easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Conducting a risk assessment for a new cloud…
A company is conducting a risk assessment for a new cloud service. They identify a vulnerability that could lead to a data breach. The likelihood is low, but the impact is high. According to common risk management frameworks, how should this risk be addressed?
⚠ Common exam trap
ISC2 often tests the misconception that low likelihood alone justifies risk acceptance, but the trap here is that high impact overrides low probability in most compliance-driven frameworks, requiring active mitigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement controls to reduce the risk.
In risk management frameworks like NIST SP 800-37 or ISO 27005, a risk with high impact must be mitigated regardless of low likelihood. The potential for a data breach from this vulnerability means the organization should implement controls (e.g., encryption, access controls, or patching) to reduce the risk to an acceptable level, as the cost of a breach outweighs the low probability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the risk until it materializes.
Why it's wrong here
Ignoring risk is not a recognized risk management strategy.
- ✗
Accept the risk because the likelihood is low.
Why it's wrong here
High impact risks are rarely accepted without mitigation.
- ✓
Implement controls to reduce the risk.
Why this is correct
Mitigation is appropriate for high-impact risks even if likelihood is low.
- ✗
Transfer the risk to a third party.
Why it's wrong here
Risk transfer (e.g., insurance) may be considered, but not the first step.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.