Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Including the impact of the risk as part of regular metrics allows senior management to receive ongoing, systematic information about the state of vulnerabilities in user workstations. By incorporating this information into regular metrics, senior management can better understand the potential consequences of unpatched software and make informed decisions about prioritizing and allocating resources to address the identified risk. While options like sending regular notifications directly to senior managers (option B), recommending the security steering committee conduct a review (option C), and updating the risk assessment at regular intervals (option D) may also be valuable actions, incorporating the impact into regular metrics provides a consistent and integrated approach to communicating the risk over time.
A. Include the impact of the risk as part of regular metrics.
The correct Answer is A B - Sending an alert doesn't help anyone understand the impact C - Sending recommendation without showing impact doesn't help anyone to understand the impact D - Updating the risk assessments in intervals doesn't show the overall impact. Risk is all about the impact and probability. The only one that addresses this is A