Knowledge + Practice

CCNA Risk Response Mitigation Questions

69 questions · Risk Response Mitigation topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

A.Accept the risk

B.Implement the control

C.Avoid the risk

D.Transfer the risk

AnswerA

Acceptance is justified when mitigation is not cost-effective.

Why this answer

When the cost of the control ($500k) exceeds the annualized loss expectancy (ALE) of $300k and the risk is within the organization's risk appetite, it is more cost-effective to accept the risk rather than implement a costly control.

Practice this question →

2

MCQeasy

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

A.Avoidance

B.Transfer

C.Acceptance

D.Mitigation

AnswerC

Acceptance is appropriate when risk is low impact and cannot be mitigated or transferred easily.

Why this answer

Acceptance is the most appropriate response because the vulnerability exists in a legacy application that supports a non-critical business process and is used by a small number of users. The cost and operational impact of patching or replacing the application outweigh the risk, making it acceptable to operate with the known vulnerability under formal risk acceptance.

Exam trap

The trap here is that candidates often choose mitigation by default, failing to recognize that when a vulnerability cannot be patched and the asset is low-impact, formal acceptance is the correct risk response per the CRISC framework.

How to eliminate wrong answers

Option A is wrong because avoidance would require removing the application or the process entirely, which is unnecessary for a non-critical process with limited user exposure. Option B is wrong because transfer (e.g., via cyber insurance or outsourcing) does not eliminate the technical vulnerability; it only shifts financial liability, and the underlying risk remains in the application. Option D is wrong because mitigation (e.g., applying a vendor patch, implementing a WAF rule, or hardening the host) is not immediately feasible for a legacy application that cannot be patched, and the low business impact does not justify the effort.

Practice this question →

3

Multi-Selecthard

An organization assesses a risk of intellectual property theft through email exfiltration. They decide to enforce DLP controls, purchase a cyber liability policy, and officially accept the residual risk after controls. Which THREE risk response options are demonstrated?

Select 3 answers

A.Avoid

B.Reduce

C.Mitigate

D.Accept

E.Transfer

AnswersC, D, E

DLP controls mitigate the risk.

Why this answer

Enforcing DLP controls directly reduces the likelihood of intellectual property theft by monitoring and blocking unauthorized email exfiltration, which is a classic risk mitigation (reduce) action. Purchasing a cyber liability policy transfers the financial impact of a breach to an insurer, demonstrating risk transfer. Formally accepting the residual risk after controls acknowledges that some risk remains, which is risk acceptance.

Exam trap

ISACA CRISC exams often test the distinction between 'mitigate' and 'reduce' as synonyms, but the CRISC framework uses 'mitigate' as the official term, so candidates may incorrectly select 'reduce' as a separate valid option when it is actually a distractor.

Practice this question →

4

MCQmedium

After implementing a set of controls, the risk owner calculates the residual risk and finds it is still above the risk tolerance. However, the cost to further reduce the risk exceeds the potential loss. What is the MOST appropriate next step?

A.Formally accept the residual risk

B.Re-assess the inherent risk

C.Reduce current controls to lower costs

D.Implement additional controls despite the cost

AnswerA

Acceptance with sign-off is appropriate when mitigation is too costly.

Why this answer

When the residual risk remains above the risk tolerance but the cost of further mitigation exceeds the potential loss, the most appropriate step is to formally accept the residual risk. This decision is based on a cost-benefit analysis showing that additional controls are not economically justified. The risk owner documents the acceptance, acknowledging the remaining exposure within the organization's risk appetite framework.

Exam trap

The CRISC exam often tests the misconception that residual risk must always be reduced to zero or below tolerance regardless of cost, but the correct approach is to accept risk when further mitigation is economically unjustified.

How to eliminate wrong answers

Option B is wrong because re-assessing inherent risk does not address the fact that residual risk is already calculated and above tolerance; inherent risk is the starting point, not the solution to an economic decision. Option C is wrong because reducing current controls would likely increase residual risk further, moving it even farther from tolerance and potentially violating compliance or security baselines. Option D is wrong because implementing additional controls despite the cost violates the fundamental principle of cost-benefit analysis in risk management; it would waste resources without proportional risk reduction.

Practice this question →

5

MCQmedium

An organization's security team recommends implementing a web application firewall (WAF) to protect against SQL injection attacks. The risk manager evaluates the cost of the WAF and the likelihood of a successful attack. This evaluation is BEST described as:

A.Residual risk calculation

B.Inherent risk assessment

C.Cost-benefit analysis

D.Risk acceptance

AnswerC

Comparing cost of control to expected loss is cost-benefit analysis.

Why this answer

The risk manager is comparing the cost of implementing the WAF against the likelihood and potential impact of a SQL injection attack. This direct comparison of mitigation cost to risk reduction benefit is the essence of a cost-benefit analysis, which determines whether the control is economically justified. It is not a calculation of residual or inherent risk, nor is it an acceptance decision.

Exam trap

The trap here is that candidates confuse the evaluation of a control's cost against risk reduction with inherent risk assessment, but inherent risk is calculated without any controls in place, whereas this scenario explicitly involves weighing the cost of a specific control against the risk it mitigates.

How to eliminate wrong answers

Option A is wrong because residual risk calculation determines the risk remaining after controls are implemented, not the evaluation of whether to implement a control in the first place. Option B is wrong because inherent risk assessment evaluates the risk level before any controls are applied, without considering the cost of mitigation. Option D is wrong because risk acceptance is a formal decision to tolerate a risk without implementing additional controls, which is not what is happening when the manager evaluates the cost of a proposed control.

Practice this question →

6

MCQhard

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

A.Perform a new risk assessment

B.Interview control owners

C.Review risk register updates

D.Conduct a control testing and audit review

AnswerD

Testing provides direct evidence of control operation.

Why this answer

Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness.

Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Practice this question →

7

MCQeasy

A security team identifies a critical vulnerability in a web application that cannot be patched immediately. They deploy a web application firewall (WAF) to block exploitation attempts. This is an example of:

A.Risk Transfer

B.Risk Mitigation

C.Risk Avoidance

D.Risk Acceptance

AnswerB

Deploying a WAF reduces risk, so it is mitigation.

Why this answer

Deploying a WAF to block exploitation attempts directly reduces the likelihood and/or impact of the vulnerability being exploited, which is the definition of risk mitigation. The WAF acts as a compensating control, filtering malicious traffic (e.g., SQL injection, XSS payloads) at the application layer (HTTP/HTTPS) without patching the underlying code. This aligns with the CRISC domain of Risk Response and Mitigation, where controls are implemented to bring residual risk within acceptable tolerance.

Exam trap

The CRISC exam often tests the distinction between risk mitigation (implementing a control to reduce risk) and risk avoidance (eliminating the activity entirely), so candidates mistakenly choose avoidance when they see a vulnerability that cannot be patched, but the key is that the application remains in use with a compensating control.

How to eliminate wrong answers

Option A is wrong because risk transfer involves shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing to a managed security provider), not deploying a technical control like a WAF. Option C is wrong because risk avoidance would require ceasing the activity that introduces the risk (e.g., taking the web application offline or removing the vulnerable feature entirely), not implementing a control to allow continued operation. Option D is wrong because risk acceptance means formally acknowledging the risk and taking no action to reduce it, whereas deploying a WAF is an active countermeasure that reduces the risk level.

Practice this question →

8

MCQmedium

Refer to the exhibit. A risk manager reviews the vulnerability scan output. According to the policy, what is the required risk response?

A.Accept the risk

B.Transfer the risk

C.Avoid by disabling the service

D.Mitigate by patching or compensating controls

AnswerD

Remediation is required.

Why this answer

The vulnerability scan output indicates a critical remote code execution vulnerability in the Apache Struts2 framework (CVE-2017-5638). According to policy, the required risk response is to mitigate by patching or implementing compensating controls because the vulnerability has a known exploit and high severity, making acceptance or transfer inappropriate without remediation.

Exam trap

The trap here is that candidates may choose 'Avoid by disabling the service' thinking it is the safest option, but CRISC emphasizes that risk avoidance should only be used when the risk cannot be mitigated to an acceptable level and the business can operate without the asset; patching is the primary response for known vulnerabilities.

How to eliminate wrong answers

Option A is wrong because accepting the risk is only appropriate when the impact and likelihood are low or when the cost of mitigation exceeds the potential loss; here, a critical remote code execution vulnerability with active exploits in the wild cannot be accepted without justification. Option B is wrong because transferring the risk (e.g., via cyber insurance) does not eliminate the underlying technical vulnerability; the attacker can still exploit the unpatched service, and insurance does not prevent the breach. Option C is wrong because avoiding by disabling the service would eliminate the functionality that the business relies on, which is a disproportionate response unless the service is non-essential; patching or compensating controls (e.g., WAF rules) are the standard, less disruptive approach.

Practice this question →

9

MCQhard

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

A.Mitigate the risk by implementing additional encryption controls

B.Transfer the risk to a third-party insurer

C.Avoid the risk by discontinuing storage of PII

D.Accept the risk and continue monitoring

AnswerD

Since residual risk is below the risk appetite threshold, acceptance is appropriate.

Why this answer

R-0042 is a low-likelihood, low-impact risk involving PII stored with AES-256 encryption and strict access controls. The residual risk is within the organization's risk appetite, making acceptance with continued monitoring the most appropriate response. Mitigation, transfer, or avoidance would introduce unnecessary cost or operational disruption for a risk already well-controlled.

Exam trap

The trap here is that candidates often assume any risk involving PII must be mitigated or avoided, ignoring the risk register's explicit low-likelihood and low-impact ratings and the existing strong controls, which make acceptance the most cost-effective and appropriate response.

How to eliminate wrong answers

Option A is wrong because the risk register shows encryption (AES-256) is already implemented, so adding further encryption controls would provide negligible risk reduction and is not cost-effective. Option B is wrong because transferring the risk to a third-party insurer is typically reserved for high-impact, low-frequency risks (e.g., data breach liability), not for a low-impact, low-likelihood risk already within appetite. Option C is wrong because discontinuing storage of PII would avoid the risk entirely but is a drastic measure that would disrupt business operations and is disproportionate to the low severity of R-0042.

Practice this question →

10

MCQeasy

A global manufacturing company is implementing a new ERP system across multiple regions. The project manager has identified a risk that data migration from legacy systems may cause data corruption, leading to production delays. The risk owner proposes conducting a full data reconciliation after migration. However, the IT director argues that this would be too time-consuming and suggests only sampling data for verification. The risk manager must decide on the risk response. The project timeline is tight, and the company has a low tolerance for data integrity issues. Which of the following is the BEST course of action?

A.Accept the risk and proceed with data sampling to save time

B.Avoid the risk by postponing the ERP implementation

C.Implement the full data reconciliation as proposed by the risk owner

D.Transfer the risk by purchasing insurance for data corruption

AnswerC

Full reconciliation directly addresses the risk and aligns with low tolerance for data integrity issues.

Why this answer

Full data reconciliation is the correct risk response because the company has a low tolerance for data integrity issues and the risk of data corruption could cause production delays. While time-consuming, this approach directly mitigates the identified risk by ensuring all migrated data is verified, aligning with the risk appetite. Sampling would leave a margin of error unacceptable for a low-tolerance environment, and the other options either fail to address the risk or are impractical.

Exam trap

The trap here is that candidates may choose data sampling (Option A) as a compromise to save time, overlooking that the company's low tolerance for data integrity issues demands full verification, not a statistical shortcut.

How to eliminate wrong answers

Option A is wrong because accepting the risk with data sampling ignores the company's low tolerance for data integrity issues and could leave undetected corruption that causes production delays. Option B is wrong because avoiding the risk by postponing the ERP implementation is an extreme overreaction that does not address the immediate need for migration and would cause significant business disruption. Option D is wrong because transferring the risk via insurance does not prevent data corruption or production delays; it only provides financial compensation after the fact, which does not meet the requirement for data integrity.

Practice this question →

11

Multi-Selectmedium

A company has a critical production system with a known vulnerability. Due to the system's age, the vendor no longer supports it. The company decides to implement network segmentation and purchase cyber insurance to cover potential losses. Which TWO risk response options are they applying?

Select 2 answers

A.Accept

B.Transfer

C.Avoid

D.Ignore

E.Mitigate

AnswersB, E

Insurance transfers financial risk.

Why this answer

Network segmentation reduces the attack surface by isolating the vulnerable system, which is a classic risk mitigation technique. Purchasing cyber insurance transfers the financial risk of residual losses to a third party, making 'Transfer' the correct second option. Together, these actions address the risk without removing the vulnerability.

Exam trap

The trap here is that candidates confuse 'transfer' with 'mitigate' because insurance is a financial transfer, while segmentation is a technical mitigation, and the question expects you to recognize both as distinct, simultaneous responses.

Practice this question →

12

MCQhard

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

A.Avoid by choosing a vendor in a country with strong data protection laws

B.Require the vendor to sign standard contractual clauses and encrypt all data

C.Accept the risk because the vendor offers the best price

D.Purchase cyber insurance to cover potential fines

AnswerB

This mitigates risk to an acceptable level under GDPR.

Why this answer

Standard Contractual Clauses (SCCs) are a GDPR-approved transfer mechanism that legally binds the vendor to EU data protection standards, even in a weak-law jurisdiction. Combined with encryption of all data at rest and in transit, this provides both a legal and technical safeguard, reducing the risk of non-compliance to an acceptable level without abandoning the vendor.

Exam trap

The trap here is that candidates often choose 'avoid' (Option A) as the safest response, but the CRISC exam expects you to recognize that risk can be mitigated to an acceptable level using legal and technical controls, rather than automatically avoiding the risk.

How to eliminate wrong answers

Option A is wrong because it represents risk avoidance, which is overly restrictive and may not be feasible if no suitable vendor exists in strong-law countries; it also ignores that SCCs and encryption can adequately mitigate the risk. Option C is wrong because accepting risk solely based on cost violates the fundamental principle of risk management—financial benefit does not justify exposing EU personal data to inadequate legal protections, and GDPR fines can far exceed any cost savings. Option D is wrong because cyber insurance only transfers the financial impact of a fine, not the legal liability or reputational damage; it does not address the root cause of non-compliance with GDPR transfer restrictions.

Practice this question →

13

MCQhard

After implementing security controls, a risk assessment shows a residual risk of data exfiltration with a probability of 5% and potential loss of $10 million. The organization's risk appetite allows a maximum acceptable risk level of 3% probability for such impact. The cost of further mitigation is $1 million. What is the best risk response?

A.Implement additional controls to reduce probability to 2%

B.Accept the residual risk

C.Purchase cybersecurity insurance

D.Discontinue the process

AnswerA

Further mitigation brings risk within appetite.

Why this answer

The residual risk has a probability of 5% and a potential loss of $10 million, resulting in an expected loss of $500,000. The organization's risk appetite allows a maximum probability of 3% for such an impact, so the current risk exceeds the acceptable threshold. Implementing additional controls for $1 million to reduce the probability to 2% brings the risk within the risk appetite (expected loss of $200,000) and is cost-effective because the reduction in expected loss ($300,000) is less than the control cost, but the primary driver is compliance with risk appetite, not pure cost-benefit.

Exam trap

The trap here is that candidates focus on the cost-benefit analysis (mitigation cost vs. reduced expected loss) and incorrectly conclude that acceptance is cheaper, ignoring that risk appetite is a binding constraint that overrides pure financial calculations.

How to eliminate wrong answers

Option B is wrong because accepting the residual risk would violate the organization's risk appetite, which explicitly caps probability at 3% for this impact level; acceptance is only valid when risk is within tolerance. Option C is wrong because purchasing cybersecurity insurance transfers financial risk but does not reduce the probability of data exfiltration; it would still leave the probability at 5%, exceeding the risk appetite threshold, and insurance premiums often require residual risk to be within appetite. Option D is wrong because discontinuing the process is an extreme risk avoidance response that would eliminate the business function entirely, which is disproportionate when a cost-effective mitigation exists to bring risk within appetite.

Practice this question →

14

MCQeasy

A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?

A.Risk acceptance

B.Risk mitigation

C.Risk avoidance

D.Risk transfer

AnswerB

Mitigation reduces risk through controls like replication.

Why this answer

Building a secondary data center in a different region and replicating critical data between both sites reduces the likelihood and impact of a flood-related outage. This is a classic risk mitigation response because it implements controls (geographic redundancy, data replication) to lower residual risk to an acceptable level, without eliminating the original flood risk entirely.

Exam trap

The trap here is confusing risk mitigation (reducing impact via redundancy) with risk avoidance (eliminating the threat by moving), leading candidates to incorrectly select risk avoidance when the primary site is not decommissioned.

How to eliminate wrong answers

Option A is wrong because risk acceptance would involve acknowledging the flood risk and taking no proactive action, which is not the case here. Option C is wrong because risk avoidance would require relocating the primary data center away from the flood-prone area entirely, not building a secondary site while keeping the original operational. Option D is wrong because risk transfer would involve shifting the financial impact of a flood to a third party (e.g., via insurance or outsourcing), not deploying technical redundancy controls.

Practice this question →

15

MCQeasy

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

A.The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface

B.The ACL has no logging enabled

C.The ACL is missing a permit statement for HTTP

D.The ACL blocks all traffic from the internet

AnswerA

Broad permits may allow unauthorized traffic.

Why this answer

Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Exam trap

The trap here is that candidates often focus on missing logging (option B) or missing HTTP (option C) as the most critical issue, but the real risk is the overly permissive ACL that allows all HTTPS and DNS traffic from any source, which dramatically increases the attack surface and is a classic misconfiguration in ACL design.

How to eliminate wrong answers

Option B is wrong because the absence of logging is a monitoring deficiency, not the most significant risk; logging is important for forensic analysis but does not directly increase the attack surface or allow malicious traffic. Option C is wrong because HTTP (TCP/80) is not explicitly permitted, but this is a lesser risk compared to allowing all HTTPS and DNS traffic, as HTTP traffic would be blocked by default (implicit deny) and does not expose the server to the same volume of potential attacks. Option D is wrong because blocking all traffic from the internet would actually reduce risk by preventing external access entirely, though it may break legitimate business functionality; however, the question asks for the most significant risk, and blocking all traffic is a security measure, not a risk.

Practice this question →

16

MCQmedium

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

A.The final rule denies all traffic

B.HTTPS traffic is permitted to any destination

C.SSH access is only allowed from internal network

D.HTTP traffic is permitted from any source to any destination

AnswerD

Unrestricted HTTP exposure is risky.

Why this answer

Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.

Exam trap

The trap here is that candidates often focus on the 'deny all' rule as a risk (thinking it might block legitimate traffic) or overlook the severity of allowing unencrypted HTTP, mistakenly assuming HTTPS and HTTP are equivalent in risk level.

How to eliminate wrong answers

Option A is wrong because a final deny-all rule is a standard security best practice; it ensures that any traffic not explicitly permitted is blocked, reducing the attack surface. Option B is wrong because HTTPS (TCP 443) is encrypted and, while permitting it to any destination may be overly permissive, it is far less risky than allowing unencrypted HTTP; the question asks for the MOST significant risk. Option C is wrong because restricting SSH access to the internal network is a security control that reduces exposure of administrative interfaces; this is a good practice, not a risk.

Practice this question →

17

MCQmedium

A multinational corporation has adopted a risk mitigation strategy for its key suppliers by requiring them to maintain ISO 27001 certification. During an audit, the risk manager discovers that one critical supplier lost its certification six months ago but did not report it, as contractually required. The supplier still has adequate security controls in place, and the relationship is strategically important. The CEO wants to avoid contract termination. What is the MOST appropriate risk response?

A.Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.

B.Transfer the risk to the supplier's cyber liability insurance policy.

C.Accept the risk because the supplier still has effective controls, and update the risk register.

D.Terminate the contract immediately and find an alternative supplier.

AnswerA

This enforces the contract and restores the intended risk mitigation.

Why this answer

It directly addresses the contractual breach with a corrective action plan and progress reviews, allowing the supplier to regain certification while maintaining the strategic relationship. Option B is incorrect because transferring risk to the supplier's cyber liability insurance does not restore the required certification or address the root cause of the breach. Option C is incorrect because accepting the risk disregards the contractual requirement for certification, even if controls are currently adequate.

Option D is incorrect because immediate termination may be too disruptive given the strategic importance of the supplier and the existence of a feasible remediation path.

Practice this question →

18

MCQhard

A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?

A.Avoid by terminating the contract

B.Mitigate by reducing data shared

C.Transfer via insurance

D.Accept the risk and monitor

AnswerA

Termination eliminates the risk.

Why this answer

The vendor's refusal to remediate high-risk findings directly violates the contract's security standards clause, and the organization's low risk appetite for third-party risk means that accepting or mitigating the residual risk is unacceptable. Terminating the contract (avoidance) is the only response that eliminates the risk entirely, aligning with the principle that when a third party cannot or will not meet required security controls, the relationship should be severed to prevent potential data breaches or compliance violations.

Exam trap

The trap here is that candidates often choose mitigation (reducing data shared) because it seems like a compromise, but they overlook that the vendor's core data handling processes remain insecure, and the organization's low risk appetite demands complete elimination of the risk, not partial reduction.

How to eliminate wrong answers

Option B is wrong because reducing data shared (mitigation) does not address the vendor's unwillingness to remediate the root cause of the high-risk findings; the vendor's insecure data handling practices would still expose the organization to residual risk exceeding its low appetite. Option C is wrong because transferring risk via insurance does not reduce the likelihood or impact of a data breach; it only provides financial compensation after an incident, which is insufficient when the organization's risk appetite is low and the vendor is non-compliant with contractual security standards. Option D is wrong because accepting the risk and monitoring contradicts the organization's low risk appetite; acceptance is appropriate only when residual risk falls within appetite, but here the high-risk findings and vendor non-compliance create an unacceptable level of exposure.

Practice this question →

19

Matchingmedium

Match each risk management process step to its activity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Find and list potential risks

Determine likelihood and impact

Compare risk levels to risk criteria

Select and implement controls

Why these pairings

The risk management process steps are distinct: Risk Identification finds risks, Risk Assessment evaluates them, and Risk Response addresses them. Common confusions involve swapping these definitions.

Practice this question →

20

MCQeasy

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

A.Update the risk register

B.Escalate to senior management

C.Implement additional controls

D.Reduce the risk appetite

AnswerB

Residual risk exceeding appetite requires senior management decision.

Why this answer

When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Exam trap

The trap here is that candidates confuse the risk owner's authority with senior management's authority, assuming the risk owner can independently implement controls or adjust appetite without escalation.

How to eliminate wrong answers

Option A is wrong because updating the risk register is a documentation step that should occur after the decision is made, not the first action when risk exceeds appetite. Option C is wrong because implementing additional controls is a potential remediation step, but it requires senior management approval or direction first, as the risk owner cannot unilaterally decide to spend resources. Option D is wrong because reducing risk appetite is a strategic decision made by the board or senior management, not the risk owner, and changing appetite to match residual risk violates the purpose of having a defined appetite.

Practice this question →

21

Multi-Selecteasy

Which TWO of the following are examples of risk mitigation controls?

Select 2 answers

A.Implementing a firewall

B.Purchasing cyber insurance

C.Accepting the risk

D.Encrypting sensitive data

E.Discontinuing a high-risk service

AnswersA, D

Mitigation reduces risk through preventive controls.

Why this answer

Implementing a firewall is a risk mitigation control because it reduces the likelihood and impact of unauthorized network access by enforcing access control policies based on source/destination IP addresses, ports, and protocols. Firewalls operate at Layers 3 and 4 (and sometimes Layer 7) of the OSI model to filter traffic, thereby directly reducing the attack surface and preventing exploitation of vulnerabilities.

Exam trap

The CRISC exam often tests the distinction between risk mitigation (reducing likelihood/impact) and risk transfer (e.g., insurance) or risk avoidance (e.g., discontinuing a service), so candidates mistakenly classify insurance or service discontinuation as mitigation when they are separate risk response strategies.

Practice this question →

22

Multi-Selecthard

Which TWO of the following are valid reasons to accept a risk rather than mitigate it?

Select 2 answers

A.Management is not aware of the risk

B.The risk relates to regulatory non-compliance

C.The risk level is within the risk appetite

D.The organization wants to avoid the risk entirely

E.The cost of mitigation is higher than the potential loss

AnswersC, E

Acceptance is appropriate when within appetite.

Why this answer

Accepting a risk is appropriate when the residual risk level falls within the organization's defined risk appetite. Risk appetite represents the amount of risk the organization is willing to accept in pursuit of its objectives, and risks within that threshold do not require additional mitigation controls. This aligns with the CRISC principle that risk acceptance is a valid response when the risk is within tolerance levels.

Exam trap

The trap here is that candidates often confuse risk acceptance with risk avoidance or assume any risk can be accepted, but CRISC requires that acceptance only applies when the risk is within the risk appetite and does not violate compliance mandates.

Practice this question →

23

MCQhard

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

A.Accept the risk

B.Implement compensating controls

C.Transfer via insurance

D.Avoid by decommissioning

AnswerB

Controls like segmentation and monitoring reduce the risk.

Why this answer

When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Exam trap

The trap here is that candidates often choose 'Accept the risk' because they misunderstand risk acceptance as a passive decision, but in CRISC, acceptance is only valid when the risk is within the risk appetite, not when the likelihood and impact are both high and the system is critical.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any mitigation would leave the organization exposed to a high-likelihood, high-impact threat, which is typically unacceptable for a core business function; acceptance is only appropriate when the residual risk is within the organization's risk appetite. Option C is wrong because transferring via insurance does not reduce the likelihood or impact of a security incident; it only provides financial compensation after a loss, and for a legacy system with a high exploitation likelihood, the operational disruption and reputational damage are not fully transferable. Option D is wrong because avoiding by decommissioning contradicts the board's explicit decision to keep the system operational due to its criticality, and it would disrupt the core business function.

Practice this question →

24

Multi-Selecteasy

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Select 2 answers

A.Implementing firewalls to protect the network perimeter.

B.Conducting regular vulnerability assessments and patching.

C.Avoiding the risk by discontinuing the vulnerable activity.

D.Accepting the risk because the cost of mitigation exceeds the potential loss.

E.Purchasing cyber insurance to cover potential losses.

AnswersA, B

Correct: Firewalls reduce the likelihood of network-based attacks, which is a mitigation technique.

Why this answer

Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Exam trap

The trap here is that candidates often confuse risk mitigation with risk transfer (insurance) or risk acceptance, failing to recognize that mitigation involves active controls (like firewalls and patching) that reduce the risk level, not just financial compensation or inaction.

Practice this question →

25

Drag & Dropmedium

Order the steps for implementing a risk treatment plan.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Practice this question →

26

Multi-Selectmedium

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Select 2 answers

A.Rewrite the order matching engine in a memory-safe language

B.Deploy a Web Application Firewall (WAF) to block malicious payloads

C.Enable detailed logging for all order matching transactions

D.Require manual approval for all orders above a threshold

E.Implement rate limiting on order submissions

AnswersD, E

Manual approval adds a human verification step, reducing the impact of a potential exploit.

Why this answer

Requiring manual approval for orders above a threshold directly reduces the impact of a successful exploit by preventing large-scale financial loss, even if the underlying code vulnerability remains unpatched. This compensating control shifts the risk acceptance decision to a human operator, effectively adding a business logic layer that can catch anomalous or malicious order matching attempts. Option E is correct because rate limiting on order submissions mitigates the risk of an attacker exploiting the vulnerability to submit a high volume of malicious orders, thereby limiting the blast radius and preventing denial-of-service or market manipulation scenarios.

Exam trap

The trap here is that candidates confuse detective controls (logging) or remediation (rewriting code) with compensating controls, failing to recognize that a compensating control must actively reduce risk without fixing the original vulnerability.

Practice this question →

27

MCQmedium

Based on the exhibit, which risk response should be prioritized?

A.Implement account lockout policy

B.Avoid by taking the server offline

C.Accept the risk because it's only a single server

D.Transfer the risk to a cloud provider

AnswerA

Account lockout reduces the effectiveness of brute-force attacks.

Why this answer

The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.

Exam trap

The trap here is that candidates may choose 'Accept the risk because it's only a single server' (Option C), mistakenly believing that a single server has low impact, but failing to recognize that a compromised server can serve as a pivot point for broader network attacks or data exfiltration.

How to eliminate wrong answers

Option B is wrong because taking the server offline would avoid the risk entirely but is typically a drastic measure that disrupts business operations and is not prioritized unless the vulnerability is critical and cannot be patched immediately. Option C is wrong because accepting the risk for a single server ignores the potential for lateral movement or data breach, and risk acceptance should only be considered after a formal risk assessment and when the cost of mitigation exceeds the potential impact. Option D is wrong because transferring the risk to a cloud provider does not eliminate the underlying vulnerability; the cloud provider may still rely on the same server configuration, and the organization retains residual risk and compliance responsibilities.

Practice this question →

28

MCQmedium

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

A.Accept the false positives as a cost of doing business

B.Tune the system to reduce false positives

C.Remove the monitoring system to focus on other controls

D.Hire additional analysts to review all alerts

AnswerB

Tuning improves detection accuracy.

Why this answer

B is correct because tuning the system involves adjusting detection thresholds, rules, or machine learning models to reduce false positives while maintaining sensitivity to actual fraud. This directly addresses the root cause—poorly calibrated detection logic—without sacrificing the system's primary function or incurring unsustainable costs.

Exam trap

The trap here is that candidates may choose D (hire more analysts) because it seems like a direct solution to alert overload, but it fails to address the system's inefficiency and is not a sustainable risk response per CRISC principles.

How to eliminate wrong answers

Option A is wrong because accepting false positives as a cost of doing business ignores the operational risk that analysts miss real threats, leading to potential financial and regulatory damage. Option C is wrong because removing the monitoring system eliminates the primary detective control for fraud, leaving the bank exposed to undetected fraudulent transactions. Option D is wrong because hiring additional analysts does not fix the underlying system misconfiguration; it only masks the symptom with increased headcount, which is not scalable and still risks alert fatigue.

Practice this question →

29

MCQmedium

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

A.Accept the risk owner's decision

B.Document the deficiency and move on

C.Communicate the risk exposure to senior management

D.Escalate directly to the board

AnswerC

Senior management needs to be aware of the risk and decide on additional funding.

Why this answer

The risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Exam trap

The trap here is that candidates confuse 'documenting the deficiency' (Option B) with completing the risk management process, but CRISC requires active communication of risk exposure to the appropriate authority, not just passive recording.

How to eliminate wrong answers

Option A is wrong because accepting the risk owner's decision without further action would violate the risk practitioner's responsibility to ensure that risk acceptance is based on complete and accurate information; the risk owner's budget-driven refusal does not constitute a valid risk acceptance decision without senior management's informed consent. Option B is wrong because simply documenting the deficiency and moving on fails to address the material risk exposure; documentation is necessary but not sufficient—the practitioner must actively communicate the risk to those who can authorize additional controls or formally accept the risk. Option D is wrong because escalating directly to the board bypasses the proper escalation chain; the board should only be involved for strategic-level risks or after senior management has been informed and has failed to act, not as a first step.

Practice this question →

30

MCQmedium

Refer to the exhibit. Based on the risk register, which risk response is applied to the risk with the highest inherent risk?

A.Transfer

B.Avoid

C.Accept

D.Mitigate

AnswerA

Risk-001 uses Transfer.

Why this answer

The risk with the highest inherent risk (Risk A, with a score of 25) involves a critical database server lacking encryption at rest. The risk response chosen is 'Transfer,' which is implemented by purchasing a cyber insurance policy that specifically covers data breach costs and regulatory fines. This shifts the financial impact of the risk to the insurer without altering the technical vulnerability or likelihood of the event.

Exam trap

The trap here is that candidates see a high inherent risk and automatically assume the response must be 'Mitigate' with technical controls, but the question tests the ability to recognize that purchasing insurance is a classic transfer response, not a reduction of the risk itself.

How to eliminate wrong answers

Option B (Avoid) is wrong because avoiding the risk would require decommissioning the database server or discontinuing the service, which is not indicated in the risk register; the response is financial, not operational. Option C (Accept) is wrong because accepting the risk would mean formally acknowledging and budgeting for potential losses without any active treatment, but the purchase of insurance is an active transfer mechanism, not passive acceptance. Option D (Mitigate) is wrong because mitigation would involve implementing technical controls such as enabling Transparent Data Encryption (TDE) or using BitLocker/ LUKS to reduce the likelihood or impact, whereas insurance does not reduce the inherent risk itself.

Practice this question →

31

Matchingmedium

Match each risk response strategy to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Eliminate the activity that causes the risk

Reduce the likelihood or impact of the risk

Shift the risk to a third party, e.g., insurance

Acknowledge the risk and take no further action

Why these pairings

The correct matches are: Avoid – decision to not perform the activity; Accept – formal acceptance of risk; Mitigate – reduce likelihood/impact; Transfer – shift to another party. Common confusions include mixing transfer with avoidance and acceptance with mitigation.

Practice this question →

32

MCQhard

Refer to the exhibit. Given the organization's risk appetite is Low, which risk response is most appropriate?

A.Accept the current residual risk because it is Medium.

B.Avoid the risk by discontinuing operations.

C.Transfer the risk via insurance.

D.Implement additional monitoring to reduce residual risk to Low.

AnswerD

Correct: This aligns with the low risk appetite by reducing residual risk to an acceptable level.

Why this answer

With a Low risk appetite, the organization requires residual risk to be Low. Option D proposes implementing additional monitoring to reduce the Medium residual risk to Low, which aligns with the risk appetite. This is a corrective response that mitigates the risk without unnecessary business disruption.

Exam trap

ISACA often tests the misconception that transferring risk (e.g., insurance) eliminates the risk itself, when in fact it only covers financial loss, leaving the operational risk level unchanged.

How to eliminate wrong answers

Option A is wrong because accepting a Medium residual risk violates the organization's Low risk appetite; acceptance is only appropriate when residual risk is within appetite. Option B is wrong because avoiding the risk by discontinuing operations is an extreme and disproportionate response that unnecessarily halts business functions when a less drastic mitigation (like monitoring) can achieve the required risk level. Option C is wrong because transferring risk via insurance does not reduce the inherent or residual risk level; it only shifts financial impact, leaving the operational risk still at Medium, which still violates the Low risk appetite.

Practice this question →

33

MCQmedium

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

A.Re-evaluate risk treatment options with the risk owner

B.Escalate directly to the board

C.Update the risk register to reflect the residual risk

D.Accept the residual risk

AnswerA

The practitioner should collaborate with the risk owner to identify additional controls or modify existing ones.

Why this answer

When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Exam trap

The trap here is that candidates often confuse the urgency of residual risk with the need to immediately escalate or accept it, when the correct first step is to revisit treatment options with the risk owner to see if further controls can close the gap.

How to eliminate wrong answers

Option B is wrong because escalating directly to the board bypasses the proper risk management process; the board should only be informed after all feasible treatment options have been exhausted and documented. Option C is wrong because updating the risk register to reflect residual risk is a documentation step that should occur after determining the final risk response, not as the first action. Option D is wrong because accepting residual risk above the risk appetite without first exploring additional mitigation measures violates the principle of risk reduction and could lead to unacceptable exposure.

Practice this question →

34

MCQmedium

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

A.Terminate the employee immediately

B.Implement additional monitoring and restrictions

C.Accept the risk as the employee is trusted

D.Transfer via fidelity insurance

AnswerB

Mitigation through controls reduces the risk.

Why this answer

Implementing additional monitoring and restrictions (Option B) is the most appropriate risk response because it allows the organization to gather more evidence of the suspected insider threat while immediately reducing the attack surface. This aligns with the risk mitigation strategy, as it directly addresses the observed anomalous behavior—accessing systems outside normal hours—without prematurely escalating the situation. In a financial data environment, this could involve enabling enhanced audit logging, restricting access to specific IP ranges or times, and deploying user and entity behavior analytics (UEBA) to detect deviations from baseline activity.

Exam trap

A common mistake in the CRISC exam is assuming that immediate termination (Option A) is the best response to insider threats, but the trap here is that termination is a punitive action, not a risk response—it fails to preserve evidence and may violate due process, whereas monitoring and restriction is a proper mitigation that balances security with operational continuity.

How to eliminate wrong answers

Option A is wrong because immediate termination without a full investigation could destroy critical forensic evidence, violate employment or data privacy laws, and does not address the root cause of the behavior; it is a reactive, punitive measure rather than a controlled risk response. Option C is wrong because accepting the risk based solely on the employee being 'trusted' ignores the clear indicators of potential malicious activity (erratic behavior, off-hours access) and violates the principle of least privilege and continuous monitoring required for sensitive financial data. Option D is wrong because transferring the risk via fidelity insurance only covers financial loss after an incident occurs, not the ongoing threat; it does nothing to prevent the insider from exfiltrating data or causing harm in the immediate term.

Practice this question →

35

Multi-Selectmedium

Which TWO of the following are examples of risk avoidance? (Select TWO.)

Select 2 answers

A.Accepting the risk

B.Installing a firewall

C.Deciding not to enter a new market

D.Purchasing insurance

E.Discontinuing a risky product line

AnswersC, E

Not entering the market avoids the associated risks.

Why this answer

Risk avoidance involves taking action to eliminate the risk entirely by not engaging in the activity that introduces it. Option C, 'Deciding not to enter a new market,' avoids all associated market, regulatory, and competitive risks by simply not pursuing that business opportunity. Option E, 'Discontinuing a risky product line,' removes the risk by ceasing the activity that generates it, such as halting production of a product with known safety or compliance issues.

Exam trap

The trap here is that candidates often confuse risk avoidance with risk mitigation or transfer, mistakenly selecting options like 'installing a firewall' (mitigation) or 'purchasing insurance' (transfer) as examples of avoidance, when avoidance requires ceasing or not starting the risk-generating activity.

Practice this question →

36

MCQhard

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

A.Mitigate by regularly monitoring the provider

B.Avoid by keeping IT support in-house

C.Transfer the risk through the outsourcing contract

D.Accept the risk because the provider is cheaper

AnswerB

Avoidance is appropriate when compliance cannot be assured.

Why this answer

The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements, which represents a high-severity compliance risk that cannot be effectively mitigated through monitoring alone. Avoiding the risk by keeping IT support in-house eliminates the exposure entirely, making it the best response when the risk level exceeds the organization's risk appetite and cannot be reduced to an acceptable level through other strategies.

Exam trap

The trap here is that candidates often choose 'mitigate by monitoring' or 'transfer through contract' because they seem proactive, but CRISC expects you to recognize that regulatory compliance risk cannot be effectively transferred or monitored away when the provider's practices are fundamentally non-compliant.

How to eliminate wrong answers

Option A is wrong because regular monitoring does not address the root cause of non-compliance; if the provider's practices violate regulations, monitoring only detects failures without preventing them, and the organization remains liable for regulatory penalties. Option C is wrong because transferring risk through a contract does not absolve the organization of regulatory responsibility; data protection regulations typically hold the data controller (the organization) accountable regardless of contractual indemnities. Option D is wrong because accepting the risk based solely on cost savings ignores the potential for severe regulatory fines, reputational damage, and legal liabilities that far outweigh any financial benefit from cheaper outsourcing.

Practice this question →

37

MCQeasy

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

A.Risk reduction

B.Risk transfer

C.Risk acceptance

D.Risk avoidance

AnswerB

Outsourcing transfers operational risk to the third party.

Why this answer

Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Exam trap

The trap here is that candidates confuse risk transfer with risk reduction, mistakenly thinking that outsourcing reduces the risk of hardware failure, when in fact it only shifts the financial liability for that failure, not the operational impact on the business.

How to eliminate wrong answers

Option A is wrong because risk reduction involves implementing controls to lower the likelihood or impact of a risk, such as deploying redundant power supplies or fire suppression systems, not outsourcing operations. Option C is wrong because risk acceptance means formally acknowledging the risk and choosing to bear it without additional action, which contradicts the active decision to engage a third party. Option D is wrong because risk avoidance would mean ceasing the activity that generates the risk, such as shutting down the data center entirely, rather than transferring its management to another entity.

Practice this question →

38

MCQmedium

An organization has a policy requiring all sensitive data to be encrypted at rest. During an audit, it is found that encryption keys are stored in plaintext on the same server. Which risk response is MOST appropriate?

A.Avoid by removing the data

B.Mitigate by encrypting the key file

C.Accept the risk because encryption is still applied

D.Transfer the risk to a cloud provider

AnswerB

Encrypting the keys protects them, reducing the risk of unauthorized decryption.

Why this answer

Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.

Exam trap

The trap here is that candidates mistakenly believe that simply having encryption applied (option C) is sufficient, overlooking the critical requirement that encryption keys must be protected separately from the data they encrypt—a fundamental principle of cryptographic security.

How to eliminate wrong answers

Option A is wrong because removing the data is an extreme measure that disrupts business operations and is unnecessary when a simpler, less costly mitigation (encrypting the key file) exists. Option C is wrong because accepting the risk ignores the fact that plaintext keys on the same server render the encryption ineffective, creating a high-likelihood, high-impact vulnerability that violates the organization's policy. Option D is wrong because transferring the risk to a cloud provider does not inherently solve the problem—if the keys remain in plaintext on the same server, the same vulnerability persists regardless of who manages the infrastructure.

Practice this question →

39

Drag & Dropmedium

Sequence the steps for implementing a new control based on risk assessment findings.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Control implementation involves design, procurement/build, testing, deployment, and monitoring.

Practice this question →

40

MCQhard

A company faces a risk of data loss due to untrained staff. They implement mandatory training and quarterly phishing simulations. This is:

A.Risk Avoidance

B.Risk Acceptance

C.Risk Mitigation

D.Risk Transfer

AnswerC

Training reduces the probability of incidents, thus mitigating risk.

Why this answer

Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Exam trap

The trap here is that candidates confuse 'risk mitigation' with 'risk avoidance' because they think training eliminates the risk entirely, but mitigation only reduces it, while avoidance would require stopping the use of email or data processing altogether.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean ceasing the activity that introduces the risk (e.g., not using email or not storing sensitive data), not training staff. Option B is wrong because risk acceptance involves acknowledging the risk and taking no action to reduce it, whereas the company is actively implementing controls. Option D is wrong because risk transfer shifts the financial impact to a third party (e.g., cyber insurance or outsourcing), not internal training and simulations.

Practice this question →

41

MCQeasy

For a risk with very low likelihood and low impact, what is the typical risk response?

A.Mitigate

B.Transfer

C.Avoid

D.Accept

AnswerD

Acceptance is the default for low risks.

Why this answer

When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

Exam trap

The trap here is that candidates mistakenly apply mitigation or transfer to all risks, failing to recognize that acceptance is the default response for low-likelihood, low-impact risks where the cost of treatment exceeds the potential loss.

How to eliminate wrong answers

Option A is wrong because mitigation involves reducing likelihood or impact through controls, which is unnecessary and wasteful for a risk with negligible potential loss. Option B is wrong because transfer (e.g., insurance or outsourcing) incurs premium costs or contractual overhead that outweighs the trivial exposure. Option C is wrong because avoidance (e.g., discontinuing the activity) would eliminate a low-value risk at the cost of losing business functionality or opportunity, which is disproportionate.

Practice this question →

42

Multi-Selectmedium

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Select 2 answers

A.Installing intrusion detection systems

B.Conducting periodic vulnerability scans

C.Regularly backing up critical data

D.Deploying network segmentation

E.Implementing user awareness training

AnswersD, E

Segmentation limits the spread of ransomware, reducing likelihood of widespread infection.

Why this answer

Deploying network segmentation (D) reduces the likelihood of a ransomware attack by limiting lateral movement. If an endpoint is compromised, segmentation using VLANs or firewall rules (e.g., 802.1Q, ACLs) prevents the ransomware from spreading to critical systems, thereby reducing the attack surface and the probability of widespread encryption. User awareness training (E) directly reduces likelihood by teaching users to recognize phishing emails and malicious attachments, which are the primary initial vectors for ransomware delivery.

Exam trap

The trap here is that candidates confuse recovery controls (backups) with likelihood-reducing mitigations, or they mistake detective controls (IDS, vulnerability scans) for preventive measures that lower the probability of an attack.

Practice this question →

43

MCQmedium

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

A.Transfer

B.Avoid

C.Accept

D.Mitigate

AnswerA

Insurance transfers the risk to a third party.

Why this answer

Purchasing insurance transfers the financial risk to the insurer. Options B, C, and D do not describe transfer via insurance.

Practice this question →

44

Multi-Selecteasy

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Select 3 answers

B.Outsourcing IT helpdesk

C.Encryption

D.Security awareness training

E.Cyber insurance

AnswersA, C, D

Firewalls reduce the likelihood of network attacks.

Why this answer

A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Exam trap

The trap here is confusing risk mitigation (which reduces likelihood or impact) with risk transfer (which shifts the financial burden to another party), leading candidates to incorrectly select outsourcing or insurance as mitigation controls.

Practice this question →

45

MCQhard

You are a risk practitioner at a financial institution that is migrating its core banking system to a cloud provider. The migration plan includes a phased approach, with the first phase moving non-critical applications. However, during the second phase (moving customer-facing applications), the cloud provider experiences a major outage that lasts 6 hours. The outage was caused by a misconfiguration in the provider's network. The institution had conducted a risk assessment and identified cloud provider downtime as a risk, but the treatment plan only included a service level agreement (SLA) with financial penalties. The SLA does not cover the reputational damage and loss of customer trust. The risk register shows that the residual risk level was marked as 'low' before the incident. After the incident, senior management is demanding a review. Which of the following is the MOST appropriate action for the risk practitioner to take?

A.Negotiate a higher penalty in the SLA

B.Initiate a legal claim against the provider

C.Update the risk register to reflect the incident and accept the residual risk

D.Reassess the risk and recommend implementing a multi-cloud architecture for critical applications

AnswerD

Multi-cloud reduces dependency on a single provider and addresses the impact.

Why this answer

The incident revealed that the existing risk treatment (SLA financial penalties) was insufficient to address the actual impact (reputational damage and loss of customer trust). The risk practitioner must reassess the risk with the new information and recommend a more robust mitigation strategy, such as multi-cloud architecture, to reduce the likelihood or impact of a single provider's outage affecting critical customer-facing applications.

Exam trap

The trap here is that candidates may think updating the risk register (Option C) is sufficient, but CRISC emphasizes that after a risk materializes with greater impact than assessed, the risk must be reassessed and the treatment plan revised, not just documented.

How to eliminate wrong answers

Option A is wrong because negotiating a higher penalty in the SLA still does not address the unmitigated reputational damage and loss of customer trust; financial penalties compensate for direct costs but not intangible impacts. Option B is wrong because initiating a legal claim is a reactive, punitive measure that does not improve future resilience and may be precluded by the SLA's limitation of liability clauses. Option C is wrong because simply updating the risk register to reflect the incident and accepting the residual risk ignores the need to reassess and improve controls after a realized risk that exceeded the accepted level.

Practice this question →

46

MCQmedium

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

A.Conduct a tabletop exercise with the updated plan

B.Add more detective controls

C.Update the risk register

D.Increase insurance coverage

AnswerA

Tabletop exercises test and improve the team's ability to execute the plan.

Why this answer

A tabletop exercise validates the updated incident response plan by simulating a realistic scenario, allowing the response team to practice their roles and identify gaps in the new procedures. This directly addresses the root cause—the plan was outdated and the team failed to execute it correctly—by ensuring the plan is current and the team is familiar with its execution. Without this validation, the updated plan remains untested and the same failure mode could recur.

Exam trap

The trap here is that candidates confuse corrective action with compensating controls, choosing to add detective controls or insurance instead of recognizing that the root cause is a procedural failure requiring validation of the updated plan through a practical exercise.

How to eliminate wrong answers

Option B is wrong because adding more detective controls (e.g., additional IDS/IPS signatures or log monitoring) does not correct the failure to execute an outdated incident response plan; it addresses detection, not response execution. Option C is wrong because updating the risk register is a documentation activity that records the incident and its impact but does not fix the procedural failure or ensure the team can execute the plan correctly. Option D is wrong because increasing insurance coverage transfers financial risk but does not improve the team's ability to follow the incident response plan, leaving the operational failure unaddressed.

Practice this question →

47

MCQhard

A financial institution is implementing a new online banking platform. The risk assessment identified that the platform will handle sensitive customer data and must comply with GDPR and local banking regulations. The project team proposes encrypting all data at rest and in transit, implementing multi-factor authentication (MFA), and conducting quarterly penetration tests. However, the risk owner is concerned about the residual risk of a sophisticated phishing attack that could bypass MFA. The board has a low risk appetite. What is the BEST way to address this residual risk?

A.Purchase cyber insurance to transfer the financial impact of a potential phishing attack.

B.Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.

C.Reduce the project scope to exclude online banking and revert to a less risky channel.

D.Accept the residual risk because the existing controls (encryption, MFA, pen tests) already provide reasonable assurance.

AnswerB

It directly addresses the residual risk of sophisticated phishing by implementing phishing-resistant MFA and employee training, which aligns with the board's low risk appetite.

Why this answer

It addresses the specific residual risk with a targeted control (phishing simulations and training) without overcomplicating the project. Option A is wrong because purchasing insurance does not reduce the likelihood of an attack. Option C is wrong because stopping the project is a disproportionate response to a manageable risk.

Option D is wrong because accepting the residual risk conflicts with the board's low risk appetite.

Practice this question →

48

MCQeasy

A new privacy regulation requires that all personal data be encrypted at rest. The current systems lack encryption. The cost to implement encryption is moderate, and the risk of non-compliance is high. Which risk response is most appropriate?

A.Mitigate by implementing encryption

B.Accept the risk

C.Avoid by discontinuing data processing

D.Transfer via cyber insurance

AnswerA

Encryption directly addresses the vulnerability.

Why this answer

(Mitigate by implementing encryption) is the most appropriate risk response because it directly addresses the risk of non-compliance with the privacy regulation by applying a moderate-cost control. The high risk of non-compliance makes acceptance (B) unsuitable; avoidance (C) by discontinuing processing is overly drastic and not cost-effective; and transfer (D) via insurance does not fulfill the regulatory requirement to encrypt at rest.

Practice this question →

49

MCQhard

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

A.Risk avoidance by decommissioning the system

B.Risk transfer through cyber insurance

C.Risk reduction by implementing redundant systems

D.Risk acceptance because mitigation is too costly

AnswerC

Redundancy reduces both likelihood and impact of downtime.

Why this answer

Given the extremely high downtime costs, the most appropriate risk response is risk reduction through implementing redundant systems. This directly addresses the critical system's availability requirement by eliminating single points of failure, thereby reducing both the likelihood and impact of downtime. Decommissioning the system (avoidance) would eliminate the business function entirely, which is typically not viable for a critical system, while insurance (transfer) only provides financial compensation after the loss, not preventing the operational impact of downtime.

Exam trap

The trap here is that candidates may confuse risk transfer (insurance) as a primary solution for high downtime costs, overlooking that insurance does not prevent the operational impact and lost revenue during the outage itself, which is the core concern in this scenario.

How to eliminate wrong answers

Option A is wrong because risk avoidance by decommissioning the system would eliminate the business function that the critical system supports, which is typically not a viable strategy for a system deemed critical to operations. Option B is wrong because risk transfer through cyber insurance only provides financial reimbursement after a loss event, but does not prevent the extremely high operational downtime costs or the associated business disruption. Option D is wrong because risk acceptance is inappropriate when the business impact analysis shows that downtime costs are extremely high and a cost-effective mitigation (like redundancy) is available.

Practice this question →

50

Multi-Selecthard

Which THREE of the following are key components of an effective risk treatment plan?

Select 3 answers

A.Assigned responsibilities

B.Risk acceptance criteria

C.A timeline for implementation

D.The risk owner's signature

E.A detailed budget

AnswersA, B, C

Clear ownership ensures accountability.

Why this answer

Assigned responsibilities are a key component of an effective risk treatment plan because they ensure accountability for implementing specific risk mitigation actions. Without clear ownership, tasks may be delayed or overlooked, undermining the plan's execution. This aligns with the CRISC framework's emphasis on defining roles to operationalize risk response.

Exam trap

The trap here is that candidates confuse supporting artifacts (like budgets or signatures) with the core structural components of the plan, which are defined by ISACA as responsibilities, timelines, and acceptance criteria.

Practice this question →

51

Drag & Dropmedium

Put the steps for performing a control self-assessment (CSA) in order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

CSA involves defining scope, identifying controls, assessing effectiveness, gap identification, and reporting.

Practice this question →

52

Multi-Selecthard

A risk assessment identifies a high likelihood of a data breach due to insecure APIs. The risk team proposes disabling the APIs until they are secured, implementing a WAF, and purchasing breach insurance. Which THREE risk response options are being considered?

Select 3 answers

A.Remediate

B.Transfer

C.Avoid

D.Mitigate

E.Accept

AnswersB, C, D

Insurance transfers the financial impact.

Why this answer

(Transfer) is correct because purchasing breach insurance transfers the financial risk of a data breach to an insurance provider. Option C (Avoid) is correct because disabling the APIs until they are secured eliminates the risk entirely by removing the vulnerable component. Option D (Mitigate) is correct because implementing a Web Application Firewall (WAF) reduces the likelihood or impact of an API-based attack without removing the API.

Exam trap

A common trap in CRISC is confusing 'remediate' (fixing the root cause) with 'mitigate' (reducing risk without eliminating the cause). Implementing a WAF is a mitigation, not remediation, because the API remains vulnerable at its core.

Practice this question →

53

MCQhard

A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?

A.Deny the existence of the risk

B.Purchase cyber insurance to cover potential losses

C.Avoid using the cloud CRM system

D.Include security requirements in the contract and perform regular vendor audits

AnswerD

This mitigates risk by enforcing controls.

Why this answer

Including security requirements in the contract and conducting regular vendor audits ensures the vendor meets the company's security standards, effectively mitigating the risk. Option A is incorrect because denying the existence of the risk is not a valid risk response. Option B is incorrect because purchasing cyber insurance transfers the financial impact but does not reduce the actual risk.

Option C is incorrect because avoiding the CRM system may be too drastic and could hinder business operations.

Practice this question →

54

MCQeasy

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

A.Risk Transfer

B.Risk Acceptance

C.Risk Mitigation

D.Risk Avoidance

AnswerC

The firewall blocks specific IP ranges, reducing the probability of attacks.

Why this answer

The firewall rule denies inbound traffic on TCP port 443 (HTTPS) from any source to any destination. This directly reduces the attack surface by blocking a specific protocol, which is a classic risk mitigation action. By implementing a technical control to reduce the likelihood or impact of a threat, the organization is applying risk mitigation, not transferring, accepting, or avoiding the risk entirely.

Exam trap

The trap here is confusing risk mitigation (reducing risk with controls) with risk avoidance (eliminating the risk by ceasing the activity), as candidates often think blocking a port is 'avoiding' the risk when it is actually reducing it while the underlying service remains operational.

How to eliminate wrong answers

Option A is wrong because risk transfer involves shifting the financial impact of a risk to a third party (e.g., insurance or outsourcing), not implementing a firewall rule. Option B is wrong because risk acceptance means formally acknowledging the risk without taking action to reduce it, whereas this rule actively reduces exposure. Option D is wrong because risk avoidance would mean eliminating the activity or asset that creates the risk (e.g., decommissioning the web server entirely), not just blocking a specific port.

Practice this question →

55

MCQhard

GlobalTech Inc., a multinational corporation, is planning to migrate its customer data to a new cloud platform. The migration involves transferring sensitive personally identifiable information (PII) from an on-premises database to a cloud-based CRM. The risk manager conducted a risk assessment and identified several risks, including unauthorized access during transit and residual data exposure due to misconfiguration. Mitigation controls include encryption in transit, encryption at rest, and strict access controls. The residual risk after mitigation is assessed as medium. The risk appetite statement defines that 'No data breach incidents resulting in regulatory fines exceeding $1 million are acceptable.' The estimated potential fine from a breach is $5 million with a likelihood of 2% after controls. The cost of additional controls to reduce likelihood to 0.5% is $500,000. The migrating team proposes to purchase cyber insurance with a $3 million coverage for $200,000 annual premium. The board of directors prefers to accept the residual risk to avoid additional costs. What should the risk manager do?

A.Advise the board to avoid the migration until all risks are eliminated.

B.Recommend purchasing cyber insurance to transfer the risk.

C.Accept the board's decision since the residual risk is medium.

D.Recommend implementing additional controls to reduce likelihood to 0.5%.

AnswerA

Avoidance is the only response that satisfies the risk appetite.

Why this answer

The residual risk after mitigation still exceeds the risk appetite: the potential fine of $5 million exceeds the $1 million threshold, and neither the proposed insurance (which covers only $3 million and does not reduce the residual risk) nor additional controls (cost $500,000 to reduce likelihood to 0.5%, but the expected loss of $25,000 is still below $1 million? Actually, the expected loss after additional controls would be $5M * 0.5% = $25,000, which is within appetite; however, the board prefers to accept the residual risk, but the risk manager must align with the risk appetite statement. The board's preference conflicts with the risk appetite; therefore, the risk manager should advise avoidance (not migrate until risks are eliminated) as it is the only option that ensures no breach exceeds the $1M fine threshold. Options B and C leave the risk above appetite, and D is costly and may not fully eliminate the risk of a breach exceeding $1M, so avoidance is the most prudent choice.

Practice this question →

56

MCQeasy

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

A.Mitigate by applying the patch

B.Avoid by taking the application offline

C.Accept the risk

D.Transfer via insurance

AnswerA

Patches remove the vulnerability.

Why this answer

Applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Practice this question →

57

MCQmedium

A multinational corporation has recently experienced a significant increase in phishing attacks targeting its employees. The attacks have caused several data breaches, resulting in regulatory fines and reputational damage. The organization has implemented security awareness training for all employees, but the number of successful attacks remains high. Additionally, the organization's risk appetite for cybersecurity incidents is Low. The CRO has asked you to recommend a risk response. You have the following options: A. Accept the risk because the training has reduced the likelihood, and further controls are too expensive. B. Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP). C. Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks. D. Avoid the risk by discontinuing the use of email for business communications. Which course of action is most appropriate given the organization's risk appetite and the current situation?

A.Avoid the risk by discontinuing the use of email for business communications.

B.Accept the risk because the training has reduced the likelihood, and further controls are too expensive.

C.Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.

D.Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).

AnswerC

Correct: Technical controls directly reduce likelihood and impact, aligning with low risk appetite.

Why this answer

Implementing technical controls like advanced email filtering (e.g., SPF, DKIM, DMARC validation) and multi-factor authentication (MFA) directly reduces both the likelihood and impact of phishing attacks. Given the organization's low risk appetite for cybersecurity incidents, this risk mitigation approach aligns with the need to lower residual risk to an acceptable level, especially since training alone has proven insufficient.

Exam trap

The trap here is that candidates may choose Option D (transfer) thinking outsourcing removes all risk, but in reality, the organization retains accountability for breaches and regulatory fines, making mitigation (Option C) the most appropriate response given the low risk appetite.

How to eliminate wrong answers

Option A is wrong because accepting the risk contradicts the organization's stated low risk appetite for cybersecurity incidents, and the training has not reduced the likelihood of successful attacks. Option B is wrong because transferring risk to an MSSP does not eliminate the organization's residual liability for regulatory fines and reputational damage, and the MSSP's controls may not fully align with the low risk appetite. Option D is wrong because avoiding the risk by discontinuing email is impractical for a multinational corporation, as email is a critical business communication channel, and this response would cause severe operational disruption without addressing the root cause of phishing.

Practice this question →

58

Multi-Selectmedium

Which THREE of the following are key considerations when selecting a risk response option?

Select 3 answers

A.Cost-benefit analysis of controls

B.Impact of the risk without controls

C.Risk appetite of the organization

D.Current control effectiveness

E.Legal and regulatory requirements

AnswersA, C, E

Cost-effectiveness is crucial.

Why this answer

A cost-benefit analysis of controls (Option A) is a key consideration because it ensures that the cost of implementing a risk response (e.g., a technical control like an intrusion prevention system or encryption) does not exceed the value of the asset being protected or the expected reduction in risk. This aligns with the principle of cost-effective risk mitigation, where the residual risk must be acceptable relative to the investment.

Exam trap

The trap here is that candidates confuse factors used in risk assessment (like impact without controls or current control effectiveness) with factors used in risk response selection, which specifically requires evaluating organizational appetite, cost-benefit, and mandatory legal/regulatory obligations.

Practice this question →

59

MCQeasy

A small e-commerce company has identified a high-risk vulnerability in its payment processing system that could expose customer credit card data. The IT team recommends immediately patching the system, but the patch requires a 4-hour downtime during peak sales hours. The risk manager proposes accepting the risk until the next scheduled maintenance window in two weeks. The CEO is concerned about potential fines from PCI DSS non-compliance. What is the BEST course of action?

A.Delay the patch until the next maintenance window but document the risk acceptance with CEO sign-off.

B.Accept the risk and schedule the patch during the next maintenance window as originally planned.

C.Apply the patch immediately during peak hours, accepting the revenue loss from downtime.

D.Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.

AnswerD

Compensating controls reduce risk while allowing a timely patch without peak-hour disruption.

Why this answer

The best course of action because implementing a compensating control (such as a web application firewall) immediately reduces the risk of data exposure while the patch is scheduled during off-peak hours within 48 hours, addressing PCI DSS compliance concerns without incurring significant revenue loss. Option A is wrong because accepting the risk without immediate mitigation violates PCI DSS requirements and exposes the company to fines. Option B is wrong because simply accepting the risk until the next maintenance window does not address the high-risk vulnerability and compliance obligations.

Option C is wrong because applying the patch during peak hours causes excessive revenue loss and customer impact, whereas the compensating control approach provides a balanced risk response.

Practice this question →

60

MCQhard

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

A.SQL injection

B.Cross-site scripting (XSS)

C.Cross-site request forgery (CSRF)

D.Brute-force or credential stuffing

AnswerD

Duplicate entry error and login success indicate multiple attempts.

Why this answer

The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Exam trap

Candidates often confuse the distinction between attacks that exploit authentication mechanisms (brute-force or credential stuffing) and those that exploit input validation (SQL injection, XSS) or session handling (CSRF). For the CRISC exam, remember that repeated login failures from the same source indicate an authentication-targeted attack.

How to eliminate wrong answers

Option A is wrong because SQL injection involves inserting malicious SQL queries into input fields to manipulate a database, which would show syntax errors or database error codes in logs, not repeated login attempts. Option B is wrong because cross-site scripting (XSS) injects client-side scripts into web pages viewed by others, reflected in logs as script tags or encoded payloads in URL parameters, not authentication failures. Option C is wrong because cross-site request forgery (CSRF) tricks a user's browser into executing unwanted actions on a trusted site, which would appear as legitimate requests from authenticated sessions, not failed logins.

Practice this question →

61

MCQhard

A healthcare organization is migrating its electronic health records (EHR) system to a cloud provider. The risk assessment shows that the cloud provider has strong security certifications (e.g., SOC 2 Type II, ISO 27001). However, the organization's legal team is concerned about data sovereignty laws that require patient data to remain within the country. The cloud provider's data centers are located in three regions: one in-country, and two outside. The project manager proposes using only the in-country data center. The IT director warns that this will increase latency and reduce redundancy. The risk manager must propose a response. Which is the BEST option?

A.Accept the legal risk because the cloud provider's certifications are sufficient, and document the decision.

B.Use all three data centers with automatic failover, and rely on the cloud provider's contractual guarantees of data residency.

C.Configure the EHR system to store primary data in the in-country data center, and use the other two centers for disaster recovery with data residency controls ensuring data does not leave the country unless encrypted and with legal approval.

D.Use only the in-country data center and accept the increased availability risk.

AnswerC

This option balances compliance by storing primary data in-country and using other centers for DR with data residency controls, addressing both legal and availability concerns.

Why this answer

It balances compliance with data sovereignty laws (using the in-country data center for primary storage) and maintains redundancy for disaster recovery with data residency controls. Option A is wrong because simply accepting the legal risk based on certifications is not sufficient; data sovereignty laws are regulatory requirements that must be adhered to, and the certifications do not override those laws. Option B is wrong because automatic failover to data centers outside the country would violate data sovereignty laws by allowing patient data to leave the country without proper controls.

Option D is wrong because using only one data center increases availability risk and does not address the legal concerns properly; it avoids the legal risk but introduces high operational risk.

Practice this question →

62

Matchingmedium

Match each risk management term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Risk level before controls are applied

Risk level after controls are applied

Amount of risk the organization is willing to accept

Acceptable deviation from risk appetite

Why these pairings

The correct matches are Risk with 'effect of uncertainty on objectives', Threat with 'circumstance/event that can adversely impact', and Vulnerability with 'weakness that can be exploited'. Common confusions include swapping definitions between these terms.

Practice this question →

63

MCQeasy

Refer to the exhibit. Which of the following is the MOST critical risk that should be addressed first?

A.SSH protocol version 1.0 on 192.168.1.10

B.RDP with weak encryption on 192.168.1.20

C.SMB signing not required on 192.168.1.20

D.Apache HTTP Server 2.2.3 on 192.168.1.10

AnswerA

Critical vulnerability should be addressed first.

Why this answer

SSH protocol version 1.0 is critically vulnerable to multiple security flaws, including session key recovery and man-in-the-middle attacks, due to weak integrity checks and lack of strong cryptographic algorithms. Unlike the other options, which represent misconfigurations or outdated software that can be mitigated with patches or configuration changes, SSHv1.0 is a deprecated protocol with known, easily exploitable vulnerabilities that directly compromise confidentiality and integrity of administrative access. This makes it the most critical risk to address first, as it exposes the core management interface of the asset.

Exam trap

Deprecated protocol versions (like SSHv1.0) are inherently more critical than configuration weaknesses or outdated software versions, because they represent a fundamental architectural flaw that cannot be fixed by patching or configuration alone.

How to eliminate wrong answers

Option B (RDP with weak encryption on 192.168.1.20) is wrong because while weak encryption (e.g., 56-bit or RC4) is a security concern, RDP can often be hardened by enabling Network Level Authentication (NLA) or upgrading to TLS-based encryption, and the risk is less immediate than a deprecated protocol like SSHv1.0. Option C (SMB signing not required on 192.168.1.20) is wrong because SMB signing not being required allows for potential relay attacks (e.g., NTLM relay), but this is a configuration weakness that can be mitigated by enabling signing, and it does not expose the system to direct remote code execution or credential theft as easily as SSHv1.0. Option D (Apache HTTP Server 2.2.3 on 192.168.1.10) is wrong because while this version is outdated and has known vulnerabilities (e.g., CVE-2011-3192, CVE-2012-0883), it is a web server that can be isolated or patched, and the risk is less critical than a protocol-level vulnerability on a management interface like SSH.

Practice this question →

64

MCQeasy

An organization purchases cyber insurance to cover potential losses from data breaches. This is an example of:

A.Risk Avoidance

B.Risk Transfer

C.Risk Mitigation

D.Risk Acceptance

AnswerB

Insurance is a classic example of risk transfer.

Why this answer

Purchasing cyber insurance transfers the financial risk of a data breach to the insurer, making it a classic example of risk transfer. In risk management, transfer shifts the impact of a loss to a third party (e.g., an insurance carrier) without eliminating the underlying threat or vulnerability. This aligns with the CRISC domain of Risk Response and Mitigation, where transfer is a distinct response strategy.

Exam trap

The trap here is that candidates confuse risk transfer with risk mitigation, thinking insurance reduces the likelihood of a breach, when in fact it only shifts the financial consequences.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean eliminating the activity that causes the risk (e.g., not storing any sensitive data), not insuring against it. Option C is wrong because risk mitigation involves implementing controls (e.g., encryption, firewalls) to reduce the likelihood or impact of a breach, not transferring financial liability. Option D is wrong because risk acceptance means formally acknowledging the risk and bearing the potential loss without purchasing insurance or implementing additional controls.

Practice this question →

65

MCQmedium

A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:

A.Risk Transfer

B.Risk Mitigation

C.Risk Acceptance

D.Risk Avoidance

AnswerB

Manual overrides and monitoring reduce the likelihood or impact of failure.

Why this answer

Implementing manual overrides and additional monitoring reduces the probability or impact of the legacy system failure without eliminating the risk entirely. This is the definition of risk mitigation, as it applies controls to lower the residual risk to an acceptable level while the system remains in operation.

Exam trap

The trap here is that candidates confuse 'risk mitigation' with 'risk acceptance' because the system is still running with known vulnerabilities, but the key differentiator is that active controls are being applied to reduce the risk, not merely acknowledged.

How to eliminate wrong answers

Option A is wrong because risk transfer would involve shifting the financial burden of failure to a third party (e.g., purchasing cyber insurance or outsourcing the system), not adding internal controls. Option C is wrong because risk acceptance means formally acknowledging the risk without taking any action to reduce it, which contradicts the decision to implement overrides and monitoring. Option D is wrong because risk avoidance would require removing the system or the activity causing the risk, such as decommissioning the legacy system entirely, which is explicitly stated as not immediately possible.

Practice this question →

66

MCQeasy

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

A.Risk Mitigation

B.Risk Avoidance

C.Risk Transfer

D.Risk Acceptance

AnswerB

Avoidance is the decision not to engage in the risk-prone activity.

Why this answer

By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Exam trap

The trap here is that candidates confuse 'avoidance' with 'mitigation' because both involve action, but avoidance eliminates the risk source entirely, whereas mitigation reduces but does not remove the risk.

How to eliminate wrong answers

Option A is wrong because risk mitigation involves implementing controls to reduce the likelihood or impact of a risk, not stopping the activity entirely. Option C is wrong because risk transfer would involve shifting the risk to another party (e.g., through insurance or outsourcing), not ceasing the service. Option D is wrong because risk acceptance means formally acknowledging and tolerating the residual risk without taking further action, which is the opposite of stopping the service.

Practice this question →

67

MCQhard

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

A.Risk Transfer

B.Risk Avoidance

C.Risk Acceptance

D.Risk Mitigation

AnswerC

Acceptance is appropriate when residual risk is still above appetite but the decision is made to tolerate it.

Why this answer

The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Exam trap

In the CRISC exam, the nuance is that risk acceptance is not inaction but a deliberate, documented decision to tolerate residual risk above appetite with ongoing monitoring, which candidates mistakenly confuse with risk mitigation or avoidance.

How to eliminate wrong answers

Option A is wrong because risk transfer would involve shifting the financial impact of the risk to a third party (e.g., cyber insurance or outsourcing), not proceeding with internal monitoring. Option B is wrong because risk avoidance would mean canceling or not launching the product to eliminate the risk entirely, which contradicts the decision to proceed. Option D is wrong because risk mitigation would require implementing additional controls to reduce the residual risk below the appetite, not accepting it above the threshold.

Practice this question →

68

Multi-Selectmedium

Which THREE of the following are key components of an effective risk response plan?

Select 3 answers

A.Documented risk response strategy (e.g., avoid, mitigate, transfer, accept)

B.Detailed implementation timeline

C.Assigned ownership and accountability

D.Regulatory impact analysis

E.Resource allocation and budget

AnswersA, C, E

The chosen strategy is a fundamental part of the plan.

Why this answer

A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.

Exam trap

The trap here is that candidates confuse project management components (like timelines and detailed schedules) with the strategic, decision-oriented components of a risk response plan, leading them to select 'Detailed implementation timeline' instead of recognizing that ownership, strategy, and budget are the three pillars CRISC emphasizes.

Practice this question →

69

MCQhard

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

A.Risk Avoidance

B.Risk Transfer

C.Risk Mitigation

D.Risk Acceptance

AnswerA

Avoidance is the decision to stop the risky activity.

Why this answer

Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Exam trap

The trap here is that candidates often confuse risk avoidance with risk mitigation, mistakenly thinking that any proactive action (like migrating) is a form of mitigation, whereas avoidance specifically means ceasing the activity that generates the risk.

How to eliminate wrong answers

Option B is wrong because risk transfer would involve shifting the financial impact of failure to a third party (e.g., purchasing cyber insurance or outsourcing to a managed service provider), not removing the system. Option C is wrong because risk mitigation would involve implementing controls to reduce the likelihood or impact of failure (e.g., adding monitoring, applying patches, or isolating the system) while keeping it operational. Option D is wrong because risk acceptance means formally acknowledging the risk and its potential consequences without taking action, which contradicts the active decision to decommission and migrate.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Risk Response Mitigation questions.

Start 20-question session