Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A financial services firm is implementing a new customer portal. The risk assessment identified a high-severity vulnerability in a legacy authentication module that cannot be patched before the scheduled release. The business requires the portal to launch on time to meet a regulatory deadline. The security team must decide how to handle this risk. Which approach best aligns with the firm's constraints?

   • AMitigate the risk by deploying a compensating control, such as an additional multi-factor authentication layer, while planning a permanent fix.
   • BAccept the risk and document it as residual, since the deadline is fixed.
   • CTransfer the risk by purchasing cyber insurance to cover potential losses from a breach.
   • DAvoid the risk by removing the authentication module entirely from the portal.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is developing a medical device software. The risk assessment identifies a risk of patient injury due to software malfunction. The company wants to reduce its financial liability while also ensuring patient safety. Which strategy best addresses both concerns?

   • ATransfer by purchasing product liability insurance.
   • BMitigate by implementing rigorous testing and safety mechanisms.
   • CAvoid by not releasing the product.
   • DAccept the risk and document it.
   Reveal Solution Discussion Select an answer first