IPA IP 2021 Question 99

Topic: Security

A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問99, translated into English. ITPEC is based on the same exams.

Same question on ITPEC: Oct 2025 Q39

In risk management for information security, the categories that include risk transfer, risk avoidance, risk mitigation, and risk retention are sometimes used. Which of the following is the appropriate description concerning these?

Explanation

Buying insurance is risk transfer, a category of risk treatment — the four categories classify ways of treating a risk.

Risk management first assesses risks (identification, analysis, evaluation) and then treats them. The four categories are the choices at the treatment stage:

  • •Risk avoidance — stop the activity that carries the risk
  • •Risk mitigation — take measures that lower the likelihood or the damage
  • •Risk transfer — pass the loss to a third party by contract, such as an insurer or an outsourcing partner
  • •Risk retention — knowingly accept a small risk without special measures

Insurance does not stop the incident but moves its financial loss to the insurer, so (a) is right on both counts: the stage and the example.

Answer (a)

Why not others:

  • •(b) — risk identification finds assets, threats and vulnerabilities; mitigation is a way of treating a risk, not a class of asset by purpose of use
  • •(c) — risk evaluation compares analysed risk levels with acceptance criteria; avoidance is a treatment, not an evaluation methodology
  • •(d) — quantifying vulnerabilities is part of risk analysis; retention means accepting a risk, not a method of analysis

Key rule: Identification, analysis and evaluation make up risk assessment; avoidance, mitigation, transfer and retention are the options of the next stage, risk treatment.

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.