Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

An enterprise logistics company maintains a legacy asset-tracking application running on an unpatchable operating system. Completely replacing the application would cost $1.5 million and cause severe operational downtime. To address the threat of potential exploitation, the security team deploys an inline intrusion prevention system (IPS) and isolates the host within a dedicated virtual local area network (VLAN) guarded by strict firewall rules. Which of the following risk response strategies did the organization execute?

  1. Risk mitigationAnswer
  2. B
    Risk avoidance
  3. C
    Risk transfer
  4. D
    Risk acceptance

Answer

Risk mitigation
Risk mitigation (also known as risk reduction) involves implementing administrative, physical, or technical security controls to diminish the likelihood or impact of a risk. Installing an intrusion prevention system (IPS) and configuring network microsegmentation actively reduce the probability of exploitation without discontinuing the legacy server.

Step-by-Step Solution

1
Analyze the scenario requirements and operational context
The organization cannot retire the system (avoidance) or accept the unmitigated vulnerability (acceptance), but needs to continue using the application safely.
Identifying business constraints clarifies why simple removal or passive tolerance is insufficient.
2
Evaluate the specific controls implemented by the security team
Deploying an inline IPS and configuring network isolation reduce threat likelihood and limit attack blast radius.
Technical controls that reduce vulnerability likelihood or impact fall under risk reduction/mitigation.
3
Match the implemented action to the formal risk response definition
Applying technical safeguards to decrease residual risk constitutes risk mitigation.
Risk mitigation actively lowers risk metrics without transferring liability or terminating the underlying process.

Key Concept

Risk Response Strategies
Estimated Time:1m 15s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic