CAS-003 · Question #398
In the past, the risk committee at Company A has shown an aversion to even minimal amounts of risk acceptance. A security engineer is preparing recommendations regarding the risk of a proposed…
The correct answer is B. Mitigate. The critical context is the risk committee's established aversion to accepting even minimal risk. Although 'Accept' (D) might seem logical given the vulnerability is minor and expensive to mitigate, the committee's track record makes risk acceptance unlikely to be approved…
Question
In the past, the risk committee at Company A has shown an aversion to even minimal amounts of risk acceptance. A security engineer is preparing recommendations regarding the risk of a proposed introducing legacy ICS equipment. The project will introduce a minor vulnerability into the enterprise. This vulnerability does not significantly expose the enterprise to risk and would be expensive against. Which of the following strategies should the engineer recommended be approved FIRST?
Options
- AAvoid
- BMitigate
- CTransfer
- DAccept
How the community answered
(29 responses)- A21% (6)
- B66% (19)
- C3% (1)
- D10% (3)
Explanation
The critical context is the risk committee's established aversion to accepting even minimal risk. Although 'Accept' (D) might seem logical given the vulnerability is minor and expensive to mitigate, the committee's track record makes risk acceptance unlikely to be approved. 'Avoid' is not feasible since the project is already proposed. 'Transfer' (insurance/third party) is possible but doesn't address the technical vulnerability. 'Mitigate' (B) is the strategy that reduces the vulnerability to a level the committee can tolerate without outright accepting the risk - making it the most likely to gain approval from a risk-averse committee. The question asks what would be approved FIRST, not what is technically optimal.
Topics
Community Discussion
No community discussion yet for this question.