When dealing with risk, the information security practitioner may choose to:

Question

Options

• Aassign
• Btransfer
• Cacknowledge
• Ddefer

• A
  3% (1)
• B
  17% (6)
• C
  71% (25)
• D
  9% (3)

Explanation

Acknowledging (accepting) a risk is the recognized option when an organization consciously decides to live with a risk because the cost of mitigation outweighs the potential impact - making C the correct answer from the choices as presented.

Why the distractors are wrong:

• A. Assign - not a recognized risk treatment option in standard information security frameworks; risk ownership is part of governance, not a treatment strategy.
• B. Transfer - while transfer (e.g., via insurance or outsourcing) is a legitimate risk response in most frameworks, it is not among the options this particular exam recognizes as the primary action a practitioner takes when dealing with residual risk after evaluation; the exam expects "acknowledge" as the acceptance response.
• D. Defer - postponing a risk decision indefinitely is not a formal treatment option; it simply delays action without addressing the risk.

Memory tip: Think of the classic risk responses as TAME - Transfer, Avoid, Mitigate, Accept/Acknowledge. When your only real option is to live with a risk (and document that decision), you acknowledge it - essentially signing off that you're aware and accepting responsibility.

No community discussion yet for this question.