A company plans to install new servers.

This is a negative risk (threat): the manufacturer may be unable to deliver due to financial trouble, which could delay the project or increase cost. The scenario already indicates the response: “the servers will be sourced from another vendor.” That is best described as risk avoidance—changing the plan to eliminate exposure to the threatened vendor failure by not depending on that manufacturer. CompTIA Project+ includes performing risk management activities such as selecting risk management strategies and executing contingency/fallback plans.

“Mitigate” would mean reducing probability/impact while still accepting some exposure (e.g., adding schedule buffer, placing partial orders early, or increasing inspections), but here the team is switching vendors, which removes the root threat from the current plan. “Share” and “exploit” are typically associated with positive risks/opportunities, not threats, and don’t fit a supplier distress scenario.

So the correct strategy is Avoid: replace the risky supplier dependency with an alternate sourcing approach to prevent the risk from materializing into a project issue (late delivery, non-delivery, or contract disruption).