Questão 21 — CompTIA SY0-701 CompTIA Security+ Certification Exam
An organization is conducting a risk assessment as part of its security program management process. During the assessment, the team identifies a critical vulnerability in a legacy application, but patching would require extensive testing and a maintenance window that impacts production services. The team decides to implement network segmentation and access controls instead of immediately patching. Which risk management strategy does this represent?
- A. Risk avoidance, because the organization is preventing all use of the vulnerable system.
- B. Risk mitigation, because the organization is implementing controls to reduce the likelihood or impact of the vulnerability being exploited.
- C. Risk acceptance, because the organization has decided not to patch and is living with the vulnerability.
- D. Risk transference, because the organization is delegating security responsibility to its network team.
Resposta correta:
B
Explicação
Explanation: Correct answer: B. Risk mitigation, because the organization is implementing controls to reduce the likelihood or impact of the vulnerability being exploited. Risk mitigation involves implementing safeguards and controls to reduce either the likelihood or impact of a threat. By implementing network segmentation and access controls, the organization reduces the likelihood that the vulnerability can be exploited even though the vulnerable code still exists. This is a common and practical risk management approach when immediate remediation is not feasible. Risk avoidance would mean discontinuing use entirely (option A). Risk acceptance would mean taking no action and consciously accepting the risk (option C). Risk transference involves shifting risk to another party, such as through insurance or outsourcing (option D).
Quer todas as 907 questões por R$ 1,00?