A software upgrade project has been postponed because it may impact a critical business system. Which of the following strategies has been applied?

Accepting risk means acknowledging the threat and proceeding with the original plan without changing scope or schedule, which is the opposite of postponing the project.

Mitigating risk reduces the probability or impact of a risk while still proceeding with the work, whereas postponing the project eliminates the risk entirely rather than lessening it.

Risk avoidance involves modifying the project plan - in this case postponing the upgrade - to completely eliminate the threat rather than reduce or accept it. By deferring the work, the organization removes the scenario in which the critical system could be impacted, which is the defining characteristic of avoidance as opposed to other risk response strategies.

Exploiting risk is a response strategy for positive risks (opportunities) aimed at ensuring the benefit is realized, and does not apply to threats such as potential system impact.