Examkin

Soru

Zorluk: OrtaRisk Identification, Assessment, and Response Strategies

An enterprise logistics company maintains a legacy asset-tracking application running on an unpatchable operating system. Completely replacing the application would cost $1.5 million and cause severe operational downtime. To address the threat of potential exploitation, the security team deploys an inline intrusion prevention system (IPS) and isolates the host within a dedicated virtual local area network (VLAN) guarded by strict firewall rules. Which of the following risk response strategies did the organization execute?

  1. Risk mitigationCevap
  2. B
    Risk avoidance
  3. C
    Risk transfer
  4. D
    Risk acceptance

Cevap

Risk mitigation
Risk mitigation (also known as risk reduction) involves implementing administrative, physical, or technical security controls to diminish the likelihood or impact of a risk. Installing an intrusion prevention system (IPS) and configuring network microsegmentation actively reduce the probability of exploitation without discontinuing the legacy server.

Adım Adım Çözüm

1
Analyze the scenario requirements and operational context
The organization cannot retire the system (avoidance) or accept the unmitigated vulnerability (acceptance), but needs to continue using the application safely.
Identifying business constraints clarifies why simple removal or passive tolerance is insufficient.
2
Evaluate the specific controls implemented by the security team
Deploying an inline IPS and configuring network isolation reduce threat likelihood and limit attack blast radius.
Technical controls that reduce vulnerability likelihood or impact fall under risk reduction/mitigation.
3
Match the implemented action to the formal risk response definition
Applying technical safeguards to decrease residual risk constitutes risk mitigation.
Risk mitigation actively lowers risk metrics without transferring liability or terminating the underlying process.

Anahtar Kavram

Risk Response Strategies
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Risk Identification, Assessment, and Response Strategies

Bu konudan daha fazla soru