200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Neglect

  Why it's wrong here

  Neglect is not a defined risk treatment option; recognised treatments are mitigate, transfer, avoid and accept. It is tempting because ignoring a low-impact risk informally resembles acceptance, but acceptance is a documented, authorised decision, whereas neglect implies no deliberate management.

• ✓

  Mitigate

  Why this is correct

  Implementing controls to reduce risk.

• ✗

  Ignore

  Why it's wrong here

  Ignore is not a formal risk treatment option; the recognised treatments are mitigate, transfer, avoid and accept. It is tempting because deliberately disregarding a trivial risk feels like acceptance, but acceptance is an explicit, documented decision, while ignoring implies the risk was never properly assessed.

• ✓

  Accept

  Why this is correct

  Acceptance is a valid risk treatment where an organisation acknowledges a risk and retains it without additional controls, typically when cost outweighs benefit. It is one of the four recognised treatment options, satisfying the stem's request.

• ✗

  Amplify

  Why it's wrong here

  Amplify is not a recognised risk treatment option; the standard set is mitigate, transfer, avoid and accept. It is tempting because it sounds like intensifying controls, but no framework defines it as a treatment, so it cannot satisfy the question's requirement for two valid treatments.