IPA IP 2025 Question 91
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問91, translated into English. ITPEC is based on the same exams.
When risk treatment in risk management for information security is implemented by dividing it into the four (4) categories of risk transfer, risk avoidance, risk mitigation, and risk retention, which of the following is an appropriate description concerning these?
Explanation
Stricter control of taking notebook PCs outside is risk mitigation — the four categories are options to choose from for each risk, not steps done in a fixed order.
After a risk is assessed, one treatment (or a mix) is chosen for it:
- •Risk avoidance: remove the cause, for example stop the activity that carries the risk
- •Risk mitigation (reduction): take measures that lower the likelihood or the impact
- •Risk transfer: shift the impact to a third party, for example by insurance or outsourcing
- •Risk retention (acceptance): accept the risk knowingly and bear any loss
Controlling more strictly when notebook PCs may leave the office keeps the risk, but makes loss or theft less likely: that is mitigation.
Answer (d)
Why not others:
- •(a) and (b) — the four are alternatives picked to suit each risk, not a procedure carried out in an order
- •(c) — insurance shifts the financial impact to the insurer, which is risk transfer; avoidance would remove the risk itself
Key rule: Avoid = remove the cause, mitigate = lower likelihood or impact, transfer = shift it to a third party (insurance), retain = accept and bear it.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.