CRISC Question 116

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose ABC1

  The correct answers are: ✅ A. Education of staff or business partners • Training and awareness programs can reduce risk by improving human behavior, which is often a critical factor in risk mitigation. ✅ B. Deployment of a threat-specific countermeasure • Implementing controls specifically designed to address the new threat helps directly reduce its impact or likelihood. ✅ C. Modify the technical architecture • Changing system design or architecture can eliminate or reduce exposure to the risk at a structural level. ⸻ Why not D. Apply more controls ❌ • Simply adding more controls without purpose or design may not address the inefficiency; it could increase complexity or cost without improving risk mitigation.

• Chose ABC1

  Modifying the technical architecture involves changing the design or infrastructure of the system to make it more resilient to the new risks. This could include enhancing network security, upgrading firewalls, or redesigning the system to address specific vulnerabilities

• 1

  In the scenario where you have identified new threats and found that existing controls are not efficient in mitigating these risks, here are three steps you could take to address the situation: B. Deployment of a threat-specific countermeasure: Implementing threat-specific countermeasures is an effective strategy to address the new risks. These countermeasures are tailored to the specific threats, and they can be more efficient in mitigating the risks compared to general controls. C. Modify the technical architecture: Sometimes, the existing technical architecture may need modifications to better address new threats. This can involve making changes to your network, systems, or infrastructure to enhance security and resilience against the identified risks. D. Apply more controls: In some cases, adding more controls to your security framework may be necessary. These additional controls can complement existing measures and provide a layered defense against the new threats. It's important to choose controls that are relevant to the specific risks you've identified.