Certified In Cybersecurity CC · Free Practice Question Easy

Question 95

We are discussing our risk responses, and we are considering not issuing our employees laptops. What type of risk response would that be?
  • A Avoidance
  • B Transference
  • C Acceptance
  • D Mitigation
Reveal correct answer

Correct answer: A

Explanation

The correct answer: Avoidance: In risk management, avoidance is the action of eliminating the threat or protecting the project from its impact. It involves changing the project management plan to altogether avoid the risk. In the context of the question, if the risk being considered involves the potential issues associated with issuing laptops to employees (for instance, data breaches, equipment loss, or maintenance costs), deciding not to issue laptops to employees is a form of risk avoidance. By choosing not to participate in the activity that incurs the risk (providing laptops), the company is eliminating the possibility of the risk event occurring. The incorrect answers: Transference is a risk response strategy where the impact of the risk is transferred to a third party. This is typically done through outsourcing, insurance, or through contractual obligations. In the context of the question, not issuing laptops to employees is not a form of risk transference because the company isn't shifting the risk to another party; instead, it's choosing to avoid the risk altogether. Risk mitigation involves taking steps to reduce the potential impact or likelihood of a risk event. Mitigating a risk means that the risk remains but its potential impact is lessened. In this scenario, not providing laptops to employees is not reducing the impact or probability of the risk, it's eliminating the potential risk entirely. An example of mitigation might be enhancing security measures or providing employees with training on how to handle the laptops responsibly. Acceptance is a risk response strategy where no action is taken to avoid, transfer, or mitigate the risk. The risk is acknowledged but not actively addressed, either because it's considered too small to warrant action or because the cost of other risk responses outweigh the potential impact of the risk. In this scenario, not issuing laptops to employees is not an example of risk acceptance, as the company is proactively choosing to avoid the risk. Acceptance would be acknowledging the risks associated with providing laptops, such as potential damage or data loss, and proceeding anyway.

Discussion

Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.

You must be logged in to post a comment.

Preparing For

Your Certification?

255+ certifications
Detailed explanations
Free PDF samples

Has All The Questions You Need