Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

A security analyst is reviewing the risk register for an organization's legacy operational technology (OT) environment. Due to vendor constraints, the OT systems cannot be updated with recent security patches, leaving them vulnerable to remote code execution exploits. To address this risk without disrupting active business operations or decommissioning the equipment, which of the following response strategies and control implementations should the analyst recommend? (Select TWO.)

  1. Implement network microsegmentation and strict access control lists around the legacy OT network segment to lessen the likelihood of exploitation.Answer
  2. Acquire a specialized cyber liability insurance policy to cover potential financial losses resulting from operational downtime.Answer
  3. C
    Deploy inline deception honeypots directly within the active OT network path to filter and block unauthorized exploitation traffic.
  4. D
    Classify the deployment of compensating network security controls as complete risk avoidance in the organization's risk register.

Answer

The analyst should recommend implementing network microsegmentation (risk mitigation) and acquiring a cyber liability insurance policy (risk transference).
Implementing network microsegmentation reduces attack vector surface area and limits exploitation likelihood, serving as a compensating control for risk mitigation. Purchasing cyber insurance transfers the residual financial burden of a potential incident to a third-party insurer (risk transference). Both actions satisfy the requirement to manage risk without pulling legacy OT equipment offline.

Step-by-Step Solution

1
Analyze the operational constraints and risk requirements
The systems cannot be patched or decommissioned (ruling out risk avoidance by removal), meaning risk must be managed through controls or financial shifting.
Risk identification requires understanding business limits before selecting appropriate risk response strategies.
2
Evaluate technical safeguard options for reducing risk likelihood
Network microsegmentation isolates vulnerable systems, lowering the likelihood of attack propagation without requiring system modification.
Applying compensating security controls to decrease exposure is the definition of risk mitigation.
3
Evaluate residual financial risk handling
Cyber insurance policies absorb residual monetary consequences caused by operational disruptions.
Shifting financial impact to a third party fulfills the criteria for risk transference.

Key Concept

Risk Response Strategies (Mitigation and Transference)
Estimated Time:1m 30s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic