mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation is evaluating risk…
A multinational corporation is evaluating risk treatment options for a identified high-impact, low-probability risk. The risk is below the organization's risk appetite threshold. Which is the most appropriate action?
⚠ Common exam trap
A common mix-up: candidates assume high-impact risks must always be mitigated or transferred, ignoring the critical factor that the risk is already below the organization's risk appetite threshold, which makes acceptance the correct and most efficient choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accept the risk
When a risk is below the organization's risk appetite threshold, it is considered acceptable. Accepting the risk (Option D) is the most appropriate action because the organization has determined that the potential impact is tolerable and does not warrant additional expenditure or operational changes. This aligns with the risk management principle that not all risks must be mitigated, transferred, or avoided—some are simply retained as a cost of doing business.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mitigate the risk
Why it's wrong here
Mitigation involves implementing controls to reduce the likelihood or impact of a risk. However, for a risk already assessed as being within the organization's established risk appetite, further mitigation efforts are generally not cost-effective or necessary. Investing additional resources to reduce an already tolerable risk would represent an inefficient allocation of security budget, as the residual risk is already deemed acceptable without further intervention.
- ✗
Transfer the risk via insurance
Why it's wrong here
Transferring this risk via insurance is inappropriate because the risk is already below the organisation’s risk appetite threshold, meaning it is accepted as tolerable without further action; insurance is a treatment for residual risk that exceeds appetite, not for risks already within tolerance. It is tempting because insurance is a standard mechanism for mitigating financial exposure from high-impact, low-probability events, and would be correct if the risk exceeded the risk appetite threshold and the organisation sought to shift financial liability.
- ✗
Avoid the risk by discontinuing the activity
Why it's wrong here
Risk avoidance is a drastic strategy that involves eliminating the activity or asset causing the risk altogether. This option is typically reserved for risks that are unacceptably high and cannot be effectively mitigated or transferred to bring them within the organization's risk appetite. Since the risk in question is already within the acceptable threshold, discontinuing the associated activity would be an unwarranted and potentially detrimental business decision, sacrificing potential benefits without sufficient justification.
- ✓
Accept the risk
Why this is correct
Risk acceptance is the appropriate treatment when the identified risk falls within the organization's defined risk appetite, meaning it is deemed tolerable without requiring additional controls or actions. This decision acknowledges that the potential impact and likelihood of the risk are within acceptable limits, and the cost or effort of further treatment would outweigh the benefits. Therefore, no further action is required, and the organization proceeds with the activity, understanding the inherent risk.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Risk management
Risk management is the process of identifying, assessing, and controlling threats to an organization's capital, earnings, and operations, including IT systems and data.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.