Which of the following is an example of a treatment strategy for a continuous risk?

Question

Options

• AEmail gateway to block phishing attempts
• BBackground checks for new employees
• CDual control requirements for wire transfers
• DBranch protection as part of the CI/CD pipeline

• A
  79% (11)
• C
  14% (2)
• D
  7% (1)

Explanation

An email gateway operates in real-time, around the clock, because phishing attempts arrive continuously - there is no defined start or end to the threat, making it a continuous risk requiring a continuous treatment. Options B, C, and D are all incorrect because they address point-in-time risks: background checks occur once at hiring, dual control activates only when a wire transfer is initiated, and branch protection triggers only during a code merge event - none of these face an unrelenting, always-on threat stream. The key distinction is whether the underlying risk persists at all times or only materializes at discrete moments.

Memory tip: Think "continuous risk = the threat never clocks out." If the control has to run 24/7 to keep up with the threat (like an email gateway filtering every inbound message), it's treating a continuous risk. If the control fires once per event (a background check, a transaction, a commit), the risk is point-in-time.

No community discussion yet for this question.