CompTIA CASP+ Practice Test

What risk response is likely considered when a business establishes a Service Level Agreement (SLA) with a third party during network infrastructure upgrades?

1. Transferring risk

2. Avoiding risk

3. Accepting risk

4. Mitigating risk

The correct answer is: Transferring risk

When a business establishes a Service Level Agreement (SLA) with a third party during network infrastructure upgrades, it is primarily engaging in the practice of transferring risk. An SLA defines the expected service levels, responsibilities, and penalties for non-compliance between the business and the third party. By doing this, the business is effectively transferring some of the risks associated with service delivery, such as downtime or poor performance, to the third party. This transfer is achieved because the third party now bears the responsibility for meeting the stipulated service levels. If they fail to deliver as promised, the SLA can provide recourse for the business, such as financial penalties or service credits, which mitigates the financial impact on the business from service failures. While there are other risk management strategies such as avoiding risk (which would involve changing plans to circumvent risks altogether), accepting risk (where a business acknowledges the possibility of risk and decides to proceed anyway), and mitigating risk (which involves implementing measures to reduce the likelihood or impact of a risk), these are not the primary focus when establishing an SLA. Instead, the SLA specifically aims to assign responsibility and accountability to the third party, thus effectively transferring the associated risks.