SY0-301 · Question #215
A security administrator plans on replacing a critical business application in five years. Recently, there was a security flaw discovered in the application that will cause the IT department to…
The correct answer is D. Accept the risk and continue to enable the accounts each month saving money. This is a cost-benefit risk analysis. Accepting the risk and continuing the manual monthly process costs $2,000/month × 60 months (5 years) = $120,000 total. Patching immediately costs $140,000 upfront - $20,000 more expensive - and takes two months to implement, after which…
Question
A security administrator plans on replacing a critical business application in five years. Recently, there was a security flaw discovered in the application that will cause the IT department to manually re-enable user accounts each month at a cost of $2,000. Patching the application today would cost $140,000 and take two months to implement. Which of the following should the security administrator do in regards to the application?
Options
- AAvoid the risk to the user base allowing them to re-enable their own accounts
- BMitigate the risk by patching the application to increase security and saving money
- CTransfer the risk replacing the application now instead of in five years
- DAccept the risk and continue to enable the accounts each month saving money
How the community answered
(42 responses)- A17% (7)
- B7% (3)
- C31% (13)
- D45% (19)
Explanation
This is a cost-benefit risk analysis. Accepting the risk and continuing the manual monthly process costs $2,000/month × 60 months (5 years) = $120,000 total. Patching immediately costs $140,000 upfront - $20,000 more expensive - and takes two months to implement, after which the app will still be replaced in roughly five years. Since the ongoing cost ($120,000) is less than the remediation cost ($140,000), the financially sound decision is to accept the risk and budget the monthly workaround. Avoiding risk (Option A) would mean eliminating the source, not just workarounds. Mitigating (Option B) by patching is more expensive here. Transferring (Option C) would mean shifting the liability to a third party, such as insurance or a vendor.
Topics
Community Discussion
No community discussion yet for this question.