Risk Mitigation Through Redundancy: A Practical Example
A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?
Quick Answer
The correct answer is risk mitigation, as building a secondary data center in a different region and replicating critical data directly reduces the likelihood and impact of a flood-related outage. This is a textbook example of risk mitigation through redundancy, where controls are implemented to lower residual risk rather than eliminate the source entirely. On the Certified in Risk and Information Systems Control CRISC exam, this scenario tests your ability to distinguish mitigation from other risk responses—avoidance would require relocating the primary site, transfer would involve purchasing flood insurance, and acceptance would mean taking no action. A common trap is confusing redundancy with avoidance, but remember that mitigation keeps the original asset in place while adding protective layers. Memory tip: “Mitigation means making it better, not moving it or betting on insurance.”
⚠ Common exam trap
Many exam-takers confuse risk mitigation (reducing impact via redundancy) with risk avoidance (eliminating the threat by moving), leading candidates to incorrectly select risk avoidance when the primary site is not decommissioned.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk acceptance
Why it's wrong here
Building a secondary site and replicating data reduces likelihood or impact, which is risk mitigation, not acceptance. Acceptance is tempting because it also involves a deliberate decision to proceed, but it means retaining the risk with no additional control, typically for low-impact risks within tolerance.
- ✓
Risk mitigation
Why this is correct
Building a secondary data centre in a different region directly reduces the likelihood and impact of flood disruption, satisfying the risk-assessment finding. Risk mitigation lowers risk through controls or redundancy, unlike avoidance (eliminating the activity), transfer (insurance), or acceptance. Replicating critical data to a separate site is a concrete mitigating control.
- ✗
Risk avoidance
Why it's wrong here
Avoidance means eliminating the activity or asset that carries the risk, for example relocating the data centre entirely; here the primary site remains in the flood zone. Avoidance is tempting because the secondary site is elsewhere, yet replication mitigates rather than removes the exposure.
- ✗
Risk transfer
Why it's wrong here
Building a secondary site and replicating data reduces the likelihood and impact of the flood, which is risk mitigation, not transfer. Transfer is tempting because it shifts financial consequences to another party, and it would be correct if the organisation bought insurance or outsourced hosting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?
easy- ✓ A.Mitigate by applying the patch
- B.Avoid by taking the application offline
- C.Accept the risk
- D.Transfer via insurance
Why A: Applying the vendor-released patch directly reduces the likelihood and impact of the SQL injection vulnerability, which is the definition of risk mitigation. Since a patch exists and the application is critical, mitigation is both feasible and the most appropriate response — it addresses the root cause rather than avoiding, accepting, or transferring the consequence.
Variation 2. A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:
easy- A.Risk Transfer
- ✓ B.Risk Mitigation
- C.Risk Avoidance
- D.Risk Acceptance
Why B: Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.