook example of risk transfer. The other options do not match because the organization is not eliminating the activity (avoidance), not implementing controls to reduce likelihood or impact (mitigation), and not simply bearing the risk without action (acceptance).

Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.

Given the business imperative to deploy and the unavailability of a timely patch, risk acceptance with compensating controls is the most appropriate response. This approach acknowledges the residual risk while reducing it through segmentation and monitoring. It also documents the decision for future review, aligning with CRISC principles of balancing risk and business objectives.

Upgrading the POS terminals to a supported operating system is a mitigation strategy because it reduces the likelihood of a breach by addressing the unpatched vulnerability. The cost-benefit analysis ($500,000 upgrade vs. $600,000 expected annual loss) supports this action. Mitigation is appropriate when controls can reduce risk to an acceptable level.

The correct answer is risk mitigation. By moving backups to an off-site facility, the organization implements a control that reduces the risk of flood damage. This is a classic example of mitigation, where the goal is to lower the probability or impact of a threat, rather than avoiding the activity or transferring the risk.

The best response reduces residual risk to within appetite while respecting the business constraint against a 12-hour outage. Database replication provides a compensating control that enables patching with minimal downtime, effectively mitigating the vulnerability. Acceptance, transfer, and avoidance either leave risk above appetite or introduce unacceptable business disruption.

The most appropriate risk response is to issue a corrective action plan with a deadline and monitoring, because it directly addresses the control gap (lapsed certification) while preserving the strategic relationship. ISO 27001 certification is a contractual requirement and a key risk mitigation control; its loss increases risk even if other controls exist. A corrective action plan is a targeted risk treatment that restores compliance and provides assurance through monthly reviews, aligning with CRISC's emphasis on balancing risk and business objectives.

After implementing risk mitigation controls, the risk practitioner must ensure the risk register is updated with the new residual risk score and that the risk owner formally accepts the remaining risk. This confirms that the risk treatment has been effective and that the residual risk is within the defined risk appetite. Documentation and sign-off are essential for auditability and governance.

Cyber insurance transfers a portion of the financial risk to the insurer, but the organization retains residual risk, including non-financial impacts and any uncovered losses. The residual risk is not eliminated or reduced to zero; it remains but with a lower financial exposure. This is a key concept in risk response: transference does not remove all risk.

Continuous monitoring with automated alerts ensures that controls are consistently effective by detecting failures or deviations quickly. In a cloud environment, where changes are frequent, periodic assessments or audits are insufficient. Continuous monitoring provides ongoing assurance and supports timely risk response, aligning with CRISC best practices for maintaining risk within appetite.

The vendor's refusal to remediate high-risk findings directly violates the contract's security standards clause, and the organization's low risk appetite for third-party risk means that accepting or mitigating the residual risk is unacceptable. Terminating the contract (avoidance) is the only response that eliminates the risk entirely, aligning with the principle that when a third party cannot or will not meet required security controls, the relationship should be severed to prevent potential data breaches or compliance violations.

When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Implementing a firewall is a risk mitigation control because it reduces the likelihood and impact of unauthorized network access by enforcing access control policies based on source/destination IP addresses, ports, and protocols. Firewalls operate at Layers 3 and 4 (and sometimes Layer 7) of the OSI model to filter traffic, thereby directly reducing the attack surface and preventing exploitation of vulnerabilities.

When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

The correct answer is risk mitigation. By integrating automated security testing into the CI/CD pipeline, the company is implementing a control that reduces the likelihood of vulnerabilities reaching production. This is a proactive mitigation strategy that aligns with CRISC's emphasis on embedding risk management into business processes.

When a critical asset cannot be patched or replaced, compensating controls are the correct mitigation approach. Network segmentation limits lateral movement, and host-based IPS can detect and block exploitation attempts on the unsupported system. These measures reduce likelihood without requiring downtime, unlike acceptance, avoidance, or pure risk transfer, which do not address the technical vulnerability in this operational context.

The correct answer is to perform additional risk response because residual risk still exceeds the risk appetite. CRISC emphasizes that risk treatment is iterative: after controls are applied, if residual risk is not within appetite, further action is needed. This could include additional controls, risk avoidance, or transfer, but the key is to continue treatment until risk is acceptable.

B is correct because tuning the system involves adjusting detection thresholds, rules, or machine learning models to reduce false positives while maintaining sensitivity to actual fraud. This directly addresses the root cause—poorly calibrated detection logic—without sacrificing the system's primary function or incurring unsustainable costs.

The correct matches are: Avoid – decision to not perform the activity; Accept – formal acceptance of risk; Mitigate – reduce likelihood/impact; Transfer – shift to another party. Common confusions include mixing transfer with avoidance and acceptance with mitigation.

When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

The correct answer is to mitigate the risk by implementing data localization controls. This approach directly addresses the legal requirement while allowing the ERP deployment to continue. Risk mitigation is appropriate when the risk can be reduced to an acceptable level through controls, and it balances business needs with compliance obligations.

Implementing surveillance and background checks are preventive controls that reduce the likelihood of employee theft. This is a classic risk mitigation strategy, as the company is taking direct action to lower the risk rather than accepting, avoiding, or transferring it. Mitigation is appropriate when the risk is significant and controls can cost-effectively reduce it.

The organization is reducing the likelihood and impact of the vulnerability by adding a WAF and performing regular penetration tests. These actions are classic risk mitigation controls that lower residual risk. Avoidance would mean discontinuing the online banking service, transfer would involve insurance, and acceptance would mean no action.

Risk avoidance involves taking action to eliminate the risk entirely by not engaging in the activity that introduces it. Option C, 'Deciding not to enter a new market,' avoids all associated market, regulatory, and competitive risks by simply not pursuing that business opportunity. Option E, 'Discontinuing a risky product line,' removes the risk by ceasing the activity that generates it, such as halting production of a product with known safety or compliance issues.

Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Implementing encryption, access controls, and backups are all mitigation actions that reduce the likelihood or impact of a breach. The organization is actively managing the risk rather than avoiding, transferring, or accepting it. Therefore, the risk response strategy is mitigation.

Implementing a DDoS mitigation service is a classic example of risk mitigation because it reduces the likelihood or impact of a threat. The risk is not avoided (the service continues), not transferred (the firm retains responsibility), and not accepted (action is taken). Mitigation controls are designed to bring residual risk within the organization's risk appetite.

Purchasing insurance is a classic example of risk transfer, where the financial impact of a risk is shifted to an insurance provider. The risk event (hurricane) still occurs, but the firm is compensated for losses, protecting its financial stability. This strategy is appropriate when the risk is high-impact but low-frequency, and the cost of insurance is justified.

When residual risk exceeds the organization's risk appetite, it must be escalated to senior management, who are responsible for making risk-based decisions. They may choose to accept the risk, allocate resources for further mitigation, or avoid the activity. The risk manager's role is to inform and recommend, not to unilaterally decide or simply monitor.

Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.

Control implementation involves design, procurement/build, testing, deployment, and monitoring.

The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.

Tokenization and real-time fraud detection are both mitigation controls because they actively reduce the risk of payment fraud. Tokenization minimizes the value of stolen data, while fraud detection identifies and blocks suspicious transactions. The other options represent risk transfer, risk avoidance, and risk acceptance, which do not reduce the inherent risk.

Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Dual-sourcing is a risk mitigation technique that reduces the likelihood of supply chain disruption by providing an alternative source. It does not transfer, avoid, or accept the risk; it actively reduces it. The primary benefit is increased resilience and reduced dependency on a single supplier.

When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

By updating the privacy policy and obtaining explicit consent, the company is implementing controls to reduce the likelihood of privacy violations. This is a mitigation strategy because it addresses the risk directly through compliance measures. Avoidance would mean not collecting data, transfer would involve shifting liability, and acceptance would mean doing nothing.

Purchasing a business continuity insurance policy transfers the financial impact of the risk to a third party (the insurer), which is the definition of the transfer response. The vendor's robust controls address some risk, but the geopolitical risk remains and is being shifted via insurance. This is a classic example of risk transfer through insurance.

A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

The incident revealed that the existing risk treatment (SLA financial penalties) was insufficient to address the actual impact (reputational damage and loss of customer trust). The risk practitioner must reassess the risk with the new information and recommend a more robust mitigation strategy, such as multi-cloud architecture, to reduce the likelihood or impact of a single provider's outage affecting critical customer-facing applications.

Qualifying a second supplier and requiring audited financial statements are both mitigation controls. The second supplier reduces impact by providing redundancy, while financial monitoring reduces likelihood by enabling early intervention. Insurance and contract clauses transfer risk, and acceptance does nothing to reduce it, so they are not mitigation.

Before recommending a risk response, the practitioner must confirm alignment with the organization's risk appetite and tolerance. The cost-benefit analysis supports the redundancy, but appetite alignment ensures the response is consistent with governance and strategic objectives. Evaluating appetite and tolerance is the overarching criterion that determines whether a control is appropriate, not merely whether it is affordable or technically feasible.

The residual risk is a sophisticated phishing attack that could bypass MFA, and the board has a low risk appetite, so the risk must be reduced rather than transferred or accepted. Implementing phishing-resistant MFA such as FIDO2/WebAuthn (hardware security keys or passkeys) removes the shared-secret and OTP weaknesses that phishing kits exploit, and pairing it with ongoing phishing simulation training hardens the human layer. This directly addresses the specific residual risk while preserving the business value of the online banking platform.

Mitigating the risk by implementing encryption is the most appropriate response because the cost is moderate and the risk of non-compliance is high. Encryption directly addresses the regulatory requirement and reduces the risk to an acceptable level. This aligns with risk management principles where high-impact risks with feasible controls should be mitigated.

The IT team is proposing a patch to reduce the likelihood of exploitation, which is a mitigation response. Mitigation is the appropriate strategy when an organization chooses to implement controls to lower risk rather than accept, transfer, or avoid it. The untested patch introduces a secondary risk that must be managed, but the primary response strategy remains mitigation.

Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Assigned responsibilities are a key component of an effective risk treatment plan because they ensure accountability for implementing specific risk mitigation actions. Without clear ownership, tasks may be delayed or overlooked, undermining the plan's execution. This aligns with the CRISC framework's emphasis on defining roles to operationalize risk response.

CSA involves defining scope, identifying controls, assessing effectiveness, gap identification, and reporting.

(Transfer) is correct because purchasing breach insurance transfers the financial risk of a data breach to an insurance provider. Option C (Avoid) is correct because disabling the APIs until they are secured eliminates the risk entirely by removing the vulnerable component. Option D (Mitigate) is correct because implementing a Web Application Firewall (WAF) reduces the likelihood or impact of an API-based attack without removing the API.

The best way to address the risk that a vendor's security controls may not meet requirements is to include explicit security requirements in the contract and perform regular vendor audits. This contractual and assurance-based approach directly mitigates the risk by establishing enforceable obligations and ongoing verification. It aligns with risk management principles of treating risk through controls and monitoring rather than ignoring, transferring, or eliminating the business capability.