Risk Management & Assessment Flashcards

A company buys cyber insurance to cover potential breach costs. Which risk response is this?

Answer: Transfer

Insurance shifts the financial consequence of a risk to a third party, which is transfer.

A manager decides to cancel a project feature because its risk is too high. This is risk:

Answer: Avoidance

Avoidance eliminates the threat by removing the activity that creates it.

Adding redundant servers to reduce the impact of a hardware failure is an example of:

Answer: Risk mitigation

Redundancy lowers the impact or likelihood of a failure, which is mitigation.

What is the difference between active and passive risk acceptance?

Answer: Active acceptance sets aside contingency reserves; passive takes no action unless the risk occurs

Active acceptance establishes a contingency plan or reserve, while passive acceptance simply deals with consequences if they happen.

A contingency plan is best described as:

Answer: A response prepared to execute only if a specific risk event occurs

Contingency plans are predefined responses activated when a risk event or its trigger occurs.

A new risk that arises as a direct result of implementing a risk response is called a:

Answer: Secondary risk

Secondary risks are created by the response itself, such as outsourcing to reduce risk introducing vendor risk.

For a positive risk (opportunity), which response aims to make sure the opportunity definitely happens?

Answer: Exploit

Exploit removes uncertainty so the opportunity is certain to be realized.