ITPEC FE Subject A April 2026 Question 32
Company A, a mobile game developer, is developing a new version of its game with a social media plugin that allows users to post their achievements on social media platforms. However, during beta testing, some users point out that posts from the game can bypass their privacy settings, making them visible to the public. Company A understands the risk and decides not to include the social media plugin in their new version of the game. Which of the following is the risk management strategy that Company A is choosing?
Explanation
Risk avoidance — Company A removes the activity that causes the risk.
By leaving the social media plugin out of the new version, the company eliminates the chance of the privacy leak instead of reducing it or bearing it. The four standard responses to a risk:
- •Avoidance — stop the activity that creates the risk
- •Mitigation (reduction) — continue, but lower the likelihood or the impact
- •Sharing (transfer) — pass part of the loss to another party, for example by insurance or outsourcing
- •Acceptance — knowingly bear the risk without further action
Answer (b)
Why not others:
- •(a) Risk acceptance — would mean shipping the plugin unchanged, aware of the flaw
- •(c) Risk mitigation — would mean shipping the plugin after fixing it so that posts respect the privacy settings
- •(d) Risk sharing — would mean transferring the consequences to someone else, for example insuring against privacy claims
Key rule: Ask whether the risky activity still takes place: if it is dropped, that is avoidance; if it continues in a safer form, mitigation; if it continues as is, acceptance or sharing.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.