CRISC Risk Response and Mitigation Strategies 3

Question 1

Which type of control reduces the likelihood of a risk event occurring?

Accepted Answer

Preventive control

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 2

A security control that limits access to sensitive data based on job function is an example of which type of control?

Accepted Answer

Preventive logical control

Answer

Detective physical control

Answer

Corrective administrative control

Answer

Compensating technical control

Question 3

When evaluating risk response options, which economic concept is MOST relevant?

Accepted Answer

Cost-benefit analysis

Answer

Net present value of IT assets

Answer

Return on investment for new technology

Answer

Total cost of ownership for security tools

Question 4

Which scenario BEST demonstrates the risk sharing response strategy?

Accepted Answer

Two companies jointly invest in a shared disaster recovery facility

Answer

A company purchases cyber insurance to cover breach costs

Answer

A company stops collecting customer data to avoid privacy risk

Answer

A company patches vulnerabilities to reduce attack surface

Question 5

Which statement about risk acceptance is TRUE?

Accepted Answer

It must be a deliberate, documented decision made by an authorized risk owner

Answer

It means the organization is ignoring the risk without review

Answer

It is only appropriate for risks below a certain dollar threshold

Answer

It eliminates the need to monitor the accepted risk going forward

Question 6

A detective control would MOST appropriately be used when:

Accepted Answer

Prevention is too costly and early identification of incidents is sufficient

Answer

The risk must be eliminated before it can cause any harm

Answer

The organization wants to transfer the financial impact of a risk

Answer

The risk has already been fully mitigated by preventive controls