CRISC Risk Response and Mitigation Practice Question
Exhibit
Refer to the exhibit. Risk Register Excerpt: Asset: Customer Database Inherent Risk (Likelihood: High, Impact: High) => High Control Set: Access controls (effective), Encryption (effective), Intrusion Detection (moderate) Current Residual Risk: Medium Mitigation Options: A. Implement additional monitoring (cost: $50k, reduces residual to Low) B. Accept the residual risk (cost: $0) C. Transfer via cyber insurance (premium: $30k) D. Avoid by discontinuing database operations (cost: $2M) What is the most appropriate risk response given the current residual risk is Medium and the organization's risk appetite is Low?
Refer to the exhibit. Given the organization's risk appetite is Low, which risk response is most appropriate?
⚠ Common exam trap
ISACA often tests the misconception that transferring risk (e.g., insurance) eliminates the risk itself, when in fact it only covers financial loss, leaving the operational risk level unchanged.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement additional monitoring to reduce residual risk to Low.
With a Low risk appetite, the organization requires residual risk to be Low. Option D proposes implementing additional monitoring to reduce the Medium residual risk to Low, which aligns with the risk appetite. This is a corrective response that mitigates the risk without unnecessary business disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the current residual risk because it is Medium.
Why it's wrong here
Incorrect: The risk appetite is Low, so Medium residual risk is unacceptable.
- ✗
Avoid the risk by discontinuing operations.
Why it's wrong here
Incorrect: Avoidance is too extreme and costly compared to the mitigation option.
- ✗
Transfer the risk via insurance.
Why it's wrong here
Incorrect: Insurance transfers financial impact but does not reduce the likelihood; residual risk remains Medium.
- ✓
Implement additional monitoring to reduce residual risk to Low.
Why this is correct
Correct: This aligns with the low risk appetite by reducing residual risk to an acceptable level.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.