Risk Response and Mitigation CRISC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A government agency has approved a risk action plan to mitigate the risk of insider threats. The plan includes implementing user behavior analytics (UBA), enhancing background checks, and establishing a whistleblower hotline. The risk owner has assigned UBA to the IT security team, background checks to HR, and the hotline to the compliance office. The plan has a 9-month timeline. The risk owner wants to ensure that the plan is implemented effectively and that progress is visible to senior management. Which approach is most effective?

   • AProvide a single status update to senior management at the end of the 9-month period.
   • BDefine KPIs for each action item and report progress to the risk committee quarterly.
   • CHave the internal audit team independently verify completion and report to the board.
   • DRely on each department to report only when they have completed their assigned tasks.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of using key performance indicators (KPIs) in monitoring a risk action plan?

   • ATo assign ownership of the risk
   • BTo identify new risks
   • CTo determine the risk appetite
   • DTo measure the effectiveness of the risk response
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A retail company has approved a risk action plan to mitigate the risk of point-of-sale (POS) malware. The plan includes updating POS software, segmenting the network, and training staff on phishing. The risk owner has assigned the software update to the IT team, network segmentation to the network engineer, and training to the HR department. What is the most critical component to include in the action plan to ensure each task is completed on time?

   • AA list of approved software vendors for the POS update.
   • BA timeline with specific milestones and a named owner for each task.
   • CA description of the risk scenario and its potential impact.
   • DA budget allocation for each task.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Who is accountable for ensuring that risk responses are implemented and that residual risk remains within the organization's risk appetite?

   • AInternal auditor
   • BControl owner
   • CRisk owner
   • DChief Information Officer (CIO)
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An e-commerce company is considering a new feature that allows customers to store payment card information for faster checkout. The risk assessment shows a moderate likelihood of a data breach and a high financial impact if card data is compromised. The company's risk appetite is low for risks involving customer financial data. The feature is expected to increase sales significantly. Which risk response is most appropriate?

   • ATransfer by purchasing cyber insurance to cover breach costs.
   • BAccept because the sales increase outweighs the potential breach costs.
   • CMitigate by implementing tokenization and PCI DSS compliance controls.
   • DAvoid by not offering the card storage feature.
   Reveal Solution Discussion Select an answer first