How should I use these Risk Response and Mitigation practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Risk Response and Mitigation questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Risk Response and Mitigation domain.

CRISC · topic practice

Risk Response and Mitigation practice questions

Practise Certified in Risk and Information Systems Control CRISC Risk Response and Mitigation practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Risk Response and Mitigation

Practice 10 questions Browse domain →

What the exam tests

What to know about Risk Response and Mitigation

Risk Response and Mitigation questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Risk Response and Mitigation exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Risk Response and Mitigation questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Risk Response and Mitigation explanation →

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Trap 1: Escalate directly to the board

Escalation is premature before attempting additional treatment options.

Trap 2: Update the risk register to reflect the residual risk

Updating the register is necessary, but the first action is to address the unacceptable residual risk.

Trap 3: Accept the residual risk

The residual risk exceeds appetite, so acceptance is not appropriate without further mitigation.

Study all Risk Response and Mitigation common traps →

A
Re-evaluate risk treatment options with the risk owner
The practitioner should collaborate with the risk owner to identify additional controls or modify existing ones.
B
Escalate directly to the board
Why wrong: Escalation is premature before attempting additional treatment options.
C
Update the risk register to reflect the residual risk
Why wrong: Updating the register is necessary, but the first action is to address the unacceptable residual risk.
D
Accept the residual risk
Why wrong: The residual risk exceeds appetite, so acceptance is not appropriate without further mitigation.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full NAT/PAT explanation →

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Trap 1: Risk avoidance by decommissioning the system

Avoidance is too extreme; the system is critical.

Trap 2: Risk transfer through cyber insurance

Insurance covers financial loss but not operational downtime.

Trap 3: Risk acceptance because mitigation is too costly

Acceptance is not appropriate due to high downtime costs.

Study all Risk Response and Mitigation common traps →

A
Risk avoidance by decommissioning the system
Why wrong: Avoidance is too extreme; the system is critical.
B
Risk transfer through cyber insurance
Why wrong: Insurance covers financial loss but not operational downtime.
C
Risk reduction by implementing redundant systems
Redundancy reduces both likelihood and impact of downtime.
D
Risk acceptance because mitigation is too costly
Why wrong: Acceptance is not appropriate due to high downtime costs.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Risk Response and Mitigation explanation →

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Trap 1: Risk reduction

Reduction would involve internal controls, not outsourcing.

Trap 2: Risk acceptance

Acceptance would mean no action is taken.

Trap 3: Risk avoidance

The organization is not avoiding the risk; it is still using the data center.

Study all Risk Response and Mitigation common traps →

A
Risk reduction
Why wrong: Reduction would involve internal controls, not outsourcing.
B
Risk transfer
Outsourcing transfers operational risk to the third party.
C
Risk acceptance
Why wrong: Acceptance would mean no action is taken.
D
Risk avoidance
Why wrong: The organization is not avoiding the risk; it is still using the data center.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Risk Response and Mitigation explanation →

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Trap 1: Accept the risk owner's decision

Accepting without escalation may violate risk appetite.

Trap 2: Document the deficiency and move on

Documentation alone does not address the risk.

Trap 3: Escalate directly to the board

Escalation should first go to senior management.

Study all Risk Response and Mitigation common traps →

A
Accept the risk owner's decision
Why wrong: Accepting without escalation may violate risk appetite.
B
Document the deficiency and move on
Why wrong: Documentation alone does not address the risk.
C
Communicate the risk exposure to senior management
Senior management needs to be aware of the risk and decide on additional funding.
D
Escalate directly to the board
Why wrong: Escalation should first go to senior management.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Risk Response and Mitigation explanation →

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Trap 1: Perform a new risk assessment

A new assessment may not focus on existing control performance.

Trap 2: Interview control owners

Interviews rely on self-reporting, which may be biased.

Trap 3: Review risk register updates

The register may not capture control performance.

Study all Risk Response and Mitigation common traps →

A
Perform a new risk assessment
Why wrong: A new assessment may not focus on existing control performance.
B
Interview control owners
Why wrong: Interviews rely on self-reporting, which may be biased.
C
Review risk register updates
Why wrong: The register may not capture control performance.
D
Conduct a control testing and audit review
Testing provides direct evidence of control operation.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Risk Response and Mitigation explanation →

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Trap 1: Installing intrusion detection systems

IDS detects but does not prevent the initial infection.

Trap 2: Conducting periodic vulnerability scans

Scans identify vulnerabilities but do not mitigate them directly.

Trap 3: Regularly backing up critical data

Backups reduce impact, not likelihood.

Study all Risk Response and Mitigation common traps →

A
Installing intrusion detection systems
Why wrong: IDS detects but does not prevent the initial infection.
B
Conducting periodic vulnerability scans
Why wrong: Scans identify vulnerabilities but do not mitigate them directly.
C
Regularly backing up critical data
Why wrong: Backups reduce impact, not likelihood.
D
Deploying network segmentation
Segmentation limits the spread of ransomware, reducing likelihood of widespread infection.
E
Implementing user awareness training
Training reduces the chance of users falling for phishing attacks.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Risk Response and Mitigation explanation →

Which THREE of the following are key components of an effective risk treatment plan?

Trap 1: The risk owner's signature

Signature is not a core component; approval is often documented elsewhere.

Trap 2: A detailed budget

Budget may be separate; the plan focuses on actions.

Study all Risk Response and Mitigation common traps →

A
Assigned responsibilities
Clear ownership ensures accountability.
B
Risk acceptance criteria
Defines what residual risk is acceptable.
C
A timeline for implementation
Deadlines drive action.
D
The risk owner's signature
Why wrong: Signature is not a core component; approval is often documented elsewhere.
E
A detailed budget
Why wrong: Budget may be separate; the plan focuses on actions.

Full breakdown with real-world context →

Question 8easymultiple choice

Study the full ACL explanation →

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Exhibit

Refer to the exhibit.

Access List: ACL-01
10 deny ip host 10.1.1.10 any
20 permit tcp 10.1.1.0 0.0.0.255 any eq 443
30 permit udp 10.1.1.0 0.0.0.255 any eq 53
40 deny ip any any

Trap 1: The ACL has no logging enabled

Lack of logging is a concern but less critical than broad permits.

Trap 2: The ACL is missing a permit statement for HTTP

HTTP is not required; HTTPS is more secure.

Trap 3: The ACL blocks all traffic from the internet

The ACL permits specific traffic.

Study all Risk Response and Mitigation common traps →

A
The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface
Broad permits may allow unauthorized traffic.
B
The ACL has no logging enabled
Why wrong: Lack of logging is a concern but less critical than broad permits.
C
The ACL is missing a permit statement for HTTP
Why wrong: HTTP is not required; HTTPS is more secure.
D
The ACL blocks all traffic from the internet
Why wrong: The ACL permits specific traffic.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Risk Response and Mitigation explanation →

You are a risk practitioner at a financial institution that is migrating its core banking system to a cloud provider. The migration plan includes a phased approach, with the first phase moving non-critical applications. However, during the second phase (moving customer-facing applications), the cloud provider experiences a major outage that lasts 6 hours. The outage was caused by a misconfiguration in the provider's network. The institution had conducted a risk assessment and identified cloud provider downtime as a risk, but the treatment plan only included a service level agreement (SLA) with financial penalties. The SLA does not cover the reputational damage and loss of customer trust. The risk register shows that the residual risk level was marked as 'low' before the incident. After the incident, senior management is demanding a review. Which of the following is the MOST appropriate action for the risk practitioner to take?

Trap 1: Negotiate a higher penalty in the SLA

Higher penalties still do not prevent downtime or address reputational damage.

Trap 2: Initiate a legal claim against the provider

Legal action may compensate but does not mitigate future risk.

Trap 3: Update the risk register to reflect the incident and accept the…

Acceptance without additional controls is inappropriate given the impact.

Study all Risk Response and Mitigation common traps →

A
Negotiate a higher penalty in the SLA
Why wrong: Higher penalties still do not prevent downtime or address reputational damage.
B
Initiate a legal claim against the provider
Why wrong: Legal action may compensate but does not mitigate future risk.
C
Update the risk register to reflect the incident and accept the residual risk
Why wrong: Acceptance without additional controls is inappropriate given the impact.
D
Reassess the risk and recommend implementing a multi-cloud architecture for critical applications
Multi-cloud reduces dependency on a single provider and addresses the impact.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Risk Response and Mitigation explanation →

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Trap 1: Rewrite the order matching engine in a memory-safe language

Rewriting the code removes the vulnerability, which is remediation, not a compensating control.

Trap 2: Deploy a Web Application Firewall (WAF) to block malicious payloads

A WAF is a preventive control that blocks attacks but does not compensate for the vulnerability; it's a separate security layer.

Trap 3: Enable detailed logging for all order matching transactions

Logging is detective and helps in forensics but does not reduce the likelihood or impact of the vulnerability.

Study all Risk Response and Mitigation common traps →

A
Rewrite the order matching engine in a memory-safe language
Why wrong: Rewriting the code removes the vulnerability, which is remediation, not a compensating control.
B
Deploy a Web Application Firewall (WAF) to block malicious payloads
Why wrong: A WAF is a preventive control that blocks attacks but does not compensate for the vulnerability; it's a separate security layer.
C
Enable detailed logging for all order matching transactions
Why wrong: Logging is detective and helps in forensics but does not reduce the likelihood or impact of the vulnerability.
D
Require manual approval for all orders above a threshold
Manual approval adds a human verification step, reducing the impact of a potential exploit.
E
Implement rate limiting on order submissions
Rate limiting reduces the likelihood of exploitation by limiting the number of requests, thus compensating for the vulnerability.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Risk Response and Mitigation explanation →

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Exhibit

Refer to the exhibit.

```
[Risk Register Excerpt]
Risk ID: R-0042
Risk Description: Unauthorized access to customer PII due to weak database encryption
Inherent Risk Score: 16 (Likelihood: 4, Impact: 4)
Control: AES-256 encryption at rest (implemented)
Residual Risk Score: 8 (Likelihood: 2, Impact: 4)
Risk Appetite Threshold: 10
```

Trap 1: Mitigate the risk by implementing additional encryption controls

Additional mitigation is not required because the risk is already within appetite.

Trap 2: Transfer the risk to a third-party insurer

Transfer is not necessary since the residual risk is within appetite.

Trap 3: Avoid the risk by discontinuing storage of PII

Avoidance is too drastic; the risk is acceptable.

Study all Risk Response and Mitigation common traps →

A
Mitigate the risk by implementing additional encryption controls
Why wrong: Additional mitigation is not required because the risk is already within appetite.
B
Transfer the risk to a third-party insurer
Why wrong: Transfer is not necessary since the residual risk is within appetite.
C
Avoid the risk by discontinuing storage of PII
Why wrong: Avoidance is too drastic; the risk is acceptable.
D
Accept the risk and continue monitoring
Since residual risk is below the risk appetite threshold, acceptance is appropriate.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Risk Response and Mitigation explanation →

A global manufacturing company is implementing a new ERP system across multiple regions. The project manager has identified a risk that data migration from legacy systems may cause data corruption, leading to production delays. The risk owner proposes conducting a full data reconciliation after migration. However, the IT director argues that this would be too time-consuming and suggests only sampling data for verification. The risk manager must decide on the risk response. The project timeline is tight, and the company has a low tolerance for data integrity issues. Which of the following is the BEST course of action?

Trap 1: Accept the risk and proceed with data sampling to save time

Sampling may not detect all corruption, which conflicts with low risk tolerance.

Trap 2: Avoid the risk by postponing the ERP implementation

Postponement is too drastic and not a practical response to a specific migration risk.

Trap 3: Transfer the risk by purchasing insurance for data corruption

Insurance does not prevent data corruption; it only provides financial compensation, which may not solve the operational impact.

Study all Risk Response and Mitigation common traps →

A
Accept the risk and proceed with data sampling to save time
Why wrong: Sampling may not detect all corruption, which conflicts with low risk tolerance.
B
Avoid the risk by postponing the ERP implementation
Why wrong: Postponement is too drastic and not a practical response to a specific migration risk.
C
Implement the full data reconciliation as proposed by the risk owner
Full reconciliation directly addresses the risk and aligns with low tolerance for data integrity issues.
D
Transfer the risk by purchasing insurance for data corruption
Why wrong: Insurance does not prevent data corruption; it only provides financial compensation, which may not solve the operational impact.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full Risk Response and Mitigation explanation →

Order the steps for implementing a risk treatment plan.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediumdrag order

Read the full Risk Response and Mitigation explanation →

Sequence the steps for implementing a new control based on risk assessment findings.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediumdrag order

Read the full Risk Response and Mitigation explanation →

Put the steps for performing a control self-assessment (CSA) in order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediummatching

Read the full Risk Response and Mitigation explanation →

Match each risk response strategy to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Eliminate the activity that causes the risk

Reduce the likelihood or impact of the risk

Shift the risk to a third party, e.g., insurance

Acknowledge the risk and take no further action

Question 17mediummatching

Read the full Risk Response and Mitigation explanation →

Match each risk management term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Risk level before controls are applied

Risk level after controls are applied

Amount of risk the organization is willing to accept

Acceptable deviation from risk appetite

Question 18mediummatching

Read the full Risk Response and Mitigation explanation →

Match each risk management process step to its activity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Find and list potential risks

Determine likelihood and impact

Compare risk levels to risk criteria

Select and implement controls

Question 19easymultiple choice

Read the full NAT/PAT explanation →

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

Trap 1: Avoidance

Avoidance would mean decommissioning the application which is not necessary.

Trap 2: Transfer

Transfer would require insurance or outsourcing which is not cost-effective.

Study all Risk Response and Mitigation common traps →

A
Avoidance
Why wrong: Avoidance would mean decommissioning the application which is not necessary.
B
Transfer
Why wrong: Transfer would require insurance or outsourcing which is not cost-effective.
C
Acceptance
Acceptance is appropriate when risk is low impact and cannot be mitigated or transferred easily.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Risk Response and Mitigation explanation →

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Trap 1: Update the risk register

Updating the risk register does not address the exceedance.

Trap 2: Implement additional controls

Increasing controls may not be feasible without approval.

Trap 3: Reduce the risk appetite

Reducing appetite without addressing risk is not appropriate.

Study all Risk Response and Mitigation common traps →

A
Update the risk register
Why wrong: Updating the risk register does not address the exceedance.
B
Escalate to senior management
Residual risk exceeding appetite requires senior management decision.
C
Implement additional controls
Why wrong: Increasing controls may not be feasible without approval.
D
Reduce the risk appetite
Why wrong: Reducing appetite without addressing risk is not appropriate.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Risk Response and Mitigation sessions

Start a Risk Response and Mitigation only practice session

Every question in these sessions is drawn from the Risk Response and Mitigation domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Risk Response and Mitigation questions →Mixed CRISC session

Frequently asked questions

What does the CRISC exam test about Risk Response and Mitigation?: Risk Response and Mitigation questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Risk Response and Mitigation questions in a focused session?: Yes — the session launcher on this page draws every question from the Risk Response and Mitigation domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CRISC topics?: Use the topic links above to move to related areas, or go back to the CRISC question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CRISC exam covers. They are not copied from any real exam or dump site.

Risk Response and Mitigation only

10 questions 20 questions 30 questions 50 questions

Mixed CRISC session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CRISC questions Risk Response and Mitigation domain overview CRISC exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Risk Response and Mitigation practice questions

What to know about Risk Response and Mitigation

Common Risk Response and Mitigation exam traps

Risk Response and Mitigation questions

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Which THREE of the following are key components of an effective risk treatment plan?

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Exhibit

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Exhibit

Order the steps for implementing a risk treatment plan.

Sequence the steps for implementing a new control based on risk assessment findings.

Put the steps for performing a control self-assessment (CSA) in order.

Match each risk response strategy to its definition.

Match each risk management term to its definition.

Match each risk management process step to its activity.

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Track your progress over time

Start a Risk Response and Mitigation only practice session

Related CRISC topic practice pages

IT Risk Identification practice questions