CRA Risk Mitigation Strategies & Controls 2

Question 1

A bank implements a policy requiring dual authorization for all wire transfers above $50,000. Which control type does this represent?

Accepted Answer

Preventive control

Answer

Dual authorization is a preventive control because it stops unauthorized transactions before they occur.

Question 2

Which risk mitigation strategy is most appropriate when the cost of control implementation exceeds the expected loss from the risk?

Accepted Answer

Risk acceptance

Answer

Risk acceptance is chosen when mitigation costs outweigh the potential financial impact of the risk.

Question 3

An organization purchases cyber liability insurance to offset potential data breach losses. This is an example of:

Accepted Answer

Risk transfer

Answer

Insurance shifts the financial burden of a risk event to a third party, making it a risk transfer strategy.

Question 4

Which of the following best describes a compensating control?

Accepted Answer

An alternative control used when the primary control is not feasible

Answer

Compensating controls serve as substitutes when primary controls cannot be implemented due to technical or business constraints.

Question 5

In the NIST Risk Management Framework, which step involves selecting and implementing security controls?

Accepted Answer

Implement

Answer

The Implement step in NIST RMF focuses on putting chosen security controls into practice within the information system.

(CRA) Certified Risk Architect Practice Test