CRISC Risk Response and Mitigation Strategies 3

Question 1

Which type of control reduces the likelihood of a risk event occurring?

Accepted Answer

Preventive control

Answer

Preventive controls are designed to reduce the probability that a threat event will occur by blocking or discouraging the threat.

Question 2

A security control that limits access to sensitive data based on job function is an example of which type of control?

Accepted Answer

Preventive logical control

Answer

Role-based access control is a preventive logical control that prevents unauthorized access by restricting data access to job-relevant functions.

Question 3

When evaluating risk response options, which economic concept is MOST relevant?

Accepted Answer

Cost-benefit analysis

Answer

Cost-benefit analysis compares the cost of implementing a risk response against the benefit of the risk reduction it provides, guiding optimal decisions.

Question 4

Which scenario BEST demonstrates the risk sharing response strategy?

Accepted Answer

Two companies jointly invest in a shared disaster recovery facility

Answer

Risk sharing distributes risk between two or more parties, such as joint investment in shared infrastructure, reducing each party's individual exposure.

Question 5

Which statement about risk acceptance is TRUE?

Accepted Answer

It must be a deliberate, documented decision made by an authorized risk owner

Answer

Risk acceptance requires a conscious, documented choice by an authorized person — it is not passive neglect and must be periodically reviewed.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Risk Response and Mitigation Strategies 3