Which of the following is an example of risk transference?

Question

Options

• APurchasing Cyber insurance
• BOutsourcing the function to a 3rd party
• CWriting specific language in an agreement that puts the burden back on the other party
• DImplementing changes to current operating procedure

• A
  70% (16)
• B
  4% (1)
• C
  9% (2)
• D
  17% (4)

Explanation

Purchasing cyber insurance (A) is the classic example of risk transference because you are shifting the financial consequences of a risk to a third party (the insurer) in exchange for a premium - your organization no longer bears the full loss if a breach occurs.

Why the distractors are wrong:

• B (Outsourcing) transfers responsibility for a function but not necessarily the risk - your organization typically still owns the liability unless contractual language explicitly shifts it, making this closer to risk sharing or avoidance depending on context.
• C (Contractual language shifting burden) is actually also a form of risk transference, making this a tricky distractor - but on most CompTIA/security exams, insurance is the textbook primary example, and contractual transfer is treated as a secondary or separate mechanism.
• D (Changing operating procedures) is risk mitigation (reduction) - you're reducing the likelihood or impact of the risk rather than moving it to another party.

Memory tip: Think of transference as "paying someone else to worry about it." Insurance is the purest form - you hand money to an insurer, and they absorb the financial hit. If you're reducing or changing something internally, that's mitigation; if you're eliminating the risk entirely, that's avoidance; if you accept the potential loss, that's acceptance.

No community discussion yet for this question.