MENU
During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application. Which of the
following should be the information security manager's FIRST course of action?
Suggested Answer: B
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
13 comments · newest first
MA
Marilynn
11 months ago
D feels too extreme, we should handle it internally first.
LE
Lenna
12 months ago
Surprised the patches weren't installed at all! How did that happen?
DO
Dorthy
12 months ago
C seems like a good move too, get the committee involved.
PA
Paulina
12 months ago
I think A is better, we need a plan first.
CO
Cory
1 year ago
Definitely B, the app owner needs to know the risks!
TA
Tayna
1 year ago
Reporting to the steering committee sounds like a good idea, but I wonder if that’s too far down the line. I think we should first communicate with the application owner, so option B seems right.
JO
Jonell
1 year ago
I feel like determining mitigation options with IT management is crucial, but it might not be the first thing to do. I lean towards option B, but I could be wrong.
MA
Martina
1 year ago
I'm not entirely sure, but I think we practiced a similar scenario where escalation was key. Maybe option D could be the right choice if the risk is severe enough?
TI
Tijuana
1 year ago
I remember discussing the importance of communication in risk management. I think option B might be the best first step to ensure the application owner understands the risks involved.
GE
Gene
1 year ago
Okay, I think I know the answer to this. The key is understanding that test analysis and design involve extracting information from the test basis, which can uncover defects.
MA
Margarita
1 year ago
I think this might be related to encryption, but I'm not entirely sure since it sounds like it could also be some sort of obfuscation.
AN
Antione
1 year ago
I feel pretty good about this one. The key is to maximize the camera's view of the people entering the store. That means it should be facing the entrance, either at eye level (B) or directly above (C). I'd probably go with B since that seems a bit more reliable.
NO
Noel
1 year ago
Wasn't there a practice question that mentioned spontaneous changes disrupting generalization? I'm really unsure if normalization is the right term here either.