ISC2 Exam CSSLP Topic 11 Question 47 Discussion

When you are hiring a third party to own risk, it is known as transference risk response.

Transference is a strategy to mitigate negative risks or threats. In this strategy, consequences and the ownership of a risk is transferred to a

third party. This strategy does not eliminate the risk but transfers responsibility of managing the risk to another party. Insurance is an

example of transference.

Answer B is incorrect. The act of spending money to reduce a risk probability and impact is known as mitigation.

Answer A is incorrect. Exploit is a strategy that may be selected for risks with positive impacts where the organization wishes to ensure

that the opportunity is realized.

Answer D is incorrect. When extra activities are introduced into the project to avoid the risk, this is an example of avoidance.