CRISC IT Risk Assessment Practice Question
An organization is evaluating risks and decides to purchase cyber insurance to cover potential financial losses from data breaches. Which risk treatment option does this represent?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transfer
Transfer involves shifting risk to a third party, such as through insurance or outsourcing with liability transfer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Transfer
Why this is correct
Purchasing cyber insurance shifts the financial consequence of a breach to an insurer for a premium, which is risk transfer. This satisfies the stem because the organisation retains the threat but not the loss burden, distinguishing transfer from mitigation, avoidance or acceptance.
- ✗
Accept
Why it's wrong here
Purchasing cyber insurance transfers the financial consequence of a breach to the insurer, so it is risk transference, not acceptance. Acceptance means retaining the loss exposure with no third-party mechanism, which would be correct where the potential loss falls within the organisation's stated risk appetite and no cost-effective control exists.
- ✗
Mitigate
Why it's wrong here
Purchasing cyber insurance transfers the financial consequence of a breach to a third party; mitigation reduces likelihood or impact through controls. Transfer is the correct treatment when residual risk is accepted and financed externally. Mitigate is tempting because insurance is a response to risk, but it does not alter the risk itself.
- ✗
Avoid
Why it's wrong here
Purchasing cyber insurance retains the breach risk while transferring its financial consequence to an insurer, so it is not avoidance. Avoidance eliminates the activity or exposure entirely — for example, discontinuing an e-commerce platform that stores cardholder data. It would be correct only where the organisation exits the risky processing altogether.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.