Study. uk . com
  1. Home
  2. All questions
  3. Question 576

CompTIA Security+ study material · question 576 of 611

An organisation has taken no explicit decision about a vulnerability it does not yet know exists. Which risk response is it implicitly taking?

  1. Accept
  2. Mitigate
  3. Avoid
  4. Transfer
Show the answer

Answer: A. Accept

By default an organisation accepts the risk of the software it runs, which is why zero-day exposure is always present.

Source: NIST SP 800-40 Rev. 4 (NIST) — SP 800-40 Rev. 4 § 2.1 Risk Responses

Challenge yourself on this topic → Study as cards