Certified in Risk and Information Systems Control (CRISC) Domain 2 Practice Exam

The main concept being tested is weighing the economic feasibility of different risk response options to decide how to handle a risk. The best answer focuses on a cost-benefit analysis related to risk acceptance because it translates potential losses and control costs into monetary terms and directly informs whether investing in controls to mitigate the risk is worthwhile or if it's more sensible to accept the residual risk.

A cost-benefit analysis compares the expected benefits of reducing the risk (such as avoided losses, improved uptime, or regulatory compliance) against the costs of implementing and sustaining controls. It also helps determine the break-even point and whether the residual risk after mitigation remains acceptable. If the cost of mitigation exceeds the expected benefit, risk acceptance may be the rational choice; if the benefits outweigh the costs, mitigation (or other responses) becomes justified.

While understanding vulnerability data, aligning with a controls framework, and conducting a business impact analysis all contribute essential context for risk management, they do not in themselves provide the economic justification for selecting a risk response. The cost-benefit lens is what ties the decision to tangible value and resource allocation, making it the most decisive activity when determining a risk mitigation strategy.