Risk Mitigation Through Redundancy: A Practical Example
A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?
Quick Answer
The correct answer is risk mitigation, as building a secondary data center in a different region and replicating critical data directly reduces the likelihood and impact of a flood-related outage. This is a textbook example of risk mitigation through redundancy, where controls are implemented to lower residual risk rather than eliminate the source entirely. On the Certified in Risk and Information Systems Control CRISC exam, this scenario tests your ability to distinguish mitigation from other risk responses—avoidance would require relocating the primary site, transfer would involve purchasing flood insurance, and acceptance would mean taking no action. A common trap is confusing redundancy with avoidance, but remember that mitigation keeps the original asset in place while adding protective layers. Memory tip: “Mitigation means making it better, not moving it or betting on insurance.”
⚠ Common exam trap
Many exam-takers confuse risk mitigation (reducing impact via redundancy) with risk avoidance (eliminating the threat by moving), leading candidates to incorrectly select risk avoidance when the primary site is not decommissioned.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk acceptance
Why it's wrong here
Acceptance would mean accepting the flood risk.
- ✓
Risk mitigation
Why this is correct
Mitigation reduces risk through controls like replication.
- ✗
Risk avoidance
Why it's wrong here
Avoidance would be moving the primary data center instead of building a secondary.
- ✗
Risk transfer
Why it's wrong here
Transfer would be through insurance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?
easy- ✓ A.Mitigate by applying the patch
- B.Avoid by taking the application offline
- C.Accept the risk
- D.Transfer via insurance
Why A: Applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.
Variation 2. A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:
easy- A.Risk Transfer
- ✓ B.Risk Mitigation
- C.Risk Avoidance
- D.Risk Acceptance
Why B: Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.