hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security manager is evaluating risk treatment…
A security manager is evaluating risk treatment options for a high-impact, low-probability risk. Which approach is most appropriate?
⚠ Common exam trap
A common mix-up: candidates choose 'Mitigate' because they assume all high-impact risks require active reduction, failing to recognize that transfer is a distinct and often more cost-effective strategy for low-probability events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transfer
Transfer is the most appropriate approach for a high-impact, low-probability risk because it shifts the financial burden of a rare but severe event to a third party, such as through cyber insurance or outsourcing. This aligns with the risk management principle that low-probability, high-impact risks are often uneconomical to mitigate fully, making transfer a cost-effective strategy. For example, purchasing a cyber liability policy with specific coverage for data breaches ensures the organization does not bear the full recovery cost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Transfer
Why this is correct
Risk transfer involves shifting the financial burden of a potential loss to a third party, typically through insurance policies or contractual agreements with vendors. While the organization retains ultimate accountability for the risk, the financial impact of a catastrophic yet rare event is absorbed by the insurer or service provider. This strategy is particularly effective for high-impact, low-probability risks where the cost of complete mitigation is prohibitive, but the potential loss is too great to accept.
- ✗
Accept
Why it's wrong here
Risk acceptance is a deliberate decision to take no action to reduce the likelihood or impact of a risk, often because the cost of treatment outweighs the potential loss or the risk is deemed negligible. However, for high-impact risks, even those with low probability, accepting them without a robust contingency or recovery plan is generally ill-advised. Such a decision could lead to severe operational disruption, significant financial losses, or even organizational failure if the risk materializes.
- ✗
Avoid
Why it's wrong here
Risk avoidance entails eliminating the activity or asset that gives rise to the risk altogether, thereby completely removing the threat. While this strategy guarantees the risk will not materialize, it often comes with significant opportunity costs or adverse business impacts, such as foregoing a lucrative market or discontinuing a critical service. It is typically reserved for risks that are unacceptably high and cannot be effectively mitigated or transferred without prohibitive expense, making the cessation of the activity the only viable option.
- ✗
Mitigate
Why it's wrong here
Risk mitigation involves implementing controls and safeguards to reduce either the likelihood of a risk occurring or the severity of its impact. This strategy is widely used, employing technical, administrative, and physical controls to bring risk down to an acceptable level. However, for risks with extremely low probability, the extensive resources and financial investment required for effective mitigation might not be justified, as the cost of controls could easily exceed the potential benefit, making it an inefficient use of resources.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.