Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Nowhere in the question does it state the app owner understands the criticality of the patch. If you've been in this situation before, you know many times an app owner is only concerned about uptime and availability. you (as an ISM) are going to have to explain to the app owner why the vulnerabilities you are patching are critical to mitigate and get their agreement on the upgrade process. you already know what the mitigation option is-- install the patch. the issue is, you have to convince the app owner why you need to install the patch. so C it is.
THE APPLICATION OWNER IS AT THE POSITION TO UNDERSTAND THE IMPACT, SO NOW RISK MITIGATION IS THE ONLY OPTION
where does it say they understand? it just says they said no to prevent an outage. they don't understand the impact from a security perspective.