ITPEC IP April 2024 Question 37
Topic: Security
Security risk treatment in ISMS includes risk transfer, risk avoidance, risk acceptance, and risk reduction. Which of the following is an example of risk avoidance?
Explanation
Withdrawing from the high-risk services — risk avoidance removes the risk by stopping the activity that causes it.
The four kinds of risk treatment:
- •Risk avoidance — stop or never start the activity that creates the risk, so the risk no longer exists
- •Risk reduction — take measures that lower the likelihood of the problem or the size of the damage
- •Risk transfer — pass the financial damage to another party, for example through insurance or outsourcing
- •Risk acceptance — judge the risk small enough and bear any damage without further measures
Answer (d)
Why not others:
- •(a) — a security measure that lowers the possibility of problems is risk reduction
- •(b) — taking out insurance shifts the damage to the insurer: risk transfer
- •(c) — confirming the risk is small and bearing any damage is risk acceptance
Key rule: Avoidance removes the activity, reduction lowers likelihood or impact, transfer shifts the loss to another party, acceptance knowingly bears it.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.