200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Risk mitigation

  Why this is correct

  Enforcing 12-character complexity passwords applies an administrative control that lowers the likelihood of credential compromise, reducing overall risk exposure. This is mitigation, since the organisation acts to reduce risk rather than accept, transfer or avoid it.

• ✗

  Risk transfer

  Why it's wrong here

  Risk transfer shifts financial impact to a third party, typically via cyber insurance or contractual indemnity; a password policy changes the organisation's own controls and retains the residual risk. It is tempting because insurers often mandate stronger authentication, but the policy itself is a mitigation, not a transfer of loss.

• ✗

  Risk acceptance

  Why it's wrong here

  Risk acceptance means acknowledging the exposure and taking no further action, often with documented sign-off. Implementing a 12-character complexity policy actively reduces the likelihood of credential compromise, so it is mitigation. It is tempting because acceptance can accompany policy decisions, but here controls are being applied rather than tolerated.

• ✗

  Risk avoidance

  Why it's wrong here

  Risk avoidance means eliminating the activity or asset that creates the exposure entirely, such as discontinuing a service. Enforcing longer complex passwords reduces likelihood while the system and its accounts remain in use, which is mitigation. It is tempting because avoidance also involves changing behaviour, but the underlying risk source is not removed.