SY0-701 Security Program Management and Oversight Practice Question
A manufacturer identifies a rare but very costly ransomware risk. Executives decide not to eliminate the activity, but to purchase cyber insurance and formally acknowledge the remaining exposure. Which risk treatment is being used?
⚠ Common exam trap
Many exam-takers confuse 'acceptance' with 'acknowledgment' — the phrase 'formally acknowledge the remaining exposure' is a red herring; true acceptance requires no further action, but purchasing insurance proves the risk is being transferred, not accepted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transfer
(Transfer) because purchasing cyber insurance shifts the financial risk of the ransomware incident to the insurer. The executives formally acknowledge the remaining exposure, which confirms they are not simply accepting the risk but are actively transferring the monetary impact through a contractual agreement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avoidance
Why it's wrong here
Avoidance means eliminating the risk by discontinuing the activity that creates it, such as ceasing manufacturing operations or disconnecting critical systems from the network. In this scenario, the manufacturer is not deciding to stop operations; instead, they are evaluating how to handle the financial impact of a ransomware event. Since avoidance would require abandoning the core business function entirely, it does not match the described response.
- ✓
Transfer
Why this is correct
Transfer shifts the financial burden of a potential loss to a third party, most commonly through a cyber insurance policy that covers ransomware payments, extortion demands, and business interruption costs. This strategy is especially appropriate for a rare but very costly risk because it converts an uncertain, potentially catastrophic loss into a predictable premium while allowing the manufacturer to continue operating. The organization still retains responsibility for incident response and reputation, but the financial impact is moved to the insurer.
- ✗
Mitigation
Why it's wrong here
Mitigation reduces the likelihood or severity of a ransomware attack by implementing technical and administrative controls such as patching, endpoint detection, access controls, and offline backups. While these measures are valuable, the scenario specifically describes transferring risk, not reducing the probability or impact of the event. Insurance alone does not impede the attacker or shrink the blast radius; it only compensates the victim after a loss, so it is not mitigation.
- ✗
Acceptance
Why it's wrong here
Acceptance is a conscious decision to retain the risk and absorb any financial loss as a cost of doing business, typically used when the expense of other responses exceeds the potential loss. In this case, the manufacturer could transfer the risk through cyber insurance, so choosing acceptance would mean deliberately forgoing that protection and accepting the full financial impact. The scenario gives no indication of such an intentional decision, and because the risk is transferable, acceptance is not the correct risk response.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.