5.2 - Risk management strategies
Security+ SY0-701 objective 5.2 covers how organisations treat risk. There are four core strategies. Risk transference shifts the impact to a third party, as when a firm buys cyber-insurance to cover breach losses it cannot fully prevent. Risk mitigation reduces risk with controls, such as installing suppression systems and moving to a hardened site to cut a fire risk. Risk avoidance eliminates the risk entirely, as when a company cancels a too-risky feature rather than build it. Risk acceptance knowingly tolerates a residual risk. You should also know risk assessment, registers, appetite and tolerance, quantitative terms (SLE, ALE, ARO), and recovery metrics - RPO defines the maximum acceptable data loss and RTO the maximum acceptable downtime. Expect scenario questions that describe a decision and ask which risk strategy or metric it represents.
Buy insurance (shift impact) = transference. Add controls to reduce = mitigation. Cancel the risky thing = avoidance. Knowingly tolerate = acceptance. Max data loss = RPO; max downtime = RTO.
Practice questions
1. RPO (Recovery Point Objective) defines:
- How fast you must restore service
- The maximum acceptable data loss (correct answer)
- The total cost of a data breach
- The number of admins kept on call
RPO = how much data (in time) you can afford to lose → drives backup frequency. RTO = how quickly you must restore service after an outage.
2. Buying cyber-insurance to offset the cost of a breach is which risk treatment?
- Risk avoidance
- Risk transference (correct answer)
- Risk acceptance
- Risk exploitation
Insurance transfers financial risk to a third party. Avoid=don't do the activity, mitigate=reduce it, accept=live with it.
3. A leadership team plots risks by likelihood and impact on a color-coded grid to prioritize them. This tool is a:
- A network topology diagram
- A risk matrix (heat map) (correct answer)
- A staff org chart
- A project Gantt chart
A risk matrix/heat map plots likelihood against impact to rank and prioritize risks visually, guiding treatment decisions. It's common in qualitative risk analysis.
4. In quantitative risk analysis, ALE is calculated as:
- Asset value minus exposure
- SLE multiplied by ARO (correct answer)
- Impact divided by likelihood
- Threat times vulnerability
ALE = SLE × ARO. SLE = asset value × exposure factor; ARO = annualized rate of occurrence. ALE estimates yearly expected loss to justify controls.
5. A central document listing identified risks, owners, severity and treatment status is a:
- A business impact analysis
- A risk register (correct answer)
- A service level agreement
- A penetration-test report
A risk register tracks each risk with its owner, likelihood, impact, treatment and status. Appetite/tolerance guide which risks to mitigate, accept or transfer.
6. An analysis that identifies critical processes and the impact of their disruption over time is a:
- An external penetration test
- A business impact analysis (BIA) (correct answer)
- An automated vulnerability scan
- A signed acceptable use policy
A BIA identifies critical functions, dependencies and the impact of downtime, informing RTO/RPO and continuity priorities. MTTR and MTBF describe repair/failure timing.