Examkin

Question

Difficulty: MediumMethods of Handling Risk

A software development firm is concerned about the growing financial threat of cyberattacks. Rather than shutting down their cloud-based application services, the company mandates multi-factor authentication (MFA) for all users and installs advanced firewall systems. Additionally, the firm decides it will pay for any data breach expenses under $10,000 directly from its operating budget.

Which of the following best describes the specific risk handling method demonstrated by mandating MFA and installing advanced firewalls?

  1. Risk reductionAnswer
  2. B
    Risk avoidance
  3. C
    Risk retention
  4. D
    Risk transfer

Answer

Risk reduction
The correct answer is risk reduction because the company is actively implementing physical and procedural safeguards (MFA and firewalls) to lower the probability and severity of a loss. They are still engaging in the risk-producing activity (offering cloud services), but they are taking active steps to control and minimize the associated exposures.

Step-by-Step Solution

1
Identify the specific actions isolated by the question stem.
The question specifically asks about the act of 'mandating MFA and installing advanced firewalls'.
Different actions in a single scenario can represent different risk handling methods. Focusing on the exact action queried is critical.
2
Determine the purpose and effect of those specific actions.
These actions do not eliminate the risk, nor do they pay for the risk; rather, they lower the probability and severity of a successful cyberattack.
Understanding the practical effect of the action allows it to be categorized into one of the STARR methods.
3
Match the action's effect to the correct fundamental risk handling method.
Taking steps to minimize the chance or impact of a loss without entirely avoiding the activity is defined as risk reduction (also known as loss control).
This confirms the correct classification among Sharing, Transfer, Avoidance, Reduction, and Retention.

Key Concept

Methods of Handling Risk (Reduction)
Rate this question

Topics

Methods of Handling Risk

More questions from this topic