200-201 Security Concepts Practice Question

A company is implementing a security policy to reduce risk. Which THREE activities are examples of risk mitigation? (Choose three.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Implementing access controls

Implementing access controls (A) is a risk mitigation activity because it enforces authentication and authorization mechanisms (such as RBAC, least privilege, and MFA) that reduce the likelihood of unauthorized access to systems and data. Encrypting sensitive data (C) mitigates risk by protecting confidentiality, so even if data is intercepted or stolen, it remains unreadable without the proper cryptographic keys (e.g., AES-256). Patching vulnerabilities (E) mitigates risk by remediating known weaknesses (e.g., CVEs) that attackers could exploit, thereby reducing the attack surface. Accepting the risk without action (B) is risk acceptance, not mitigation, since no controls are applied. Purchasing cyber insurance (D) is risk transference, as the financial impact is shifted to an insurer rather than reduced through technical or administrative controls.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Implementing access controls
Why this is correct
Implementing access controls directly satisfies the stem's requirement to reduce risk by limiting who can reach systems and data. Authentication, authorisation and least-privilege enforcement, typically via Microsoft Entra ID, shrink the attack surface and block unauthorised actions, lowering both likelihood and impact of a breach.
✗
Accepting the risk without action
Why it's wrong here
Accepting risk without action is risk acceptance, the deliberate retention of residual risk, not mitigation, which lowers likelihood or impact through controls. It is tempting because acceptance is a valid documented treatment option, and would be correct if the stem asked which activity follows mitigation once residual risk falls within tolerance.
✓
Encrypting sensitive data
Why this is correct
Encrypting sensitive data directly reduces the likelihood of unauthorised disclosure, satisfying the policy's aim of lowering risk exposure. Unlike risk acceptance or transfer, encryption applies a preventive control that renders intercepted or stolen data unreadable without the decryption key, thereby mitigating impact and aligning with Microsoft Entra ID protection and data-protection requirements.
✗
Purchasing cyber insurance
Why it's wrong here
Cyber insurance transfers residual financial impact to an insurer; it does not reduce the likelihood or technical effect of an incident, so it is risk transference. It is tempting because it is a legitimate risk treatment listed alongside mitigation, and would be the right answer if the question asked about risk transfer or acceptance.
✓
Patching vulnerabilities
Why this is correct
Patching vulnerabilities directly reduces the likelihood of exploitation by removing the flaw an attacker would target, satisfying the policy's aim of lowering risk rather than merely transferring or accepting it. Unlike avoidance, which eliminates the activity, patching retains the system while shrinking the attack surface.

Quick reference

Symmetric Encryption Algorithm Comparison

Algorithm	Key Size	Block Size	Status	Notes
AES-128	128-bit	128-bit	Current standard	NIST approved; WPA3, TLS
AES-256	256-bit	128-bit	Current standard	Preferred for sensitive / govt data
3DES	112-bit effective	64-bit	Deprecated (2023)	Replaced by AES
DES	56-bit	64-bit	Broken	Cracked in < 24 h; never deploy
ChaCha20	256-bit	Stream cipher	Current	TLS 1.3, WireGuard

Go deeper

200-201 Security Concepts Practice Question

Why each option matters

Option-by-option breakdown

Symmetric Encryption Algorithm Comparison

Related to this question