A Security Analyst Is Providing a Risk Assessment for a Medical

question 90

Multiple Choice

A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk-based policy decision to review and enforce the vendor upgrade before the end of life is reached. Which of the following risk actions has the security committee taken?

• A) Risk exception
• B) Risk avoidance
• C) Risk tolerance
• D) Risk acceptance

---

Definitions:

Implicit Cost

The opportunity cost equal to what a firm must give up in order to use resources it owns, without paying rent or borrowing costs.

Free Entry

A market condition where new participants can enter the industry freely without facing prohibitive barriers to entry.

Zero Profits

A situation in which a company's revenues exactly equal its expenses, resulting in no net income or loss.

Price

The monetary value estimated, obligatory, or presented in compensation for an object.