200-201 Security Policies and Procedures Practice Question
During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate the risk by implementing the control
If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk because the mitigation cost is higher than the ALE
Why it's wrong here
Acceptance is unjustified because the $35,000 annual mitigation cost is below the $50,000 ALE, so the control yields a positive return. It is tempting because acceptance suits risks where treatment exceeds expected loss, but here the arithmetic favours mitigation, making acceptance the wrong treatment.
- ✗
Avoid the risk by discontinuing the activity
Why it's wrong here
Discontinuing the activity eliminates the risk but forfeits the business process generating value, an excessive response when a $35,000 control offsets a $50,000 ALE. It is tempting because avoidance suits risks with no viable control, but mitigation is proportionate here.
- ✗
Transfer the risk by purchasing cyber insurance
Why it's wrong here
Insurance transfers financial impact but leaves the $50,000 ALE exposure and the threat itself unaddressed, and premiums add recurring cost. It is tempting because transfer suits low-frequency, high-severity risks that are impractical to mitigate, yet here mitigation costs $35,000 annually against a $50,000 ALE, so reduction is justified.
- ✓
Mitigate the risk by implementing the control
Why this is correct
The control's total annual cost is $35,000, which is lower than the $50,000 ALE, so mitigation yields a positive return and reduces expected loss. This satisfies the risk management principle of selecting treatment where control cost is less than the annualised loss expectancy.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.