ITPEC IP October 2018 Question 59

Proactive countermeasures should be selected by balancing anticipated losses against the cost of the controls. Risk assessment considers likelihood and impact, then supports controls that reduce risk to an acceptable level cost-effectively rather than assuming every threat can be eliminated.

Answer (d)

Why not others:
- unauthorized access may also originate internally and no prevention is absolute
- natural disasters still require continuity and recovery preparation
- backups address data recovery but not every confidentiality, integrity, or availability risk

Key rule: Apply proportionate controls based on risk and cost; defense in depth is needed because a single control cannot address every threat.

AI-generated — may contain errors