Exam CS0-002 topic 1 question 70 discussion

It's obviously they will respond, but they want to validate the trend over the time, so continuous monitoring can provide this.

For me it's planning. He identified the risks that it plan how to response to each one, that implement the response, finally he monitored the result and the new risk restarting the cycle.

The key is "Which of the following will provide a trend of risk mitigation" How do you find trends? Continuous Monitoring will allow you to see trends and mitigate adverse trends etc...

The key word here is “ trend of risk mitigation”.. at first my answer was C but when I searched about the meaning of the word I switched it to B. A trend of risk mitigation refers to the ability to track and monitor the effectiveness of risk mitigation efforts over time. It involves continuously assessing the effectiveness of implemented security controls and risk management strategies to determine if they are reducing the organization's exposure to risk.

Risk response involves taking specific actions to reduce, transfer, or mitigate the risks that have been identified through the risk assessment process.

the question states that the risks have already been identified through the risk assessment review, then the option that will provide a trend of risk mitigation would be C. Risk response.

Per the CompTIA CySA+ CS0-002 textbook: Topic 7A - Speaking on the risk identification process-- "Respond—'Mitigate' each risk factor through the deployment of managerial, operational, and technical security controls. Key word in the question is mitigation. This clearly means the answer is C

Answer B - Risk response (option C) is focused on addressing risks that have been identified, but it does not provide a trend of risk mitigation.

It's the mitigation thing that's critical here. Monitoring isn't mitigating

Just monitoring without taking action is useless. Easy question, i going with C.

Which of the following will provide a trend of risk mitigation? For me this has to be C. He has carried out the risk assesment and identified issues, surely the next stage is risk response... Though i understand people who are saying B, i think some of you (respectfully) are getting too caught up on the term 'trend' and tying that to continuous monitoring

Risk response is an important part of the risk management process and involves implementing measures to mitigate or transfer the risks identified during the risk analysis. However, risk response alone does not provide a trend of risk mitigation, as it only addresses the risks that have been identified in a specific point in time. Continuous monitoring, on the other hand, involves ongoing assessment of the organization's security posture and the identification of new risks. By regularly monitoring the organization's security, the CISO can identify trends in risk mitigation and make adjustments to the risk management plan as needed. This provides a more comprehensive view of the organization's risk landscape and the effectiveness of the risk mitigation measures in place.

This is close, however I'd need to opt for C as to pull trend analysis data, I need to see the how and the why of mitigation over a period of time. Response actions would give me that better than continuous monitoring. See this article, points 5 and 6 are so close - https://securityscorecard.com/blog/6-strategies-for-cybersecurity-risk-mitigation

chat GBT says B

The best option that will provide a trend of risk mitigation is B. Continuous monitoring. Continuous monitoring is the ongoing process of assessing the security controls in an organization to identify vulnerabilities, threats, and risks. It also involves analyzing the results of security testing, incident response, and other security-related activities to identify trends and patterns that can be used to improve the security of the organization. By continuously monitoring the organization, the Chief Information Security Officer can identify and address new and emerging risks, which will help to reduce the overall risk to the organization.

After risk assessment review --->comes Risk response

risk mitigation is an attempt to minimize the chances of a potential attack...thus Risk Response..C is correct