IPA IP 2024 Question 64
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問64, translated into English. ITPEC is based on the same exams.
When the treatment of risks in information security risk management is classified into the four (4) categories of risk sharing, risk avoidance, risk retention, and risk mitigation, which of the following is an appropriate example of risk sharing?
Explanation
Taking out cyber insurance — passing part of the financial loss to an insurer is risk sharing.
The four ways to treat a risk:
- •Risk avoidance — stop the activity that carries the risk
- •Risk mitigation — take measures that lower the likelihood or the damage
- •Risk sharing (transfer) — pass part of the loss to a third party by contract, such as an insurer or an outsourcing partner
- •Risk retention (acceptance) — knowingly take no special measure because the risk is small
Insurance does not make a leak less likely or less severe; it moves the cost of compensation and incident handling to the insurer. Options (a), (c) and (d) are all measures that reduce the risk itself.
Answer (b)
Why not others:
- •(a) — a remote backup center shortens the downtime after a disaster, which reduces the damage: risk mitigation
- •(c) — requiring a superior’s permission lowers the chance of a file leaking by e-mail: risk mitigation
- •(d) — encrypting the HDD limits the damage if the PC is lost or stolen: risk mitigation
Key rule: If the measure changes how likely or how bad the event is, it is mitigation; if it only changes who pays for it, it is sharing.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.