The e-z-buy application must handle usernames, passwords, and payment information while meeting a stated 99.999% uptime requirement. Which planning response best follows the lesson?

### Why this is right The scenario specifies both sensitive information and a demanding availability requirement. Risk-based planning should consider threats to the data and to the application's continued operation, then select controls and review them over time. ### The concept Confidentiality concerns protection from unauthorized disclosure, while availability concerns access to systems and information when needed. The lesson does not prescribe a single tool for e-z-buy; it asks students to develop a strategy. That strategy should identify assets, assess risks, define policies, implement suitable controls, train staff, and monitor for change. ### The other options - **Focus only on preventing data disclosure because availability is not a security concern**: the scenario explicitly makes availability a requirement, and the course treats protection of availability as part of cybersecurity. - **Install one security tool and assume the application is protected**: security requires a risk-based combination of controls and ongoing review, not an assumption based on one tool. - **Accept every risk because the application is a startup product**: acceptance should be a reasoned treatment decision, not a blanket choice unrelated to impact. ### Terms - **Availability**: the ability of authorized users to access systems or information when needed. - **Uptime**: the time a service is operating and available. ### Remember For an application, plan for both data protection and service availability.