CISSP Security and Risk Management Practice Question
A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
For high-impact, high-likelihood risks, avoidance (eliminating the activity) or mitigation (reducing impact/likelihood) are common. Transfer (insurance) may also be used but is less comprehensive. Acceptance is for low risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk mitigation
Why this is correct
Risk mitigation involves implementing specific security controls and countermeasures to actively reduce the likelihood of a risk occurring or to lessen its potential impact. For a high-impact risk, this means taking proactive steps, such as strengthening defenses, improving processes, or deploying new technologies, to bring the risk level down to an acceptable threshold. It is a primary and responsible strategy when the activity causing the risk cannot be avoided.
- ✗
Risk research
Why it's wrong here
Risk research is an analytical phase of risk management, focused on identifying, assessing, and understanding the characteristics of threats, vulnerabilities, and potential impacts. While essential for informed decision-making, it is a preparatory step that precedes the selection of a risk response. Research itself does not constitute an action taken to alter the risk's likelihood or impact, which is the defining characteristic of a risk response.
- ✓
Risk avoidance
Why this is correct
Risk avoidance is a definitive response that eliminates the risk entirely by discontinuing the activity or process that gives rise to it. For a high-impact risk, this strategy ensures the organization is no longer exposed to the potential harm, making it a very effective, albeit sometimes costly, solution. For example, choosing not to implement a new system due to insurmountable security vulnerabilities is a form of risk avoidance.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance involves consciously deciding to take no action to reduce the likelihood or impact of a risk, typically because the cost of mitigation outweighs the potential loss, or the risk is deemed very low. For a high-impact risk, however, simply accepting it without implementing controls is generally irresponsible and contrary to sound security management principles, as it leaves the organization vulnerable to significant harm.
- ✗
Risk deferral
Why it's wrong here
Risk deferral is not a recognized or advisable risk response strategy within formal cybersecurity frameworks like NIST or ISO 27005. While an organization might operationally delay a response due to resource constraints, this is an operational decision, not a strategic risk treatment. For a high-impact risk, deferring action would leave the organization exposed to severe consequences without a planned countermeasure, which is unacceptable in robust risk management.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.