Exam CISM topic 1 question 768 discussion

A may not be a correct answer. A is not an example for risk mitigation. Both options B and D are correct here; because B meant Risk Avoidance which is one of the mitigation; D meant transfer risk to insurer which is also one of the mitigation.

While discontinuing the activity associated with the risk (B) can be an effective risk mitigation strategy in certain circumstances, it may not always be feasible or practical. For example, discontinuing a critical business activity may not be an option for many organizations. Improving security controls (A), on the other hand, is a more flexible and common approach to risk mitigation. By enhancing the security measures in place, organizations can reduce the likelihood or impact of a potential security incident. This approach allows organizations to continue their operations while reducing the risk of a security breach or loss of sensitive information.

A. Improving security controls

I like B. Risk avoidance is a better example of risk mitigation strategy.