ISC2 CC Security Principles Practice Question
A security analyst discovers that a vendor's software contains a known vulnerability that could lead to data exposure. The analyst reports this to management. According to risk management principles, which action represents risk transfer?
⚠ Common exam trap
Test-takers frequently confuse risk transfer with risk mitigation or avoidance; candidates often think that patching (mitigation) or discontinuing use (avoidance) transfers risk, but only shifting financial responsibility to a third party constitutes transfer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Purchasing cyber insurance to cover potential losses
Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual agreements. Purchasing cyber insurance explicitly transfers the potential financial losses from data exposure to the insurer, which is the definition of risk transfer. The other options represent risk avoidance (discontinuing use), risk mitigation (patching), or risk acceptance (accepting and documenting).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Discontinuing use of the vendor's software
Why it's wrong here
Discontinuing the software avoids the exposure entirely, which is risk avoidance, not transfer. Transfer moves the financial consequence to a third party through insurance or contractual indemnity. Avoidance is chosen when the risk cannot be reduced to an acceptable level and the business process can be discontinued.
- ✓
Purchasing cyber insurance to cover potential losses
Why this is correct
Risk transfer shifts the financial consequence of a risk to a third party. Purchasing cyber insurance means the insurer absorbs potential breach losses, satisfying the stem's requirement for risk transfer, whereas patching, avoiding the vendor or accepting the exposure would not shift that financial burden.
- ✗
Installing a patch to fix the vulnerability
Why it's wrong here
Patching reduces the vulnerability's likelihood, which is risk mitigation, not transfer. Transfer shifts financial consequence to a third party via insurance or contractual indemnity. Patching is correct when the organisation retains the risk and can remediate directly within its own systems.
- ✗
Accepting the risk and documenting the decision
Why it's wrong here
Accepting and documenting the risk is risk retention, since the organisation absorbs any loss itself. Transfer requires another party to bear the financial impact, typically through cyber insurance or vendor indemnity clauses. Acceptance is appropriate when the exposure falls within the stated risk appetite.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Risk avoidance
Risk avoidance is a risk management strategy that involves eliminating any activity, process, or technology that introduces a specific risk, rather than trying to reduce or accept it.
Key term
Impact
Impact is the measure of the potential damage or harm that a risk event could cause to an organization's assets, operations, or reputation.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.