List the four common risk response strategies and give a brief example of each.

• A. Ignore, Ignore, Ignore, Ignore.
• B. Accept, Exploit, Escalate, Eliminate.
• C. Avoid (eliminate risk), Transfer (purchase insurance or outsource), Mitigate (implement controls to reduce likelihood/impact), Accept (tolerate residual risk with monitoring).
• D. Avoid, Accept, Ignore, Outsource.

Answer: (C)

The question tests how risk is addressed with four standard responses: avoid, transfer, mitigate, and accept. Each one is a different way to handle a threat by changing how we interact with the risk.

Avoid means eliminating the risk by not pursuing the activity at all. For example, choosing not to deploy a new technology that has significant security or compliance risks removes that risk from the project entirely.

Transfer shifts the risk to another party, typically through contracts or insurance. An example is outsourcing a sensitive function or purchasing cyber insurance to cover potential losses, so if something goes wrong, another party bears the financial impact.

Mitigate reduces either the likelihood of the risk occurring or the impact if it does occur through controls and safeguards. A concrete example is implementing multi-factor authentication, patch management, and access reviews to lower the chance of a breach and lessen its potential harm.

Accept means acknowledging the risk and monitoring it without taking immediate action to change it, usually when the residual risk is within the organization’s risk tolerance. An example is accepting a minor, low-impact risk and keeping an eye on it with ongoing review.

The other options mix in nonstandard or unrelated ideas—ignore isn’t a formal risk response, exploit is about opportunities rather than threats, and escalation or partial measures without the full set don’t constitute the complete, recognized framework.