Exam CISA topic 1 question 19 discussion

Do not fully agree with the original answer, risk avoidance usually means that the operational target has been cancelled, which means that the data center has ceased to operate. In the context of exam questions, it also seems to be a risk mitigation approach. Risk avoidance in this scenario is only for the risk of flooding, which is not a too standard case.

The approach that has been adopted in this scenario is D. Risk avoidance. Risk avoidance involves taking actions to eliminate or avoid the risk altogether. In this case, the decision to move data center operations to another facility on higher ground is a proactive measure to avoid the potential risk of flooding near the current data center location. By relocating the data center to a safer location, the organization is actively avoiding the risk associated with potential flooding.

Risk avoidance involves eliminating the risk entirely by deciding not to engage in the activity or exposure that gives rise to the risk. In this case, moving the data center to higher ground is a proactive measure to avoid the risk of flooding altogether. Why not the others? A. Risk reduction: Risk reduction involves implementing controls to minimize the likelihood or impact of a risk. For example, building flood barriers or enhancing drainage systems would be risk reduction. Moving the data center eliminates the risk entirely rather than reducing it. B. Risk acceptance: Risk acceptance means recognizing a risk and choosing to live with it without taking action. In this case, management is taking decisive action to address the risk, not accepting it. C. Risk transfer: Risk transfer involves shifting the financial consequences of a risk to a third party, such as purchasing flood insurance. Moving the data center does not involve transferring the risk to another party.

Risk avoidance involves taking actions to completely eliminate a risk by avoiding the activities or circumstances that create it. In this case, relocating the data center to higher ground avoids the risk of flooding entirely.

Risk still be present in the new location only the likelihood will be decreased - A

There's been a decision to eliminate the risk of flooding by relocating the data center to a safer location. This approach directly addresses the identified risk by moving away from the potential threat.

Answer is A. Risk reduction (mitigate) Risk avoidance is when you do not operate or perform the process, which could increase risks. However, in this question, they move the data centre to keep operating in the safer place.

Risk reduction would involve taking steps to lessen the impact or likelihood of the risk occurring but not completely avoiding it. An example of risk reduction in this context might be to enhance flood defenses at the current data center rather than moving it. However, since the organization is moving the data center to eliminate the risk of flooding, the approach is risk avoidance.

Answer: A

avoidance

The approach described in the question is called risk avoidance.

A. Risk avoidance means no chance of happening - which means closing data center. Any way that still have a chance are risk reduction

The answer is D. To avoid risk, data centers must be closed or moved to a cloud environment where there is no risk of flooding. A is the appropriate choice to reduce the risk of flooding.

A is the right answer.

Wow! D is indeed correct. RISK reduction would be if you put sandbags around your DC! A. Risk reduction: This involves taking actions to decrease the potential impact or likelihood of a risk. While moving the data center might reduce the risk of flood damage, it's more accurate to say it completely avoids this particular risk.

They don't avoid risk, they take correcting actions

Risk avoidance would be if you close down data center. because risk avoidance mean "Avoiding risk by not allowing actions that would cause the risk to occur". In this case safe and higher ground is chosen therefor appropriate controls are applied to reduce the risk therefor Risk mitigation, answer is A