English
Menu

Information Security Basics

To prepare for damages that might have to be paid after a data breach, a company took out cyber insurance. Which risk response is this?

  1. ARisk avoidance
  2. BRisk transfer
  3. CRisk acceptance
Show answer and explanation

Answer: B. Risk transfer

Risk responses fall into four broad types. Risk avoidance means stopping the business activity or system that causes the risk. Risk reduction means taking measures to lower the likelihood or impact. Risk transfer means sharing the burden of loss with another organization, for example through insurance or outsourcing; it is also called risk sharing. Risk acceptance (retention) means taking the risk without any particular measures, for example when its impact is small. Insurance moves part of the financial loss, such as damages, to the insurer, so it is risk transfer. The breach itself and the loss of trust cannot be transferred, however, so insurance is combined with risk reduction measures.

  • A. Risk avoidance means giving up the business activity or system that causes the risk.
  • B. Correct. Insurance moves the burden of financial loss to the insurer, which is risk transfer.
  • C. Risk acceptance means taking the risk without any particular measures. Buying insurance is a measure.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. For an information system, it is estimated that an incident causing a loss of 20 million yen each time occurs 0.1 times per year. A countermeasure costing 0.5 million yen per year would reduce the frequency to 0.02 times per year. What is the net annual benefit of this countermeasure (the reduction in expected loss minus the cost of the countermeasure)?
  2. When an ISMS (information security management system) is run using the PDCA cycle, which activity belongs to the Check stage?
  3. Which statement correctly describes symmetric-key cryptography?
  4. Using public-key cryptography, A wants to encrypt a message so that only B can read it. Which key is used for the encryption?
  5. Fifty members want every pair of them to be able to communicate with encryption without the other members learning the contents. Which combination gives the number of keys needed with symmetric-key cryptography and with public-key cryptography (counting public and private keys together)?