ITPEC IP October 2023 Question 59

Proactive countermeasures should be selected by balancing expected losses against the cost and effectiveness of controls. Risk cannot normally be reduced to zero with unlimited spending, so the organization evaluates likelihood, impact, treatment cost, and residual risk and implements measures that are justified by its risk appetite and business needs.

Answer (d)

Why not others:
- (a) external intrusion controls alone do not address insiders, mistakes, malware, or other access paths
- (b) natural disasters still require preparation such as redundancy and continuity planning even if their timing is uncertain
- (c) backups support recovery but do not replace prevention, detection, availability, or security controls

Key rule: Use layered, risk-based controls; no single control is sufficient for all threats.

AI-generated — may contain errors