Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The core problem here isn't a lack of monitoring or a strategic misalignment — it's that the incident response team took actions outside the boundaries of what they were authorized to do.
Anwer is A The core issue is unapproved actions during incident response that put business objectives at risk. This is a governance and authority problem, not a technical or monitoring failure. Updating clearly defined roles, responsibilities, and authorities: Establishes who is authorized to make which decisions Defines decision thresholds and approval requirements Aligns incident actions with business objectives and risk appetite Prevents recurrence at the root cause level CISM principle: When actions exceed authority, fix governance — not tooling or oversight.
If the incident response team took unapproved actions during an incident, it indicates a gap in understanding or following established escalation procedures. Training the team on proper escalation protocols ensures they know when to escalate decisions or actions to management rather than acting independently.