100-160 Question 199
Select 3Your organization is planning to implement a new cloud-based application. During the planning phase, the cybersecurity team identifies potential risks such as unauthorized data access, system downtime, and compliance violations. As a cybersecurity technician, which steps should you recommend to effectively manage these risks?
- A
Identify and classify assets to determine their criticality
- B
Implement controls to mitigate or reduce identified risks
- C
Accept all risks since they cannot be completely eliminated
- D
Conduct regular risk assessments to evaluate new and existing risks
- E
Transfer all risks to a third-party cloud provider to ensure full protection
Show answer and explanation
Correct answers: A, B, D
Explanation
Effective risk management involves a systematic approach that includes identifying and classifying assets, implementing controls to mitigate risks, and conducting regular risk assessments. While some risks may be transferred or accepted, these actions should be based on careful analysis, and responsibility for cybersecurity cannot be entirely outsourced. These steps collectively help organizations manage and minimize risks to their operations and data.
- A. Correct.
Identifying and classifying assets is a crucial step in understanding what needs protection and prioritizing efforts based on criticality. This is an essential component of risk management.
- B. Correct.
Implementing controls, such as technical, administrative, or physical measures, is necessary to mitigate or reduce the impact of identified risks.
- C. Incorrect.
Accepting all risks is not a best practice in cybersecurity. While some risks may be accepted based on cost-benefit analysis, it is not appropriate to accept all risks indiscriminately.
- D. Correct.
Conducting regular risk assessments ensures that new risks are identified and existing risks are reassessed, which is a critical part of maintaining an effective risk management strategy.
- E. Incorrect.
Transferring risks to a third-party provider, such as a cloud provider, may reduce some risks but does not ensure full protection. Responsibility for risk management cannot be completely outsourced.