A city risk team scopes ransomware exposure only to one forgotten departmental Access database. Critical 911 and utility billing applications are left out. What coverage problem does that create?
Select an answer to reveal the explanation.
Short Explanation
Scoping ransomware to one dusty Access file is like locking the garden shed while leaving the city hall doors wide open. The forgotten database might matter, but the real blast radius sits on 911 and billing. Tiny scopes create silent gaps that look tidy on paper and fail in an incident.
Full Explanation
Under-scoping ransomware exposure to one forgotten departmental Access database hides risk on critical civic applications such as 911 and utility billing while giving a false sense that the threat is contained. Entity scoping for a risk must include populations where impact is material; tiny tidy scopes fail in incidents. Assessments, indicators, and responses never attach to systems leadership assumes are covered when those systems were never in scope. Effective scoping starts from critical services and expands with evidence, not from the easiest orphan record. Saying risk statements may only attach to databases so applications cannot be entities invents a false technical limitation. Preferring under-scoping because Advanced Risk automatically invents missing entities at assessment time relies on magic that does not replace deliberate scope. Excluding public-safety systems from ransomware entity scope to avoid operational disruption leaves the highest-impact targets ungoverned. Exam caveat: under-scoping critical services is as dangerous as over-scoping noise. Operational check for the city risk team: list crown-jewel applications for ransomware impact, ensure they exist as entities, attach the ransomware risk statement as scoped risks, and retire the Access-only scope as the sole coverage story.