CISM Question 245

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Role-based enablement is a reasonable implementation mechanism for how an exception might be technically applied, but it doesn't by itself justify why the exception should be granted in the first place.

• 1

  Any exception to a security policy should be grounded in a proper risk-based justification: a documented determination that the business benefit gained from the exception genuinely outweighs the residual risk it introduces.

• Chose C2

  Its C. CISM is not so vague to say benefit what does that even mean benefit? to define an exception policy for justification you need to define roles through rbac