CAS-001 · Question #237
A security incident happens three times a year on a company's web server costing the company $1,500 in downtime, per occurrence. The web server is only for archival access and is scheduled to be…
The correct answer is D. Mitigate the risk. This question requires a straightforward cost-benefit calculation. The annualized loss from the incident is 3 occurrences × $1,500 = $4,500/year. Over the 5-year remaining life of the server, the total expected loss is $22,500. The cost to mitigate is $15,000 (initial) +…
Question
A security incident happens three times a year on a company's web server costing the company $1,500 in downtime, per occurrence. The web server is only for archival access and is scheduled to be decommissioned in five years. The cost of implementing software to prevent this incident would be $15,000 initially, plus $1,000 a year for maintenance. Which of the following is the MOST cost- effective manner to deal with this risk?
Options
- AAvoid the risk
- BTransfer the risk
- CAccept the risk
- DMitigate the risk
How the community answered
(30 responses)- A7% (2)
- B27% (8)
- C13% (4)
- D53% (16)
Explanation
This question requires a straightforward cost-benefit calculation. The annualized loss from the incident is 3 occurrences × $1,500 = $4,500/year. Over the 5-year remaining life of the server, the total expected loss is $22,500. The cost to mitigate is $15,000 (initial) + $1,000/year × 5 years = $20,000 total. Mitigation costs $20,000 and prevents $22,500 in losses, yielding a net savings of $2,500 - making it the most cost-effective choice. Accepting the risk (C) costs $2,500 more over the life of the server. Avoiding the risk (A) would mean decommissioning the server now, which the scenario does not support. Transferring the risk (B) via insurance would involve ongoing premiums and is not necessarily cheaper than direct mitigation here.
Topics
Community Discussion
No community discussion yet for this question.