A company determines that a legacy customer file-sharing service carries risk it cannot reduce cost-effectively. Leadership decides to decommission the service entirely and stop offering it. Which risk treatment is this?
Select an answer to reveal the explanation.
Short Explanation
If you're worried about getting hurt skydiving and decide never to jump, that's avoidance. Shutting the service down removes the risk instead of managing it. Don't mix it up with acceptance, which keeps the service running and simply lives with the risk.
Full Explanation
Risk avoidance removes the exposure by discontinuing the activity, system, or process that creates it. Decommissioning the legacy file-sharing service means the vulnerabilities and threats associated with it no longer apply to the organization, which is appropriate when the risk is high and cannot be reduced at a reasonable cost. The trade-off is the lost business value of the service, which leadership has judged worth giving up. Risk acceptance means continuing the activity with a documented, approved decision to tolerate the remaining exposure; the service would stay online, which is the opposite of what happened. Risk transfer shifts financial consequences to a third party through insurance or contract terms; the service would continue and the exposure would remain, only the financial burden would move. Risk mitigation applies controls such as patching, encryption, or access restrictions to reduce likelihood or impact; the scenario states mitigation is not cost-effective and the outcome is removal rather than reduction. Exam caveat: avoidance must be complete to count; leaving copies of the data or an unused but reachable server keeps residual exposure. Operational check: confirm the service, its accounts, DNS records, and stored data have been retired or sanitized, then update the risk register entry to closed with the decommission evidence attached.