Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
B. The Security manager job is to reduce or mitigate risk to a acceptable level so focusing on risk classification aligns perfectly with that. I would choose 'A' before i chose 'C" since CMM allow the re-engineering of processes for efficiency and completeness.
B is the no brainer choice here!
I think it's B. Just think what your job is - are you going to potentially compromise security just because ROI for a certain security tool is not optimal, and disregard the risk and criticality level of an asset?