Question 45

Mitigation describes applying a compensating control to a device rather than patching.

Mitigation is the strategy that involves implementing compensating controls to reduce risk when a direct solution, such as patching, is not immediately feasible.

A) Acceptance

Acceptance refers to recognizing the risk and deciding to proceed without any changes, essentially acknowledging that the risk is tolerable. This does not involve implementing any controls, making it an incorrect choice for the scenario described.

B) Mitigation

Mitigation involves taking steps to reduce the impact or likelihood of a risk, which can include applying compensating controls in lieu of patching. This aligns perfectly with the scenario described in the question, making it the correct answer.

C) Avoidance

Avoidance involves eliminating the risk entirely by discontinuing the processes or activities that generate the risk. This strategy does not apply in the context of applying a compensating control, thus rendering it incorrect.

D) Transference

Transference involves shifting the risk to another party, such as through insurance or outsourcing. This strategy does not relate to the application of controls on a device, making it an incorrect choice in this context.

Conclusion

Mitigation is the most appropriate strategy when addressing risks that cannot be immediately patched, as it focuses on implementing alternative controls to manage risk effectively. All other options either do not apply to the context of compensating controls or represent different approaches to risk management, thereby confirming that Mitigation is the correct answer.