ITPEC IP October 2024 Question 43
Company A implements risk analysis for its own information assets. The results show that if a nearby river overflows, the server room on the first floor of the company might be flooded. The company considers the possibility of moving the server room, but decides there is almost no risk of a flood because the last time the river overflowed was 100 years ago, and the management decides that no particular countermeasures are taken. Which of the following is the risk treatment for information security that Company A selects?
Explanation
Risk acceptance — management recognized the flood risk, judged it low, and chose to take no countermeasure.
The company analyzed the risk, considered moving the server room, and then decided the likelihood (the last flood was 100 years ago) was too low to justify action. Knowingly keeping a risk without adding any control is risk acceptance, also called risk retention.
Answer (c)
Why not others:
- •(a) Risk transfer — would shift the loss to another party, for example by buying flood insurance; nothing was shifted
- •(b) Risk avoidance — would remove the cause, such as moving the server room off the first floor; this was considered and rejected
- •(d) Risk mitigation — would lower the likelihood or impact with a control, such as flood barriers or off-site backups; no control was added
Key rule: The four treatments differ by action: avoidance removes the source, mitigation reduces it, transfer shifts it, and acceptance keeps it on purpose after a conscious decision.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.