ITPEC IP April 2019 Question 36
When treatments against information security risks are categorized into risk transfer, risk avoidance, risk acceptance, and risk reduction, which of the following is the description that corresponds to risk acceptance?
Explanation
Taking no special action and estimating the impact when damage occurs — risk acceptance knowingly keeps the risk as it is.
The four risk treatments:
- •Risk reduction — take measures that lower the likelihood or the impact
- •Risk avoidance — remove the cause or stop the activity, so the risk cannot materialise
- •Risk transfer — shift the loss to a third party, such as an insurer
- •Risk acceptance — take no special measure, knowing the likely impact, because the risk is small or countermeasures would cost more than the loss
Answer (b)
Why not others:
- •(a) — lowering the likelihood with security measures is risk reduction
- •(c) — shifting the risk through insurance is risk transfer
- •(d) — removing the cause so the risk cannot occur is risk avoidance
Key rule: Risk acceptance is a deliberate decision made after assessing the risk, not neglect; it suits risks whose expected loss is lower than the cost of treating them.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.