After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software…

The correct answer is A. Avoid. Avoid is a risk management principle that describes the decision or action of not engaging in an activity or accepting a risk that is deemed too high or unacceptable. Avoiding a risk can eliminate the possibility or impact of the risk, as well as the need for any further risk…

Submitted by salim_om· Mar 6, 2026Security operations

Question

After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select?

Options

AAvoid
BTransfer
CAccept
DMitigate

How the community answered

(41 responses)

A
90% (37)
B
2% (1)
C
2% (1)
D
5% (2)

Explanation

Avoid is a risk management principle that describes the decision or action of not engaging in an activity or accepting a risk that is deemed too high or unacceptable. Avoiding a risk can eliminate the possibility or impact of the risk, as well as the need for any further risk management actions. In this case, the CISO decided the risk score would be too high and refused the software request. This indicates that the CISO selected the avoid principle for risk management.

Topics

#risk management#risk avoidance#risk assessment#CISO decisions

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice