200-201 Security Policies and Procedures Practice Question
An organization is reviewing its risk management process and identifies a risk with a high probability and high impact. Management decides to stop the activity causing the risk. Which risk treatment option is being applied?
⚠ Common exam trap
200-201 often tests the distinction between avoidance and mitigation — candidates pick mitigation because 'stopping the activity' sounds like a control, but avoidance specifically means eliminating the activity, not reducing its risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk avoidance
Risk avoidance is the treatment option where the organization eliminates the risk entirely by discontinuing the activity that creates it. Since management decided to stop the activity causing the high-probability, high-impact risk, this is avoidance. It is the only option that removes the risk rather than reducing, accepting, or transferring it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk mitigation
Why it's wrong here
Mitigation reduces the likelihood or impact of a risk while continuing the activity, whereas terminating the activity entirely is risk avoidance. It is tempting because mitigation is the most common treatment, and it would be correct if controls were added rather than the activity stopped.
- ✗
Risk acceptance
Why it's wrong here
Acceptance means acknowledging the risk and proceeding without action, which contradicts stopping the activity. It is tempting because acceptance is valid for low-probability or low-impact risks, but a high-probability, high-impact risk being eliminated is avoidance, not acceptance.
- ✓
Risk avoidance
Why this is correct
Risk avoidance eliminates the risk by discontinuing the activity entirely, which matches management stopping the process outright. Unlike mitigation, which reduces likelihood or impact, or transfer, which shifts financial consequence, avoidance removes the exposure at source.
- ✗
Risk transfer
Why it's wrong here
Stopping the activity is risk avoidance, not transfer, which shifts financial impact to a third party such as an insurer or outsourcer while the activity continues. Transfer is tempting because it is a recognised treatment for high-probability, high-impact risks, but it does not eliminate the underlying activity.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.