After identifying phishing risk to municipal email, which set names the basic risk responses the city can choose?
Select an answer to reveal the explanation.
Short Explanation
Once the city sees phishing risk, it has four doors: live with it, lock it down, buy a policy, or stop using the risky mail feature. MFA, awareness, and ES detections are the mitigate door—not a cluster rebuild and not writing Python.
Full Explanation
After identifying phishing risk to municipal email, the basic risk responses the city can choose are accept the risk, mitigate it with controls, transfer it, or avoid the risky activity. Those four doors—live with it, lock it down, insure/shift it, or stop the activity—are the classic risk-response set. Civic email programs typically mitigate with MFA, awareness, and ES detections rather than pretending cluster resize is a risk response.
Escalating every phishing notable to the city attorney and taking no other action fails by concept: escalation alone is not the closed set of risk responses. Resizing the Splunk indexer cluster or replacing the license master fails by concept: platform sizing is operations, not a risk-response category for phishing. Authoring a custom SOAR Python playbook as the only permitted response fails by concept: automation can support mitigation but is not the exclusive named response set.
Exam caveat: Memorize accept / mitigate / transfer / avoid as the basic risk responses; do not substitute SIEM admin tasks for that vocabulary.
Operational check: For municipal phishing risk, document which controls mitigate (MFA, filtering, ES detections), what residual is accepted, whether cyber insurance transfers some residual, and whether any high-risk mail feature should be avoided.