Discuss Isaca CISM Exam Topic 1 Question 97

Which of the following is the GREATEST concern resulting from the lack of severity criteria in incident classification?

AStatistical reports will be incorrect.

BThe service desk will be staffed incorrectly.

CEscalation procedures will be ineffective.

DTimely detection of attacks will be impossible.

Suggested Answer: C

The greatest concern resulting from the lack of severity criteria in incident classification is that escalation procedures will be ineffective because they rely on severity criteria to determine when and how to escalate an incident to higher levels of authority or responsibility, and what actions or resources are required for resolving an incident. Statistical reports will be incorrect is not a great concern because they do not affect the incident response process directly, but rather provide information or analysis for improvement or evaluation purposes. The service desk will be staffed incorrectly is not a great concern because it does not affect the incident response process directly, but rather affects the availability or efficiency of one of its components. Timely detection of attacks will be impossible is not a great concern because it does not depend on severity criteria, but rather on monitoring and alerting mechanisms. Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-5/incident-response-lessons-learned https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/incident-response-lessons-learned

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Viva 10 months ago

Not sure about B, staffing can adapt to other factors too.

Phyliss 10 months ago

Totally agree with A, it’s all about the numbers!

Louvenia 10 months ago

I think C is a bigger issue, escalations need to be clear.

Orville 10 months ago

D seems a bit extreme, can’t we still detect attacks?

Bo 11 months ago

Definitely A, incorrect stats can mess everything up.

Cary 11 months ago

Staffing the service desk incorrectly could definitely cause issues, but I wonder if it’s as severe as the problems with escalation procedures.

Ronald 11 months ago

I'm a bit confused about the options, but I feel like timely detection of attacks is really important. If we can't detect them, everything else falls apart.

Paris 11 months ago

I think I saw a similar question in our practice tests, and I leaned towards escalation procedures being ineffective. That seems critical.

Sabine 12 months ago

I remember discussing how incorrect statistical reports could lead to poor decision-making, but I'm not sure if that's the greatest concern.

Mari 12 months ago

Ah, this is the kind of question that really makes you think. I'm going to need to review the material on incident management again to make sure I choose the best answer.

Lai 12 months ago

Okay, I think I've got a handle on this. The key is to identify the most significant consequence of not having clear severity criteria for incident classification.

Emilio 1 year ago

Hmm, this is a tricky one. I'm not entirely sure which of these concerns is the greatest, but I'll try to reason through it step-by-step.

Levi 1 year ago

This seems like a straightforward question, but I want to make sure I understand the implications of the lack of severity criteria. I'll need to carefully consider each option.

Val 1 year ago

That's a valid point, without severity criteria, attacks may go unnoticed for longer.

Rex 1 year ago

But what about the impact on timely detection of attacks?

Benedict 1 year ago

I'm going with B. If the service desk is staffed incorrectly, the whole system is thrown off. Good luck getting anything done right!

Jesusa 1 year ago

↳ replying to Benedict

B) The service desk will be staffed incorrectly.

Erasmo 1 year ago

↳ replying to Benedict

A) Statistical reports will be incorrect.

Shawn 1 year ago

I agree, incorrect statistical reports can lead to wrong decisions.

Val 1 year ago

I think the lack of severity criteria will affect statistical reports.

Novella 1 year ago

Hold up, are we talking about incident classification or a game of 'Guess the Severity'? I feel like I should be rolling dice right now.

Valentin 1 year ago

↳ replying to Novella

C) Escalation procedures will be ineffective.

Nakita 1 year ago

↳ replying to Novella

B) The service desk will be staffed incorrectly.

Bobbye 1 year ago

↳ replying to Novella

A) Statistical reports will be incorrect.

Walton 1 year ago

Wait, so we're supposed to be concerned about the lack of severity criteria? I thought that was just an excuse to skip our incident response training. Oops.

Bonita 1 year ago

↳ replying to Walton

C) Escalation procedures will be ineffective.

Torie 1 year ago

↳ replying to Walton

B) The service desk will be staffed incorrectly.

Anastacia 1 year ago

↳ replying to Walton

A) Statistical reports will be incorrect.

Fidelia 1 year ago

D is the way to go. Without clear severity criteria, how can we possibly detect attacks in a timely manner? This is a recipe for disaster!

Francine 1 year ago

↳ replying to Fidelia

D) Timely detection of attacks will be impossible.

Shawn 1 year ago

↳ replying to Fidelia

B) The service desk will be staffed incorrectly.

Adaline 1 year ago

↳ replying to Fidelia

A) Statistical reports will be incorrect.

Isaca CISM Exam - Topic 1 Question 97 Discussion