Exam CISA topic 1 question 19 discussion

Do not fully agree with the original answer, risk avoidance usually means that the operational target has been cancelled, which means that the data center has ceased to operate. In the context of exam questions, it also seems to be a risk mitigation approach. Risk avoidance in this scenario is only for the risk of flooding, which is not a too standard case.

The approach that has been adopted in this scenario is D. Risk avoidance. Risk avoidance involves taking actions to eliminate or avoid the risk altogether. In this case, the decision to move data center operations to another facility on higher ground is a proactive measure to avoid the potential risk of flooding near the current data center location. By relocating the data center to a safer location, the organization is actively avoiding the risk associated with potential flooding.

Risk still be present in the new location only the likelihood will be decreased - A

There's been a decision to eliminate the risk of flooding by relocating the data center to a safer location. This approach directly addresses the identified risk by moving away from the potential threat.

Answer is A. Risk reduction (mitigate) Risk avoidance is when you do not operate or perform the process, which could increase risks. However, in this question, they move the data centre to keep operating in the safer place.

Risk reduction would involve taking steps to lessen the impact or likelihood of the risk occurring but not completely avoiding it. An example of risk reduction in this context might be to enhance flood defenses at the current data center rather than moving it. However, since the organization is moving the data center to eliminate the risk of flooding, the approach is risk avoidance.

Answer: A

avoidance

The approach described in the question is called risk avoidance.

A. Risk avoidance means no chance of happening - which means closing data center. Any way that still have a chance are risk reduction

The answer is D. To avoid risk, data centers must be closed or moved to a cloud environment where there is no risk of flooding. A is the appropriate choice to reduce the risk of flooding.

A is the right answer.

Wow! D is indeed correct. RISK reduction would be if you put sandbags around your DC! A. Risk reduction: This involves taking actions to decrease the potential impact or likelihood of a risk. While moving the data center might reduce the risk of flood damage, it's more accurate to say it completely avoids this particular risk.

They don't avoid risk, they take correcting actions

Risk avoidance would be if you close down data center. because risk avoidance mean "Avoiding risk by not allowing actions that would cause the risk to occur". In this case safe and higher ground is chosen therefor appropriate controls are applied to reduce the risk therefor Risk mitigation, answer is A

I would go for A. The risk is reduced but not eliminated (hence avoided).

D is the correct answear because according to CRM risk avoidance means avoiding risk by not allowing actions that would cause the risk to occur. Risk acceptance means not taking actions, provided the risk clearly satisfies the organisation s policy and criteria for acceptance. Risk transfer means transfering the risk to other parties such as insurets or suppliers.