ITPEC IP October 2023 Question 59

Take the necessary countermeasures, weighing anticipated losses against their cost — proactive measures are chosen by risk: how much damage a threat could cause versus how much protection costs.

No countermeasure removes every threat, and budgets are limited. Risk assessment estimates each threat's likelihood and impact, the anticipated loss; a countermeasure is adopted where the loss it prevents justifies its cost, and the remaining risk is accepted or transferred, for example by insurance. Spending more than the loss prevented is waste; ignoring a large loss to save money is negligence.

Answer (d)

Why not others:

• •(a) — complete prevention of intrusion from outside is not realistic, and threats also come from inside (insiders, lost devices, operating mistakes), so internal controls and detection are still needed
• •(b) — natural disasters are hard to predict but can be prepared for: earthquake-resistant facilities, UPS, remote backup sites, a continuity plan
• •(c) — a backup only helps recovery after data is lost; it does not prevent intrusion, leakage or downtime

Key rule: Security countermeasures are an investment decision: prioritize threats by likelihood and impact, spend where the loss avoided exceeds the cost, and combine several layers rather than rely on one.

Security · AI-written, may contain errors