mediumMultiple Choice
CCSP Practice Question: A company identifies a high-risk vulnerability in…
A company identifies a high-risk vulnerability in a cloud application. The cost to remediate is significantly higher than the potential loss from exploitation. Which risk treatment strategy is most appropriate?
⚠ Common exam trap
ISC2 often tests the distinction between risk acceptance and risk mitigation, where candidates mistakenly choose mitigation because they assume all vulnerabilities must be fixed, ignoring the cost-benefit analysis that justifies acceptance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Acceptance
When the cost to remediate a vulnerability exceeds the potential loss from exploitation, the most appropriate risk treatment strategy is acceptance. This means the organization formally acknowledges the risk and chooses to tolerate it without implementing additional controls, often documented in a risk register. In cloud environments, this is common for low-impact, high-cost vulnerabilities where the business decides the residual risk is within its risk appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Acceptance
Why this is correct
Acceptance is appropriate when remediation cost outweighs potential loss, and the scenario states exactly that imbalance. Formally accepting the high-risk vulnerability, with documented justification and monitoring, satisfies the cost-benefit constraint rather than transferring, avoiding or mitigating it through disproportionate expenditure.
- ✗
Avoidance
Why it's wrong here
Avoidance eliminates the activity generating the risk, but the stem accepts the residual loss because remediation costs exceed it, so the application must keep running. Avoidance suits scenarios where no control can reduce risk below tolerance and the business process itself can be discontinued.
- ✗
Transfer
Why it's wrong here
Transfer shifts risk to a third party such as an insurer or outsourced provider; the stem gives no counterparty willing to accept this vulnerability, and remediation cost exceeding potential loss points to acceptance. Transfer suits insurable losses, not retaining an unmitigated application flaw.
- ✗
Mitigation
Why it's wrong here
Mitigation—applying controls to reduce the vulnerability’s likelihood or impact—fails here because the cost of remediation exceeds the expected loss, making the expense economically unjustifiable; the correct strategy is acceptance, which formally acknowledges the risk without spending resources. Mitigation is tempting because it is the default response to most vulnerabilities, and it would be correct when the cost to reduce risk is lower than the potential loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.