Security Policies and Procedures →hardMultiple ChoiceObjective-mapped

200-201 Security Policies and Procedures Practice Question

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Mitigate the risk by implementing the control

If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Accept the risk because the mitigation cost is higher than the ALE
Why it's wrong here
Mitigation cost ($35,000) is actually lower than ALE ($50,000), so acceptance is not the best choice.
✗
Avoid the risk by discontinuing the activity
Why it's wrong here
Avoidance may not be necessary if mitigation is feasible and cost-effective.
✗
Transfer the risk by purchasing cyber insurance
Why it's wrong here
Transfer might be considered, but mitigation is more cost-effective in this scenario.
✓
Mitigate the risk by implementing the control
Why this is correct
Since the mitigation cost is less than the ALE, it is cost-effective to mitigate.

Go deeper

200-201 Security Policies and Procedures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question