CRA Risk Mitigation and Controls 3

Question 1

In the context of IT risk, which control layer is responsible for ensuring only authorized users access systems?

Accepted Answer

Logical access controls

Answer

Logical access controls (passwords, MFA, role-based access) govern who can authenticate and what resources they can use within IT systems.

Question 2

A risk architect evaluates a control and finds it reduces both the likelihood and impact of a risk. This control strategy is known as:

Accepted Answer

Risk mitigation

Answer

Risk mitigation involves implementing controls that reduce the probability, impact, or both dimensions of a risk event.

Question 3

Which type of control testing involves reviewing documentation and policies without testing actual execution?

Accepted Answer

Design effectiveness testing

Answer

Design effectiveness testing evaluates whether a control is properly designed to address a risk, typically through inquiry and inspection of documentation.

Question 4

An organization contracts a third-party vendor to process customer data. Which control is most critical to mitigate third-party risk?

Accepted Answer

Vendor due diligence and contractual SLAs with right-to-audit clauses

Answer

Vendor due diligence combined with contractual SLAs and right-to-audit provisions ensures third parties meet security and compliance requirements.

Question 5

The four Ts of risk response are: Tolerate, Treat, Transfer, and:

Accepted Answer

Terminate

Answer

The four Ts of risk response are Tolerate (accept), Treat (mitigate), Transfer (insure/outsource), and Terminate (avoid by ceasing the activity).

(CRA) Certified Risk Architect Practice Test

(CRA) Certified Risk Architect Practice Test

CRA Risk Mitigation and Controls 3