SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the…

Question

Options

• AAn approach that allows for minimum budget impact if the solution is unsuitable
• BA methodology-based approach to ensure authentication mechanism functions
• CAn approach providing minimum time impact to the implementation schedules
• DA risk-based approach to determine if the solution is suitable for investment

• A
  4% (2)
• B
  17% (9)
• C
  7% (4)
• D
  72% (39)

Explanation

Option D is correct because the CISO is responding to uncertainty about a critical security investment by ordering a proof of concept (PoC) - a classic risk-based decision: identify the risk (scalability failure), validate before committing further resources, and determine whether the solution is worth the investment. This is the textbook definition of risk management applied to technology procurement.

Why the distractors are wrong:

• A is wrong because the scenario does not describe minimizing budget impact - the PoC itself costs money, and no cost-containment strategy is described.
• B is wrong because a "methodology-based approach to ensure authentication functions" would focus on testing whether the authentication mechanism works, not whether it scales - the concern here is suitability, not functionality.
• C is wrong because a PoC actually delays the implementation schedule; the scenario even mentions implementation teams are ready and waiting, making time impact a negative, not a neutral or minimized factor.

Memory tip: When you see a CISO pausing to validate a solution before committing (PoC, pilot, testing phase) due to uncertainty or concern, that's always a risk-based approach - the key phrase is "determine if the solution is suitable for investment." Risk-based = evaluate before you commit.

No community discussion yet for this question.