MENU
Of the following, who is accountable for data loss in the event of an information security incident at a third-party provider?
Suggested Answer: A
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.
https://simplicable.com/risk/risk-treatment
https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/
https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.
35 comments · newest first
DE
Detra
10 months ago
It's all about the service provider, no doubt about it!
DA
Darell
11 months ago
The information security manager should oversee everything, but not solely accountable.
JE
Jesus
11 months ago
Wait, how can the incident response team be accountable? That seems off.
LU
Luz
11 months ago
I think the business data owner should take some responsibility too.
RH
Rhea
11 months ago
Definitely the service provider that hosts the data.
DE
Devora
12 months ago
This is tricky! I recall similar questions where it was emphasized that the service provider holds a lot of responsibility, but what about the data owner?
GE
Gertude
12 months ago
I feel like the information security manager has some oversight, but ultimately it might come down to the business data owner.
AV
Avery
12 months ago
I remember a practice question where the incident response team was mentioned, but I don't think they are directly accountable for data loss.
CA
Carmelina
1 year ago
I think the service provider that hosts the data is usually accountable, but I'm not entirely sure if the business data owner has some responsibility too.
DE
Denna
1 year ago
I'm a bit confused on this. Is it the information security manager or the business data owner who is accountable? I'll need to weigh the options carefully.
ST
Stephaine
1 year ago
I'm confident I know the answer to this one. The service provider is responsible for the data, even if it's a third-party.
CH
Christiane
1 year ago
Okay, I think I've got this. The key is to identify who is ultimately accountable for the data, regardless of where it's hosted.
CA
Cathern
1 year ago
Hmm, I'm not entirely sure about this. I'll need to review my notes on information security incident response procedures.
WA
Wava
1 year ago
This seems like a tricky one. I'll need to think carefully about the responsibilities of each party involved.
ST
Stefania
1 year ago
Hmm, I'm a bit unsure about this one. I know black-box testing is about focusing on the program's external behavior rather than its internal workings, but I'm not totally sure which of these options best captures that. I'll have to think it through carefully.
HE
Hester
1 year ago
Hmm, this seems like a tricky one. I'm not entirely sure about the details of how Cisco SD-WAN redundancy works, but I'll give it my best shot and try to eliminate the incorrect options.
MI
Micaela
1 year ago
I don't know, man. I'm just hoping the correct answer isn't 'all of the above'. That would be a real plot twist, am I right?
MA
Maybelle
1 year ago
Hmm, I'm gonna have to go with the business data owner on this one. After all, they're the ones who decided to outsource their data, so they should be prepared to deal with the consequences.
JU
Juliann
1 year ago
The information security manager is the one who's supposed to be overseeing all this, so they should be the ones held accountable. No one else is gonna take the fall for their mistakes.
WI
Wilbert
1 year ago
The business data owner might also share some responsibility in ensuring data protection.
DE
Demetra
1 year ago
I agree, they are responsible for overseeing data security.
AI
Aide
1 year ago
The information security manager should definitely be held accountable.
SH
Sherman
1 year ago
I'm going with the incident response team on this one. They're the ones who are supposed to handle security incidents, so they should be the ones responsible.
MA
Marshall
1 year ago
Nah, it's definitely the service provider's responsibility. They're the ones hosting the data, so they should be the ones held accountable.
AL
Alexia
1 year ago
C) The incident response team
WI
Wilda
1 year ago
B) The service provider that hosts the data
AL
Aleisha
1 year ago
A) The information security manager
TE
Tequila
1 year ago
I think the business data owner should be accountable for data loss at a third-party provider. They're the ones who entrusted the data to the provider in the first place.
DI
Diego
1 year ago
D) The business data owner
VI
Viki
1 year ago
C) The incident response team
CA
Carole
1 year ago
B) The service provider that hosts the data
MA
Ma
1 year ago
A) The information security manager
BR
Brittni
1 year ago
But what about the service provider that hosts the data? Shouldn't they also be accountable?
PE
Pearlie
2 years ago
I agree with Laticia. The business data owner should be responsible for protecting the data.
LA
Laticia
2 years ago
I think the business data owner is accountable for data loss.