CISSP Security and Risk Management Practice Question
A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)
⚠ Common exam trap
CISSP often tests the risk response taxonomy, tempting candidates to select 'risk acceptance' or 'risk deferral' for high-severity risks when the correct answers are the proactive responses of mitigation and avoidance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
Risk mitigation (A) is correct because for a high-impact, high-likelihood risk the organization should implement controls (e.g., firewalls, encryption, MFA, patching) to reduce the probability and/or impact to an acceptable level. Risk avoidance (C) is also correct because eliminating the activity or asset that generates the risk removes the exposure entirely, which is appropriate when the risk is too severe to tolerate. Risk research (B) is not a standard risk response in the mitigation/avoidance/transference/acceptance taxonomy and does not by itself reduce a high/high risk. Risk acceptance (D) is inappropriate because accepting a high-impact, high-likelihood risk leaves the organization exposed beyond tolerable levels. Risk deferral (E) is not a valid risk response; postponing action does not reduce the risk and is essentially a form of acceptance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk mitigation
Why this is correct
Risk mitigation involves implementing specific security controls and countermeasures to actively reduce the likelihood of a risk occurring or to lessen its potential impact. For a high-impact risk, this means taking proactive steps, such as strengthening defenses, improving processes, or deploying new technologies, to bring the risk level down to an acceptable threshold. It is a primary and responsible strategy when the activity causing the risk cannot be avoided.
- ✗
Risk research
Why it's wrong here
Risk research is an analytical phase of risk management, focused on identifying, assessing, and understanding the characteristics of threats, vulnerabilities, and potential impacts. While essential for informed decision-making, it is a preparatory step that precedes the selection of a risk response. Research itself does not constitute an action taken to alter the risk's likelihood or impact, which is the defining characteristic of a risk response.
- ✓
Risk avoidance
Why this is correct
Risk avoidance is a definitive response that eliminates the risk entirely by discontinuing the activity or process that gives rise to it. For a high-impact risk, this strategy ensures the organization is no longer exposed to the potential harm, making it a very effective, albeit sometimes costly, solution. For example, choosing not to implement a new system due to insurmountable security vulnerabilities is a form of risk avoidance.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance involves consciously deciding to take no action to reduce the likelihood or impact of a risk, typically because the cost of mitigation outweighs the potential loss, or the risk is deemed very low. For a high-impact risk, however, simply accepting it without implementing controls is generally irresponsible and contrary to sound security management principles, as it leaves the organization vulnerable to significant harm.
- ✗
Risk deferral
Why it's wrong here
Risk deferral is not a recognized or advisable risk response strategy within formal cybersecurity frameworks like NIST or ISO 27005. While an organization might operationally delay a response due to resource constraints, this is an operational decision, not a strategic risk treatment. For a high-impact risk, deferring action would leave the organization exposed to severe consequences without a planned countermeasure, which is unacceptable in robust risk management.
Go deeper
Related to this question
Learn chapter
Incident Response and Business Continuity
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Risk mitigation
Risk mitigation is the process of reducing the likelihood or impact of a potential security threat to an acceptable level through specific controls and actions.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.