CISA Question 294

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  Missing periodic threat and vulnerability assessments means the organization is operating without any awareness of any risk existence

• Chose A1

  n an Information Security Management environment, the MOST critical issue is the absence of formal governance authority and structure. An official security charter defines: authority of the security function scope and responsibilities reporting lines (often to senior management/board) mandate to enforce security policies organizational accountability Without it, the security function lacks legitimacy and enforcement power.

• Chose A2

  Would vote A