ITPEC IP October 2025 Question 39

Buying insurance is risk transfer — the organization pays another party to bear an agreed portion of the financial impact if the risk materializes.

Transfer is one type of risk treatment. The organization may alternatively avoid the risky activity, mitigate probability or impact with controls, or retain the risk when accepting it is appropriate. Insurance is the standard example of transferring financial consequences.

Answer (a)

Why not others:
- (b) anti-malware is indeed a mitigation control, but the option incorrectly presents these treatment categories as classifications of asset purposes during identification
- (c) deciding whether to stop a risky activity is treatment, not a category of evaluation methodology
- (d) quantifying vulnerabilities is analysis, not retention

Key rule: Avoid removes the activity, mitigate reduces risk, transfer shifts impact, and retain accepts the remaining risk.

AI-generated — may contain errors