CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityEasy
A financial services firm identifies a risk that its primary cloud provider could suffer an extended outage during peak trading hours. Rather than building redundant infrastructure, the firm purchases a business interruption insurance policy to cover potential losses. Which risk response strategy is being used?
- ARisk acceptance
- BRisk mitigation
- CRisk avoidance
- DRisk transfer
Show answer & explanationAnswer & explanation
Correct answer: D. Risk transfer
Purchasing insurance shifts the financial impact of the risk to a third party (the insurer) rather than reducing the likelihood or impact directly, which defines risk transfer.
Why the other options are wrong
- A. Acceptance means acknowledging the risk and taking no action to address it.
- B. Mitigation involves reducing the likelihood or impact, such as adding redundancy.
- C. Avoidance would mean eliminating the activity that creates the risk entirely.
Risk Transfer
A risk response strategy where the financial or operational impact of a risk is shifted to a third party, such as through insurance or contractual agreements.
- Does not reduce likelihood of the risk occurring
- Common examples: insurance, outsourcing, warranties
- One of four standard risk response strategies
Memory trick: A Man Takes Anything — Avoid, Mitigate, Transfer, Accept