Which of the following is an example of risk transference?

Question

Options

• AWriting specific language in an agreement that puts the burden back on the other party
• BOutsourcing the function on run 3rd party
• CImplementing changes to current operating procedure
• DPurchasing cyber insurance

• A
  9% (4)
• B
  7% (3)
• C
  4% (2)
• D
  80% (37)

Explanation

Purchasing cyber insurance (D) is the classic example of risk transference - you are shifting the financial consequences of a risk to a third party (the insurer) rather than absorbing it yourself.

Why the distractors are wrong:

• A (contractual language shifting burden) describes risk transference as well, but this is the classic example of contractual risk transfer - not the best or most prototypical exam answer. On most security exams, insurance is the canonical example, making D the stronger choice.
• B (outsourcing to a 3rd party) is often confused with transference, but outsourcing primarily represents risk sharing or acceptance, since you still carry residual liability and reputational risk.
• C (changing operating procedures) is risk mitigation/reduction - you're altering internal controls to decrease the likelihood or impact of a risk.

Memory tip: Think of the word transfer - you are handing off the financial risk to someone else who gets paid to carry it. Insurance is literally a financial instrument designed to bear your risk for a premium, making it the textbook definition of transference.

No community discussion yet for this question.