Risk Response and Mitigation Strategies Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Response and Mitigation Strategies flashcards as text
Which type of control reduces the likelihood of a risk event occurring?
Answer: Preventive control
Preventive controls are designed to reduce the probability that a threat event will occur by blocking or discouraging the threat.
A security control that limits access to sensitive data based on job function is an example of which type of control?
Answer: Preventive logical control
Role-based access control is a preventive logical control that prevents unauthorized access by restricting data access to job-relevant functions.
When evaluating risk response options, which economic concept is MOST relevant?
Answer: Cost-benefit analysis
Cost-benefit analysis compares the cost of implementing a risk response against the benefit of the risk reduction it provides, guiding optimal decisions.
Which scenario BEST demonstrates the risk sharing response strategy?
Answer: Two companies jointly invest in a shared disaster recovery facility
Risk sharing distributes risk between two or more parties, such as joint investment in shared infrastructure, reducing each party's individual exposure.
Which statement about risk acceptance is TRUE?
Answer: It must be a deliberate, documented decision made by an authorized risk owner
Risk acceptance requires a conscious, documented choice by an authorized person — it is not passive neglect and must be periodically reviewed.
A detective control would MOST appropriately be used when:
Answer: Prevention is too costly and early identification of incidents is sufficient
When prevention is impractical or too expensive, detective controls provide early warning so the organization can respond before damage becomes catastrophic.