Risk Management Strategies

1. A company purchases a cybersecurity insurance policy that covers ransomware recovery costs, legal expenses, and breach notification fees. After a ransomware attack encrypted their servers, the insurer paid out $800,000. Which risk management strategy did the organization use, and what did it NOT accomplish?

A. Risk avoidance — purchasing insurance avoids the financial consequences of ransomware attacks B. Risk transfer — the financial consequences were shifted to the insurer; however, the organization still suffered the operational disruption, reputational impact, and the ransomware threat itself was not eliminated C. Risk mitigation — insurance reduces the financial impact of ransomware D. Risk acceptance — by purchasing insurance the organization formally accepted the ransomware risk

2. A manufacturing company purchases a specialized industrial robot that runs Windows 7. The equipment vendor states they do not support any OS patches or updates and that applying patches will void the warranty and potentially damage the equipment. The company's security policy requires monthly OS patches on all Windows systems. What is the appropriate risk management response?

A. Risk avoidance — the company should not purchase equipment that cannot be patched B. Risk acceptance with exemption — management approves a formal documented exemption for this device because the security policy cannot be applied; compensating controls (network isolation) are implemented and the residual risk is documented C. Risk acceptance with exception — the company creates a temporary exception allowing delayed patching until the vendor supports patches D. Risk mitigation — the company installs antivirus software on the industrial robot to compensate for missing patches

3. A company's security policy requires that all OS patches be applied within 72 hours of release. This month's Windows update causes the company's critical ERP system to crash. The vendor has acknowledged the incompatibility and is working on a fix expected in two weeks. What is the appropriate risk management response?

A. Risk acceptance with exemption — the policy cannot permanently be applied to ERP systems B. Risk acceptance with exception — a time-limited exception is granted to delay these specific patches until the vendor resolves the ERP incompatibility; the policy remains valid and the exception expires once the fix is available C. Risk avoidance — the company should stop applying patches to avoid compatibility issues D. Risk transfer — the vendor is responsible for the incompatibility and bears the risk during the delay

4. After analyzing their public-facing web application, a security team determines it has too many unresolvable vulnerabilities and poses unacceptable risk. Management decides to shut down the web application entirely and redirect customers to a partner's platform. Which risk management strategy does this represent?

A. Risk mitigation — shutting down a vulnerable application is a form of vulnerability remediation B. Risk avoidance — the organization completely eliminates the risk by stopping the activity (running the vulnerable application) that created it; the risk is fully removed, not just reduced C. Risk transfer — using the partner's platform transfers web application risk to the partner D. Risk acceptance — by redirecting customers, the company accepts that its web application is too risky

5. A security team is concerned about internet-facing attack risk. They install a next-generation firewall with application inspection, implement multi-factor authentication on all remote access, and segment the network to limit lateral movement. Which risk management strategy do these actions collectively represent?

A. Risk avoidance — these controls eliminate internet-facing risk by blocking all external access B. Risk mitigation — these controls reduce the likelihood and impact of internet-facing attacks without eliminating internet connectivity or the threat; risk is lowered to an acceptable level, not removed C. Risk transfer — these controls shift attack surface responsibility to the firewall vendor D. Risk acceptance — by implementing controls rather than eliminating internet access, the organization accepts residual internet-facing risk

6. A CISO prepares a quarterly security risk report for the board of directors. The report includes identified risks with business impact descriptions, likelihood ratings, current mitigation status, and highlights two newly discovered attack vectors the organization has not yet addressed. What purpose do these newly discovered risks serve in the report, and who is the intended decision-maker?

A. Newly discovered risks are included for historical reference; the board reviews completed mitigations, not future risks B. The newly discovered risks are emerging risks requiring board attention; risk reports for board-level audiences highlight critical and emerging risks so executives can make informed decisions about budget allocation and risk acceptance for risks not yet under control C. Emerging risks should be withheld from board reporting until the security team has proposed a mitigation plan D. The board is not the appropriate audience for emerging risks; they should be reported only to the CISO and IT leadership

Matching: Risk Management Strategies

Match each strategy (1–4) to its correct description (A–D).

1Risk Transfer

2Risk Avoidance

3Risk Mitigation

4Risk Acceptance

AA deliberate, documented business decision to tolerate a risk without implementing additional controls because the cost of mitigation exceeds the potential damage or the risk falls within the stated risk appetite

BCompletely eliminates a risk by stopping participation in the activity that creates it; the only strategy that fully removes the risk rather than reducing or shifting it

CShifts financial responsibility for a risk to another party through mechanisms such as cybersecurity insurance or outsourcing; does not eliminate the underlying threat

DReduces the likelihood or impact of a threat through security controls such as firewalls, MFA, encryption, and patching; does not eliminate the risk but lowers it to an acceptable level

Risk Management Strategies — Quiz