200-201 Security Policies and Procedures Practice Question
Which risk treatment option involves taking actions to reduce the likelihood or impact of a risk?
⚠ Common exam trap
Candidates often confuse 'transfer' with 'mitigate' — candidates often assume buying insurance reduces risk, but transfer only shifts financial liability, not the likelihood or impact of the event itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate
Mitigation (also called risk reduction) is the risk treatment option where an organization takes deliberate actions to lower either the likelihood that a risk materializes or the severity of its impact if it does. Examples include applying patches, adding firewalls, or implementing MFA. It is the only option that actively modifies the risk itself rather than shifting, eliminating, or tolerating it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mitigate
Why this is correct
Mitigation reduces risk through controls.
- ✗
Accept
Why it's wrong here
Acceptance acknowledges the risk and takes no action, leaving likelihood and impact untouched. It tempts when the cost of treatment exceeds the potential loss and the risk sits within tolerance, but the stem explicitly requires actions that reduce likelihood or impact.
- ✗
Transfer
Why it's wrong here
Transfer shifts financial exposure to a third party such as an insurer; the underlying likelihood and impact remain unchanged within the environment. It tempts when residual financial loss must be capped, but the stem asks for actions that actually lower likelihood or impact.
- ✗
Avoid
Why it's wrong here
Avoidance eliminates the activity or asset that carries the risk entirely, so likelihood and impact never materialise rather than being reduced. It tempts when a risk is unacceptable and the business can forgo the underlying process, but the stem describes mitigation, not withdrawal.
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.