ISC2 CC Security Principles Practice Question
A company is implementing risk management for a new project. Which THREE of the following are valid risk treatment options? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk acceptance
Risk acceptance (A) is a valid risk treatment option because the organization consciously decides to tolerate the risk without taking action, often when the cost of mitigation exceeds the potential impact. Risk transfer (B) is valid because the organization shifts the financial impact of a risk to a third party, typically through insurance, outsourcing, or contracts. Risk mitigation (D) is valid because it involves taking actions to reduce the probability or impact of a risk, such as implementing controls or safeguards. Risk communication (C) is not a treatment option; it is an ongoing activity for sharing risk information among stakeholders. Risk analysis (E) is not a treatment option either; it is part of risk assessment, used to identify and evaluate risks before treatment decisions are made.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk acceptance
Why this is correct
Risk acceptance is a valid treatment: the organisation acknowledges the risk and proceeds without action, typically when exposure falls within tolerance or mitigation costs exceed potential impact. It sits alongside avoidance, transfer and mitigation as recognised responses.
- ✓
Risk transfer
Why this is correct
Risk transfer shifts the financial impact of a threat to a third party, typically via insurance or contractual indemnity, while the company retains the risk itself. It is one of the recognised treatment options alongside mitigation, avoidance and acceptance, satisfying the stem's requirement for a valid treatment.
- ✗
Risk communication
Why it's wrong here
Risk communication shares information about risks; it does not alter the risk itself. It is tempting because communication underpins every risk process, and it is correct when stakeholders must be informed or consulted. Treatment options modify exposure through avoid, reduce, transfer or accept, which communication does not do.
- ✓
Risk mitigation
Why this is correct
Risk mitigation reduces the likelihood or impact of a threat through controls such as patching, encryption or redundancy. It is a recognised treatment option alongside transfer, avoidance and acceptance, directly satisfying the stem's requirement for a valid risk treatment.
- ✗
Risk analysis
Why it's wrong here
Risk analysis is an assessment activity that evaluates likelihood and impact, not a treatment response. It is tempting because analysis precedes treatment selection, and it is genuinely correct when identifying or prioritising risks. The valid treatments are avoid, reduce, transfer and accept, so analysis cannot be selected here.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Risk mitigation
Risk mitigation is the process of reducing the likelihood or impact of a potential security threat to an acceptable level through specific controls and actions.
Key term
Risk acceptance
Risk acceptance is a risk management strategy where an organization acknowledges a potential risk but decides to tolerate it without taking active measures to reduce or eliminate it.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.