Isaca Certified in Risk and Information Systems Control CRISC Question # 339 Topic 34 Discussion
CRISC Exam Topic 34 Question 339 Discussion:
Question #: 339
Topic #: 34
One of an organization's key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk practitioner's BEST recommendation?
A.
Additional mitigating controls should be identified.
B.
The system should not be used until the application is changed
C.
The organization's IT risk appetite should be adjusted.
D.
The associated IT risk should be accepted by management.
The risk practitioner’s best recommendation when one of an organization’s key IT systems cannot be patched because the patches interfere with critical business application functionalities is to identify additional mitigating controls, as they may reduce the likelihood or impact of the vulnerabilities being exploited, and align the residual risk with the risk tolerance and appetite of the organization. The other options are not the best recommendations, as they may not address the risk adequately, or may introduce unacceptable consequences, such as disrupting the businessoperations, changing the risk strategy, or accepting excessive risk. References = CRISC Review Manual, 7th Edition, page 111.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit