CRISC Question 317

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  D. A decrease in achievement of service level agreements (SLAs). The most relevant observation to escalate to senior management in this scenario would be "D. A decrease in achievement of service level agreements (SLAs)." Given that the web-based service provider has a low risk appetite for system outages, a decrease in achieving service level agreements suggests that the provider's ability to maintain the desired level of service reliability and availability is diminishing. This directly aligns with the risk appetite for low system outages and might indicate potential issues that require senior management attention. While the other observations (increase in attempted DDoS attacks, increase in attempted website phishing attacks, decrease in remediated web security vulnerabilities) are all important and relevant to online security, they might not have as direct an impact on the organization's risk appetite for system outages as a decrease in SLA achievement would.

• Chose D3

  I was thinking of "A" as it is directly mapped to service outage; but I read the question carefully and asked myself what the upper management cares about !. If option "A" was "An increase in SUCCESSFUL attempted distributed denial of service (DDoS) attacks " then it will be "A" but everyday many organizations are subjected to hundreds of (failed) DDOS attempts. The management cares about their customers satisfaction and they need the service uptime to be 99%+. Failure to achieve SLA would have the great concern to the management (reputation risk, customers will be looking for alternative organization, etc.)

• Chose A1

  A as it shows the threats are increasing