Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

A security analyst is reviewing organizational risk management activities across several enterprise initiatives. Which of the following examples correctly align the stated risk response strategy or security control application with its operational description? (Select TWO.)

  1. Purchasing a cyber risk insurance policy to shift potential financial losses resulting from ransomware breaches to a third-party underwriter.Answer
  2. Deploying endpoint detection and response (EDR) agents to lower the likelihood and potential operational impact of malware execution.Answer
  3. C
    Decommissioning an unsupported legacy database server entirely to eliminate vulnerability exposure, which represents risk acceptance.
  4. D
    Installing a honeypot network to act as an inline security boundary control that actively filters and blocks malicious inbound traffic.

Answer

The correct responses are purchasing a cyber risk insurance policy to shift financial losses (Risk Transfer) and deploying endpoint detection and response controls to lower malware impact (Risk Mitigation).
Purchasing insurance transfers financial liability to an external party (Risk Transfer), and deploying technical endpoint controls lowers the likelihood and impact of threat events (Risk Mitigation). Both examples accurately represent standard risk management definitions.

Step-by-Step Solution

1
Evaluate the definition of Risk Transfer.
Purchasing cyber risk insurance shifts financial risk to an insurer, which directly aligns with Risk Transfer principles.
Risk Transfer involves passing the risk exposure or financial consequence to a third party.
2
Evaluate the definition of Risk Mitigation.
Deploying endpoint security tools reduces the probability and impact of security incidents.
Risk Mitigation applies controls to decrease risk levels to an acceptable threshold.
3
Identify misclassified risk responses and control roles.
Removing a system to eliminate risk is Risk Avoidance, not Acceptance. Additionally, honeypots gather intelligence and do not act as inline filtering firewalls.
Acceptance involves retaining exposure without action, while honeypots are passive deception tools.

Key Concept

Risk Response Strategies and Security Control Functions
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic