CISM Question 84

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  The key word is: FIRST In CISM, FIRST usually means: Assess, evaluate, identify, or understand before acting. So we should be suspicious of answers that immediately implement, notify, or escalate before risk is understood.

• Chose C1

  Before taking any action, the information security manager needs to understand the nature and severity of the vulnerability. A risk assessment determines: How severe the vulnerability actually is, Whether it is being actively exploited, What systems and data are exposed, The likelihood and potential impact of an attack, What response is proportionate and justified. Without this information first, any action taken whether implementing controls, notifying management or conducting a BIA would be uninformed and potentially disproportionate. The risk assessment provides the evidence base for every subsequent decision.

• Chose A1

  I have tried to convey this to a cyber security class that I have attended recently when dealing with vulnerability measures. The definition between mitigation and remediation will apply. Mitigation is reducing the risk of that vulnerability, but not necessarily completely take out the vulnerability like what remediation would do. In this scenario, mitigation is the right answer.