ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  The key phrase is "timely Response", SLAs are formal contracts that define the level of service expected from a cloud provider. Crucially, they specify response times and resolution times for various incidents, including security events, outages, and performance issues. Without clear SLAs, an organization has no contractual leverage to demand prompt action from their cloud provider when a risk or incident arises.

• 1

  both answers B and C are correct to me. Here is why: Question asks about risk monitoring: this can be achieved through continuous audit mechanisms of vendor systems by technical measures. Therefore, answer C is correct. However, the question also asks about a timely response, indicating that answer B is correct as well. Conclusion: question is not fairly stated.

• 1

  What is the 'continuous audit mechanism' referring to please? When addressing the need for timely responses, an SLA might have metrics on RTO, RPO, maximum tolerable downtime in mind. Likely there could be monthly or more frequent reporting cycles, even immediate. In reality how often would audits occur; once, perhaps twice per year. These can address a point in time when risk monitoring can be reviewed but it would be SLA that would give the most timely insight.