How should I use these Risk Response and Mitigation practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Risk Response and Mitigation questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Risk Response and Mitigation domain.

CRISC · topic practice

Risk Response and Mitigation practice questions

Practise Certified in Risk and Information Systems Control CRISC Risk Response and Mitigation practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Risk Response and Mitigation

Practice 10 questions Browse domain →

What the exam tests

What to know about Risk Response and Mitigation

Risk Response and Mitigation questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Risk Response and Mitigation exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Risk Response and Mitigation questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Risk Response and Mitigation explanation →

Which TWO of the following are examples of risk transfer? (Select TWO.)

Trap 1: Implementing encryption

Encryption is a mitigation control, not transfer.

Trap 2: Accepting residual risk

Acceptance is a strategy, not transfer.

Trap 3: Conducting security training

Training is a mitigation control.

Study all Risk Response and Mitigation common traps →

A
Outsourcing IT operations to a third party
Outsourcing transfers the risk of IT operations to the vendor.
B
Implementing encryption
Why wrong: Encryption is a mitigation control, not transfer.
C
Accepting residual risk
Why wrong: Acceptance is a strategy, not transfer.
D
Buying cyber insurance
Insurance transfers the financial impact of incidents to the insurer.
E
Conducting security training
Why wrong: Training is a mitigation control.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Risk Response and Mitigation explanation →

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Exhibit

Refer to the exhibit.

AWS S3 bucket policy:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Trap 1: Risk of cost; set a budget alert

While cost risks exist in cloud environments, the primary risk from the policy shown is data exposure, not cost. Budget alerts address cost but not the security risk.

Trap 2: Risk of availability; implement backup

Availability risk is not the primary issue here. Backup addresses data loss or unavailability, not unauthorized access.

Trap 3: No risk; the policy is standard

The policy is not standard; a wildcard principal allowing public access is a significant security misconfiguration.

Study all Risk Response and Mitigation common traps →

A
Risk of cost; set a budget alert
Why wrong: While cost risks exist in cloud environments, the primary risk from the policy shown is data exposure, not cost. Budget alerts address cost but not the security risk.
B
Risk of data exposure; apply a deny rule to restrict access
Correct. The permissive policy allows public access, so restricting it with a deny rule is the appropriate response.
C
Risk of availability; implement backup
Why wrong: Availability risk is not the primary issue here. Backup addresses data loss or unavailability, not unauthorized access.
D
No risk; the policy is standard
Why wrong: The policy is not standard; a wildcard principal allowing public access is a significant security misconfiguration.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full Risk Response and Mitigation explanation →

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Trap 1: Escalate directly to the board

Escalation is premature before attempting additional treatment options.

Trap 2: Update the risk register to reflect the residual risk

Updating the register is necessary, but the first action is to address the unacceptable residual risk.

Trap 3: Accept the residual risk

The residual risk exceeds appetite, so acceptance is not appropriate without further mitigation.

Study all Risk Response and Mitigation common traps →

A
Re-evaluate risk treatment options with the risk owner
The practitioner should collaborate with the risk owner to identify additional controls or modify existing ones.
B
Escalate directly to the board
Why wrong: Escalation is premature before attempting additional treatment options.
C
Update the risk register to reflect the residual risk
Why wrong: Updating the register is necessary, but the first action is to address the unacceptable residual risk.
D
Accept the residual risk
Why wrong: The residual risk exceeds appetite, so acceptance is not appropriate without further mitigation.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Risk Response and Mitigation explanation →

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

Trap 1: Risk avoidance by decommissioning the system

Avoidance is too extreme; the system is critical.

Trap 2: Risk transfer through cyber insurance

Insurance covers financial loss but not operational downtime.

Trap 3: Risk acceptance because mitigation is too costly

Acceptance is not appropriate due to high downtime costs.

Study all Risk Response and Mitigation common traps →

A
Risk avoidance by decommissioning the system
Why wrong: Avoidance is too extreme; the system is critical.
B
Risk transfer through cyber insurance
Why wrong: Insurance covers financial loss but not operational downtime.
C
Risk reduction by implementing redundant systems
Redundancy reduces both likelihood and impact of downtime.
D
Risk acceptance because mitigation is too costly
Why wrong: Acceptance is not appropriate due to high downtime costs.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Risk Response and Mitigation explanation →

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Trap 1: Risk reduction

Reduction would involve internal controls, not outsourcing.

Trap 2: Risk acceptance

Acceptance would mean no action is taken.

Trap 3: Risk avoidance

The organization is not avoiding the risk; it is still using the data center.

Study all Risk Response and Mitigation common traps →

A
Risk reduction
Why wrong: Reduction would involve internal controls, not outsourcing.
B
Risk transfer
Outsourcing transfers operational risk to the third party.
C
Risk acceptance
Why wrong: Acceptance would mean no action is taken.
D
Risk avoidance
Why wrong: The organization is not avoiding the risk; it is still using the data center.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Risk Response and Mitigation explanation →

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Trap 1: Accept the risk owner's decision

Accepting without escalation may violate risk appetite.

Trap 2: Document the deficiency and move on

Documentation alone does not address the risk.

Trap 3: Escalate directly to the board

Escalation should first go to senior management.

Study all Risk Response and Mitigation common traps →

A
Accept the risk owner's decision
Why wrong: Accepting without escalation may violate risk appetite.
B
Document the deficiency and move on
Why wrong: Documentation alone does not address the risk.
C
Communicate the risk exposure to senior management
Senior management needs to be aware of the risk and decide on additional funding.
D
Escalate directly to the board
Why wrong: Escalation should first go to senior management.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Risk Response and Mitigation explanation →

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Trap 1: Perform a new risk assessment

A new assessment may not focus on existing control performance.

Trap 2: Interview control owners

Interviews rely on self-reporting, which may be biased.

Trap 3: Review risk register updates

The register may not capture control performance.

Study all Risk Response and Mitigation common traps →

A
Perform a new risk assessment
Why wrong: A new assessment may not focus on existing control performance.
B
Interview control owners
Why wrong: Interviews rely on self-reporting, which may be biased.
C
Review risk register updates
Why wrong: The register may not capture control performance.
D
Conduct a control testing and audit review
Testing provides direct evidence of control operation.

Full breakdown with real-world context →

Question 8mediummulti select

Read the full Risk Response and Mitigation explanation →

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Trap 1: Installing intrusion detection systems

IDS detects but does not prevent the initial infection.

Trap 2: Conducting periodic vulnerability scans

Scans identify vulnerabilities but do not mitigate them directly.

Trap 3: Regularly backing up critical data

Backups reduce impact, not likelihood.

Study all Risk Response and Mitigation common traps →

A
Installing intrusion detection systems
Why wrong: IDS detects but does not prevent the initial infection.
B
Conducting periodic vulnerability scans
Why wrong: Scans identify vulnerabilities but do not mitigate them directly.
C
Regularly backing up critical data
Why wrong: Backups reduce impact, not likelihood.
D
Deploying network segmentation
Segmentation limits the spread of ransomware, reducing likelihood of widespread infection.
E
Implementing user awareness training
Training reduces the chance of users falling for phishing attacks.

Full breakdown with real-world context →

Question 9hardmulti select

Read the full Risk Response and Mitigation explanation →

Which THREE of the following are key components of an effective risk treatment plan?

Trap 1: The risk owner's signature

Signature is not a core component; approval is often documented elsewhere.

Trap 2: A detailed budget

Budget may be separate; the plan focuses on actions.

Study all Risk Response and Mitigation common traps →

A
Assigned responsibilities
Clear ownership ensures accountability.
B
Risk acceptance criteria
Defines what residual risk is acceptable.
C
A timeline for implementation
Deadlines drive action.
D
The risk owner's signature
Why wrong: Signature is not a core component; approval is often documented elsewhere.
E
A detailed budget
Why wrong: Budget may be separate; the plan focuses on actions.

Full breakdown with real-world context →

Question 10easymultiple choice

Study the full ACL explanation →

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Exhibit

Refer to the exhibit.

Access List: ACL-01
10 deny ip host 10.1.1.10 any
20 permit tcp 10.1.1.0 0.0.0.255 any eq 443
30 permit udp 10.1.1.0 0.0.0.255 any eq 53
40 deny ip any any

Trap 1: The ACL has no logging enabled

Lack of logging is a concern but less critical than broad permits.

Trap 2: The ACL is missing a permit statement for HTTP

HTTP is not required; HTTPS is more secure.

Trap 3: The ACL blocks all traffic from the internet

The ACL permits specific traffic.

Study all Risk Response and Mitigation common traps →

A
The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface
Broad permits may allow unauthorized traffic.
B
The ACL has no logging enabled
Why wrong: Lack of logging is a concern but less critical than broad permits.
C
The ACL is missing a permit statement for HTTP
Why wrong: HTTP is not required; HTTPS is more secure.
D
The ACL blocks all traffic from the internet
Why wrong: The ACL permits specific traffic.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Risk Response and Mitigation explanation →

You are a risk practitioner at a financial institution that is migrating its core banking system to a cloud provider. The migration plan includes a phased approach, with the first phase moving non-critical applications. However, during the second phase (moving customer-facing applications), the cloud provider experiences a major outage that lasts 6 hours. The outage was caused by a misconfiguration in the provider's network. The institution had conducted a risk assessment and identified cloud provider downtime as a risk, but the treatment plan only included a service level agreement (SLA) with financial penalties. The SLA does not cover the reputational damage and loss of customer trust. The risk register shows that the residual risk level was marked as 'low' before the incident. After the incident, senior management is demanding a review. Which of the following is the MOST appropriate action for the risk practitioner to take?

Trap 1: Negotiate a higher penalty in the SLA

Higher penalties still do not prevent downtime or address reputational damage.

Trap 2: Initiate a legal claim against the provider

Legal action may compensate but does not mitigate future risk.

Trap 3: Update the risk register to reflect the incident and accept the…

Acceptance without additional controls is inappropriate given the impact.

Study all Risk Response and Mitigation common traps →

A
Negotiate a higher penalty in the SLA
Why wrong: Higher penalties still do not prevent downtime or address reputational damage.
B
Initiate a legal claim against the provider
Why wrong: Legal action may compensate but does not mitigate future risk.
C
Update the risk register to reflect the incident and accept the residual risk
Why wrong: Acceptance without additional controls is inappropriate given the impact.
D
Reassess the risk and recommend implementing a multi-cloud architecture for critical applications
Multi-cloud reduces dependency on a single provider and addresses the impact.

Full breakdown with real-world context →

Question 12mediummulti select

Read the full Risk Response and Mitigation explanation →

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Trap 1: Rewrite the order matching engine in a memory-safe language

Rewriting the code removes the vulnerability, which is remediation, not a compensating control.

Trap 2: Deploy a Web Application Firewall (WAF) to block malicious payloads

A WAF is a preventive control that blocks attacks but does not compensate for the vulnerability; it's a separate security layer.

Trap 3: Enable detailed logging for all order matching transactions

Logging is detective and helps in forensics but does not reduce the likelihood or impact of the vulnerability.

Study all Risk Response and Mitigation common traps →

A
Rewrite the order matching engine in a memory-safe language
Why wrong: Rewriting the code removes the vulnerability, which is remediation, not a compensating control.
B
Deploy a Web Application Firewall (WAF) to block malicious payloads
Why wrong: A WAF is a preventive control that blocks attacks but does not compensate for the vulnerability; it's a separate security layer.
C
Enable detailed logging for all order matching transactions
Why wrong: Logging is detective and helps in forensics but does not reduce the likelihood or impact of the vulnerability.
D
Require manual approval for all orders above a threshold
Manual approval adds a human verification step, reducing the impact of a potential exploit.
E
Implement rate limiting on order submissions
Rate limiting reduces the likelihood of exploitation by limiting the number of requests, thus compensating for the vulnerability.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Risk Response and Mitigation explanation →

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Exhibit

Refer to the exhibit.

```
[Risk Register Excerpt]
Risk ID: R-0042
Risk Description: Unauthorized access to customer PII due to weak database encryption
Inherent Risk Score: 16 (Likelihood: 4, Impact: 4)
Control: AES-256 encryption at rest (implemented)
Residual Risk Score: 8 (Likelihood: 2, Impact: 4)
Risk Appetite Threshold: 10
```

Trap 1: Mitigate the risk by implementing additional encryption controls

Additional mitigation is not required because the risk is already within appetite.

Trap 2: Transfer the risk to a third-party insurer

Transfer is not necessary since the residual risk is within appetite.

Trap 3: Avoid the risk by discontinuing storage of PII

Avoidance is too drastic; the risk is acceptable.

Study all Risk Response and Mitigation common traps →

A
Mitigate the risk by implementing additional encryption controls
Why wrong: Additional mitigation is not required because the risk is already within appetite.
B
Transfer the risk to a third-party insurer
Why wrong: Transfer is not necessary since the residual risk is within appetite.
C
Avoid the risk by discontinuing storage of PII
Why wrong: Avoidance is too drastic; the risk is acceptable.
D
Accept the risk and continue monitoring
Since residual risk is below the risk appetite threshold, acceptance is appropriate.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full Risk Response and Mitigation explanation →

A global manufacturing company is implementing a new ERP system across multiple regions. The project manager has identified a risk that data migration from legacy systems may cause data corruption, leading to production delays. The risk owner proposes conducting a full data reconciliation after migration. However, the IT director argues that this would be too time-consuming and suggests only sampling data for verification. The risk manager must decide on the risk response. The project timeline is tight, and the company has a low tolerance for data integrity issues. Which of the following is the BEST course of action?

Trap 1: Accept the risk and proceed with data sampling to save time

Sampling may not detect all corruption, which conflicts with low risk tolerance.

Trap 2: Avoid the risk by postponing the ERP implementation

Postponement is too drastic and not a practical response to a specific migration risk.

Trap 3: Transfer the risk by purchasing insurance for data corruption

Insurance does not prevent data corruption; it only provides financial compensation, which may not solve the operational impact.

Study all Risk Response and Mitigation common traps →

A
Accept the risk and proceed with data sampling to save time
Why wrong: Sampling may not detect all corruption, which conflicts with low risk tolerance.
B
Avoid the risk by postponing the ERP implementation
Why wrong: Postponement is too drastic and not a practical response to a specific migration risk.
C
Implement the full data reconciliation as proposed by the risk owner
Full reconciliation directly addresses the risk and aligns with low tolerance for data integrity issues.
D
Transfer the risk by purchasing insurance for data corruption
Why wrong: Insurance does not prevent data corruption; it only provides financial compensation, which may not solve the operational impact.

Full breakdown with real-world context →

Question 15mediumdrag order

Read the full Risk Response and Mitigation explanation →

Order the steps for implementing a risk treatment plan.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Select risk response, then obtain approval, then develop risk…

This is incorrect because approval should come after the treatment plan is developed, not before. You cannot approve a plan that hasn't been created yet.

Trap 2: Develop risk treatment plan, then select risk response, then obtain…

This is incorrect because you must first decide the risk response (what to do) before creating a detailed plan. Developing a plan without knowing the chosen response is illogical.

Trap 3: Select risk response, then develop risk treatment plan, then…

This is incorrect because implementation should occur only after the plan has been approved by management. Implementing before approval risks wasting resources on unapproved actions.

Study all Risk Response and Mitigation common traps →

A
Select risk response, then develop risk treatment plan, then obtain approval, then implement the plan, then monitor and review.
This is the correct order because risk treatment must start with selecting the appropriate response (e.g., mitigate, transfer, accept, avoid), then planning how to execute it, obtaining formal approval, implementing the controls, and finally monitoring their effectiveness to ensure the risk is managed.
B
Select risk response, then obtain approval, then develop risk treatment plan, then implement the plan, then monitor and review.
Why wrong: This is incorrect because approval should come after the treatment plan is developed, not before. You cannot approve a plan that hasn't been created yet.
C
Develop risk treatment plan, then select risk response, then obtain approval, then implement the plan, then monitor and review.
Why wrong: This is incorrect because you must first decide the risk response (what to do) before creating a detailed plan. Developing a plan without knowing the chosen response is illogical.
D
Select risk response, then develop risk treatment plan, then implement the plan, then obtain approval, then monitor and review.
Why wrong: This is incorrect because implementation should occur only after the plan has been approved by management. Implementing before approval risks wasting resources on unapproved actions.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full Risk Response and Mitigation explanation →

Sequence the steps for implementing a new control based on risk assessment findings.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Procure/Build the control, then Design the control, then Test the…

This is incorrect because the control must be designed before it can be procured or built; otherwise, the procurement or build may not meet the required specifications.

Trap 2: Design the control, then Test the control, then Procure/Build the…

This is incorrect because testing cannot occur before the control is built or procured; testing requires a physical or implemented control to evaluate.

Trap 3: Design the control, then Procure/Build the control, then Deploy the…

This is incorrect because deploying the control before testing it risks introducing an ineffective or flawed control into the production environment.

Study all Risk Response and Mitigation common traps →

A
Design the control, then Procure/Build the control, then Test the control, then Deploy the control, then Monitor the control.
This is the correct order because controls should first be designed to meet requirements, then procured or built, tested to verify effectiveness, deployed into production, and finally monitored to ensure ongoing performance.
B
Procure/Build the control, then Design the control, then Test the control, then Deploy the control, then Monitor the control.
Why wrong: This is incorrect because the control must be designed before it can be procured or built; otherwise, the procurement or build may not meet the required specifications.
C
Design the control, then Test the control, then Procure/Build the control, then Deploy the control, then Monitor the control.
Why wrong: This is incorrect because testing cannot occur before the control is built or procured; testing requires a physical or implemented control to evaluate.
D
Design the control, then Procure/Build the control, then Deploy the control, then Test the control, then Monitor the control.
Why wrong: This is incorrect because deploying the control before testing it risks introducing an ineffective or flawed control into the production environment.

Full breakdown with real-world context →

Question 17mediumdrag order

Read the full Risk Response and Mitigation explanation →

Put the steps for performing a control self-assessment (CSA) in order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Define scope, then assess effectiveness, then identify controls,…

This is incorrect because controls must be identified before their effectiveness can be assessed.

Trap 2: Identify controls, then define scope, then assess effectiveness,…

This is incorrect because the scope must be defined before controls can be identified.

Trap 3: Define scope, then identify controls, then identify gaps, then…

This is incorrect because gaps are identified after assessing effectiveness, not before.

Study all Risk Response and Mitigation common traps →

A
Define scope, then identify controls, then assess effectiveness, then identify gaps, then report results
This is the correct order because CSA starts with defining the scope of the assessment, then identifying the controls in place, assessing their effectiveness, identifying any gaps, and finally reporting the findings.
B
Define scope, then assess effectiveness, then identify controls, then identify gaps, then report results
Why wrong: This is incorrect because controls must be identified before their effectiveness can be assessed.
C
Identify controls, then define scope, then assess effectiveness, then identify gaps, then report results
Why wrong: This is incorrect because the scope must be defined before controls can be identified.
D
Define scope, then identify controls, then identify gaps, then assess effectiveness, then report results
Why wrong: This is incorrect because gaps are identified after assessing effectiveness, not before.

Full breakdown with real-world context →

Question 18mediummatching

Read the full Risk Response and Mitigation explanation →

Match each risk response strategy to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Eliminate the activity that causes the risk

Reduce the likelihood or impact of the risk

Shift the risk to a third party, e.g., insurance

Acknowledge the risk and take no further action

Trap 1: Avoid: Shifting the risk to another party.

Incorrect: This describes risk transfer, not avoidance.

Trap 2: Accept: Actions taken to reduce the likelihood or impact of a risk.

Incorrect: This describes risk mitigation, not acceptance.

Study all Risk Response and Mitigation common traps →

A
Avoid: Identifying a risk and making the decision to no longer perform the activity that gives rise to the risk.
Correct: Risk avoidance means eliminating the risk by discontinuing the activity.
B
Avoid: Shifting the risk to another party.
Why wrong: Incorrect: This describes risk transfer, not avoidance.
C
Accept: A decision to accept the consequences and likelihood of a risk.
Correct: Risk acceptance is a conscious decision to retain the risk.
D
Accept: Actions taken to reduce the likelihood or impact of a risk.
Why wrong: Incorrect: This describes risk mitigation, not acceptance.
E
Mitigate: Actions taken to reduce the likelihood or impact of a risk.
Correct: Risk mitigation involves implementing controls to reduce risk.
F
Transfer: Shifting the risk to another party, e.g., through insurance or outsourcing.
Correct: Risk transfer moves the risk to a third party.

Full breakdown with real-world context →

Question 19mediummatching

Read the full Risk Response and Mitigation explanation →

Match each risk management term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Risk level before controls are applied

Risk level after controls are applied

Amount of risk the organization is willing to accept

Acceptable deviation from risk appetite

Trap 1: Risk: A weakness that could be exploited.

Incorrect — this describes vulnerability, not risk.

Trap 2: Threat: The effect of uncertainty on objectives.

Incorrect — this describes risk, not threat.

Trap 3: Vulnerability: Any circumstance or event with potential to…

Incorrect — this describes threat, not vulnerability.

Study all Risk Response and Mitigation common traps →

A
Risk: The effect of uncertainty on objectives.
This is the standard definition of risk from ISO 31000.
B
Threat: Any circumstance or event with the potential to adversely impact organizational operations or assets.
This definition aligns with NIST SP 800-30.
C
Vulnerability: A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
This is the NIST definition of vulnerability.
D
Risk: A weakness that could be exploited.
Why wrong: Incorrect — this describes vulnerability, not risk.
E
Threat: The effect of uncertainty on objectives.
Why wrong: Incorrect — this describes risk, not threat.
F
Vulnerability: Any circumstance or event with potential to adversely impact.
Why wrong: Incorrect — this describes threat, not vulnerability.

Full breakdown with real-world context →

Question 20mediummatching

Read the full Risk Response and Mitigation explanation →

Match each risk management process step to its activity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Find and list potential risks

Determine likelihood and impact

Compare risk levels to risk criteria

Select and implement controls

Trap 1: Risk Identification: The process of determining the probability and…

Incorrect — this describes Risk Assessment, not Risk Identification.

Trap 2: Risk Assessment: The process of finding, recognizing, and…

Incorrect — this describes Risk Identification, not Risk Assessment.

Study all Risk Response and Mitigation common traps →

A
Risk Identification: The process of finding, recognizing, and documenting risks.
Risk Identification is the step where risks are identified and documented.
B
Risk Assessment: The process of determining the probability and impact of identified risks.
Risk Assessment involves evaluating the likelihood and potential impact of risks.
C
Risk Response: The process of developing and implementing strategies to address risks.
Risk Response includes actions to mitigate, transfer, avoid, or accept risks.
D
Risk Identification: The process of determining the probability and impact of identified risks.
Why wrong: Incorrect — this describes Risk Assessment, not Risk Identification.
E
Risk Assessment: The process of finding, recognizing, and documenting risks.
Why wrong: Incorrect — this describes Risk Identification, not Risk Assessment.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Risk Response and Mitigation sessions

Start a Risk Response and Mitigation only practice session

Every question in these sessions is drawn from the Risk Response and Mitigation domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Risk Response and Mitigation questions →Mixed CRISC session

Frequently asked questions

What does the CRISC exam test about Risk Response and Mitigation?: Risk Response and Mitigation questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Risk Response and Mitigation questions in a focused session?: Yes — the session launcher on this page draws every question from the Risk Response and Mitigation domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CRISC topics?: Use the topic links above to move to related areas, or go back to the CRISC question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CRISC exam covers. They are not copied from any real exam or dump site.

Risk Response and Mitigation only

10 questions 20 questions 30 questions 50 questions

Mixed CRISC session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CRISC questions Risk Response and Mitigation domain overview CRISC exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Risk Response and Mitigation practice questions

What to know about Risk Response and Mitigation

Common Risk Response and Mitigation exam traps

Risk Response and Mitigation questions

Which TWO of the following are examples of risk transfer? (Select TWO.)

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Exhibit

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

A multinational organization is implementing a risk mitigation strategy for a critical system. The business impact analysis shows that downtime costs are extremely high. Which risk response strategy is MOST appropriate for this scenario?

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Which TWO of the following are effective risk mitigation strategies for reducing the likelihood of a ransomware attack?

Which THREE of the following are key components of an effective risk treatment plan?

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Exhibit

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Exhibit

Order the steps for implementing a risk treatment plan.

Sequence the steps for implementing a new control based on risk assessment findings.

Put the steps for performing a control self-assessment (CSA) in order.

Match each risk response strategy to its definition.

Match each risk management term to its definition.

Match each risk management process step to its activity.

Track your progress over time

Start a Risk Response and Mitigation only practice session

Related CRISC topic practice pages

IT Risk Identification practice questions

IT Risk Assessment practice questions

Risk Response and Reporting practice questions

Information Technology and Security practice questions