CRISC Risk Response and Mitigation Practice Question
Which TWO of the following are examples of risk transfer? (Select TWO.)
⚠ Common exam trap
The distinction between risk transfer and risk mitigation is frequently tested on the CRISC exam. Candidates often confuse controls like encryption or training with transfer mechanisms, when in fact only insurance and outsourcing (with liability transfer) qualify as true risk transfer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Outsourcing IT operations to a third party
Option A (Outsourcing IT operations to a third party) is correct because risk transfer shifts the financial and operational impact of a risk to another entity via a contractual agreement, such as an SLA or MSA, where the vendor assumes responsibility for the outsourced functions. Option D (Buying cyber insurance) is correct because insurance is the classic form of risk transfer, where the insurer agrees to compensate the organization for covered losses in exchange for premiums, moving the financial consequence of the risk to the insurer. Option B (Implementing encryption) is a risk mitigation or reduction control that lowers the likelihood or impact of a data breach rather than transferring it. Option C (Accepting residual risk) is risk acceptance, where the organization retains the remaining risk after other treatments. Option E (Conducting security training) is also risk mitigation, reducing human error and improving security awareness rather than shifting risk to a third party.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Outsourcing IT operations to a third party
Why this is correct
Outsourcing shifts operational risk to the vendor under contract, so liability for failures transfers rather than being mitigated or avoided. This satisfies the stem's risk transfer definition by moving financial consequence to a third party.
- ✗
Implementing encryption
Why it's wrong here
Encryption is a risk mitigation control that reduces likelihood or impact; the organisation still owns the data and the breach consequences. It tempts because cyber insurance and contractual clauses are transfers, and encryption is often bundled into those arrangements, but the control itself transfers nothing.
- ✗
Accepting residual risk
Why it's wrong here
Accepting residual risk is risk retention, not transfer; no third party absorbs the loss. It tempts because residual risk follows every treatment decision, and retention is the deliberate correct choice when the cost of transfer exceeds the potential loss.
- ✓
Buying cyber insurance
Why this is correct
Cyber insurance contractually shifts financial loss from the insured to the insurer for covered events, a pure risk transfer. This satisfies the stem by transferring monetary impact rather than reducing likelihood or impact through controls.
- ✗
Conducting security training
Why it's wrong here
Security training modifies employee behaviour to reduce incident likelihood, which is mitigation, not transfer. It tempts because awareness reduces phishing losses, and training is the right answer when the question asks how to lower human-error risk rather than shift financial consequences to another party.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.