CS0-003 · Question #355
Chief Information Security Officer (CISO) wants to disable a functionality on a business-critical web application that is vulnerable to RCE in order to maintain the minimum risk level with minimal…
The correct answer is B. Mitigate. The CISO is looking to reduce the risk associated with a vulnerable web application functionality by disabling it, which is an action to mitigate the risk without completely eliminating the application.
Question
Chief Information Security Officer (CISO) wants to disable a functionality on a business-critical web application that is vulnerable to RCE in order to maintain the minimum risk level with minimal increased cost. Which of the following risk treatments best describes what the CISO is looking for?
Options
- ATransfer
- BMitigate
- CAccept
- DAvoid
How the community answered
(28 responses)- A4% (1)
- B79% (22)
- C4% (1)
- D14% (4)
Why each option
The CISO is looking to reduce the risk associated with a vulnerable web application functionality by disabling it, which is an action to mitigate the risk without completely eliminating the application.
Risk transfer involves shifting the risk to another party, typically through insurance or outsourcing, which is not what disabling a functionality achieves.
Mitigation involves taking steps to reduce the likelihood or impact of a risk. Disabling a vulnerable functionality is a direct action to reduce the exploitability (likelihood) or the potential damage (impact) of an RCE vulnerability, aligning with maintaining minimum risk with minimal cost.
Risk acceptance means acknowledging the risk and deciding not to take any action, which contradicts the CISO's goal of maintaining minimum risk by taking action.
Risk avoidance involves eliminating the risk entirely, often by discontinuing the activity or not implementing the system, which is more drastic than merely disabling a functionality on a business-critical application.
Concept tested: Risk treatment strategies (mitigation)
Source: https://learn.microsoft.com/en-us/compliance/regulatory/risk-management-process-overview
Topics
Community Discussion
No community discussion yet for this question.