mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A company identifies a high-risk vulnerability in…
A company identifies a high-risk vulnerability in a cloud application. The cost to remediate is significantly higher than the potential loss from exploitation. Which risk treatment strategy is most appropriate?
⚠ Common exam trap
ISC2 often tests the distinction between risk acceptance and risk mitigation, where candidates mistakenly choose mitigation because they assume all vulnerabilities must be fixed, ignoring the cost-benefit analysis that justifies acceptance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Acceptance
When the cost to remediate a vulnerability exceeds the potential loss from exploitation, the most appropriate risk treatment strategy is acceptance. This means the organization formally acknowledges the risk and chooses to tolerate it without implementing additional controls, often documented in a risk register. In cloud environments, this is common for low-impact, high-cost vulnerabilities where the business decides the residual risk is within its risk appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Acceptance
Why this is correct
Correct. Risk acceptance is justified when cost of treatment exceeds potential loss.
- ✗
Avoidance
Why it's wrong here
Avoidance means eliminating the risk, which may not be feasible or cost-effective.
- ✗
Transfer
Why it's wrong here
Transfer via insurance may not be cost-effective and doesn't address the risk directly.
- ✗
Mitigation
Why it's wrong here
Mitigation—applying controls to reduce the vulnerability’s likelihood or impact—fails here because the cost of remediation exceeds the expected loss, making the expense economically unjustifiable; the correct strategy is acceptance, which formally acknowledges the risk without spending resources. Mitigation is tempting because it is the default response to most vulnerabilities, and it would be correct when the cost to reduce risk is lower than the potential loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.