CRISC Risk Response and Mitigation Strategies

Question 1

Which risk response option involves purchasing cyber liability insurance to cover potential losses?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 2

A company decides to discontinue an e-commerce feature because its security risks are too high. This is an example of:

Accepted Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk mitigation

Question 3

Which factor is MOST important when selecting between risk mitigation options?

Accepted Answer

Cost-effectiveness relative to the risk reduction achieved

Answer

Availability of vendor-supplied solutions

Answer

The IT department's preference for specific technologies

Answer

The speed at which the control can be implemented

Question 4

Residual risk that remains after mitigation controls are applied should be compared against which benchmark?

Accepted Answer

The organization's defined risk tolerance

Answer

The industry average residual risk level

Answer

The cost of additional controls

Answer

The initial inherent risk score

Question 5

Which risk response is MOST appropriate for a low-likelihood, low-impact risk?

Accepted Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation

Question 6

A compensating control is BEST described as:

Accepted Answer

An alternative control used when a primary control cannot be implemented

Answer

A control that provides additional layers on top of existing controls

Answer

A detective control that identifies when a risk has materialized

Answer

A control automatically triggered by a monitoring system