Examkin

Question

Difficulty: EasyRisk Identification, Assessment, and Response Strategies

An organization is evaluating its risk management procedures to align with standard risk response strategies. Which of the following actions correctly represent valid risk response strategies? (Select TWO.)

  1. Purchasing a commercial cyber insurance policy to cover financial losses resulting from data breaches.Answer
  2. B
    Deploying a deception honeypot to act as an inline security control for filtering malicious incoming traffic.
  3. Decommissioning a vulnerable legacy service entirely to eliminate the risk of remote exploitation.Answer
  4. D
    Calculating Annual Loss Expectancy by adding the Single Loss Expectancy directly to the Annual Rate of Occurrence.

Answer

The actions representing valid risk response strategies are purchasing a cyber insurance policy (risk transference) and decommissioning a vulnerable legacy service (risk avoidance).
Purchasing cyber insurance shifts the financial burden of an attack to an insurance provider, which is the definition of risk transference. Decommissioning a vulnerable legacy application removes the threat vector completely, which is the definition of risk avoidance.

Step-by-Step Solution

1
Identify the standard risk response options
The core risk response options are Risk Acceptance, Risk Avoidance, Risk Mitigation (Reduction), and Risk Transference.
Risk management frameworks categorize response activities into distinct strategies based on how the risk is handled.
2
Evaluate the statement regarding cyber insurance
Purchasing cybersecurity insurance shifts financial loss impacts to an insurer.
Shifting impact or loss liability to a third party is defined as Risk Transference.
3
Evaluate the statement regarding service decommissioning
Discontinuing a legacy service removes the risk entirely.
Altering plans or stopping activities to remove threat vectors entirely is defined as Risk Avoidance.

Key Concept

Risk Response Strategies (Avoidance, Transference, Mitigation, Acceptance)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic