IPA IP 2023 Question 72
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問72, translated into English. ITPEC is based on the same exams.
Same question on ITPEC: Apr 2025 Q44
When risk treatment in risk management for information security is divided into the four (4) categories of risk avoidance, risk sharing, risk mitigation, and risk retention, which of the following is the appropriate explanation of risk sharing?
Explanation
Transferring or distributing the risk to another organization by agreement, such as buying insurance — this is risk sharing.
The four ways to treat a risk, one per option:
- •Risk avoidance — stop the activity that carries the risk, so the risk no longer exists: option (a)
- •Risk mitigation — take measures that lower the likelihood or the damage: option (b)
- •Risk sharing (transfer) — pass part of the loss to a third party by contract, such as an insurer or an outsourcing partner: option (c)
- •Risk retention (acceptance) — knowingly take no special measure because the risk is small: option (d)
Answer (c)
Why not others:
- •(a) — not handling personal information at all removes the risk factor itself, which is risk avoidance
- •(b) — spreading the data center over distant sites lowers the damage a disaster can do, which is risk mitigation
- •(d) — accepting a small risk without measures is risk retention
Key rule: Sharing does not make the event less likely; the disaster can still happen, but part of the financial loss falls on the other party.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.