Match each risk treatment to its description.

### Why this is right Each term describes a different decision about an identified risk. The key distinction is whether the organization reduces, shifts, retains, or removes the source of exposure. ### The pairs | Item | Matches | Why | |---|---|---| | Mitigate | Reduce the likelihood or impact without necessarily eliminating the risk | Safeguards such as patching can make an attack less likely or less harmful. | | Transfer | Shift some financial consequences, for example through insurance | Insurance can help cover losses, although it does not itself prevent an attack. | | Accept | Retain a risk after deciding it is tolerable | The organization continues with the exposure rather than adding a new treatment. | | Avoid | Eliminate the risk by removing the activity or exposure | Removing an activity removes the associated exposure, as in blocking USB use. | ### Terms - **Exposure**: a condition in which an asset could be affected by a threat. ### Remember Mitigation reduces, transfer shifts, acceptance retains, and avoidance removes.