CRISC - Risk Response UPDATED ACTUAL Questions and CORRECT
Answers
1. Determine risk strategies and Risk Response
evaluate their effectiveness to
manage risk to a level in align-
ment with business objectives
2. Risk Response Strategies Reduce - Avoidance
Transfer
Acceptance
3. Risk Reduction Lessen probability or impact of a risk event
4. Risk Mitigation Risk Reduction
5. Very Frequent risk response Risk Reduction
6. Ultimate risk reduction strategy Risk Avoidance
7. Risk transference Share potential loss, no changes to probabilty or impact
8. Type of Risk Response of Insur- Risk Transference
ances
9. Other Risk Transference strate- SLAs
gies Contract Modifications
10. Risk Acceptance Requires due diligence, when cost of countermeasure is
greater than potential loss.
11. Separation of Duties Risk Mitigation through Policies
Dual Control
Mandatory Vacations
Job Rotation
Least privilege
Need to know
, Strong Configuration Manage-
ment
Acceptable Use Policies
Data Classification Policy
Data Privacy
Computer ownership
Data ownership
12. Access Control Data flow between subject and object, regulates what a
subject can do with an object
13. IAAA of Access Control Identification
Authentication
Authorization
Auditing
14. Make a claim, public informa- Identification
tion, must be unique
15. Provide support of your claim, Authentication
prove it
16. Authorization Rights and Permissions you have
17. Accountability, matching ac- Auditing
tions to subjects
18. Something I know, I have or I Authentication
am
19. Paswords and Passphrases cor- Authentication Type I, Something you know
respond to
20. Authentication Type II, Something you have
Answers
1. Determine risk strategies and Risk Response
evaluate their effectiveness to
manage risk to a level in align-
ment with business objectives
2. Risk Response Strategies Reduce - Avoidance
Transfer
Acceptance
3. Risk Reduction Lessen probability or impact of a risk event
4. Risk Mitigation Risk Reduction
5. Very Frequent risk response Risk Reduction
6. Ultimate risk reduction strategy Risk Avoidance
7. Risk transference Share potential loss, no changes to probabilty or impact
8. Type of Risk Response of Insur- Risk Transference
ances
9. Other Risk Transference strate- SLAs
gies Contract Modifications
10. Risk Acceptance Requires due diligence, when cost of countermeasure is
greater than potential loss.
11. Separation of Duties Risk Mitigation through Policies
Dual Control
Mandatory Vacations
Job Rotation
Least privilege
Need to know
, Strong Configuration Manage-
ment
Acceptable Use Policies
Data Classification Policy
Data Privacy
Computer ownership
Data ownership
12. Access Control Data flow between subject and object, regulates what a
subject can do with an object
13. IAAA of Access Control Identification
Authentication
Authorization
Auditing
14. Make a claim, public informa- Identification
tion, must be unique
15. Provide support of your claim, Authentication
prove it
16. Authorization Rights and Permissions you have
17. Accountability, matching ac- Auditing
tions to subjects
18. Something I know, I have or I Authentication
am
19. Paswords and Passphrases cor- Authentication Type I, Something you know
respond to
20. Authentication Type II, Something you have
