MENU
Which of the following is the PRIMARY benefit of implementing an information security governance framework?
Suggested Answer: A
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.
https://simplicable.com/risk/risk-treatment
https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/
https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.
37 comments · newest first
TY
Ty
10 months ago
A is the most straightforward benefit, can’t argue with that!
SU
Suzan
11 months ago
Wow, I didn’t realize D was even an option!
BI
Billye
11 months ago
C is interesting, but I think it’s more about security than revenue.
RO
Roslyn
11 months ago
I’m not sure about that, A seems more relevant to me.
CA
Casandra
11 months ago
Definitely B, it’s all about balancing risks and controls.
LU
Luis
12 months ago
I’m a bit confused; I thought the framework was mostly about risk management, so I’m leaning towards A or B, but I can't recall the exact details.
HA
Haydee
12 months ago
I feel like option C could also be a contender since maximizing revenue is important, but it seems more like a secondary benefit to me.
VI
Vicki
12 months ago
I remember practicing a question similar to this, and I think option B makes the most sense since it talks about balancing risks and controls with business goals.
EL
Elinore
1 year ago
I think the primary benefit is about defining responsibilities, but I'm not completely sure if that's the main focus of governance frameworks.
GL
Glenn
1 year ago
Option B stands out to me as the best answer. The framework is about aligning information security with the business, not just defining responsibilities or maximizing revenue.
DI
Dick
1 year ago
I'm a bit confused by the wording of the options. They all seem related to the benefits, but I'm not sure which one is the "PRIMARY" benefit. I'll need to re-read the question carefully.
EL
Eliseo
1 year ago
The primary benefit is that the framework provides direction to meet business goals while balancing risks and controls. This aligns with the need to secure technology use while supporting the organization's objectives.
RO
Rozella
1 year ago
This question seems straightforward, but I want to make sure I understand the key benefits of an information security governance framework before selecting an answer.
AN
Andree
1 year ago
I'm leaning towards option B. The framework is meant to guide the organization in managing information security risks in a way that supports the overall business strategy, not just maximizing revenue or confirming goals.
LE
Leota
1 year ago
This looks like a straightforward question about ensuring layer availability across multiple Citrix sites. I think I've got a good handle on the different options presented.
AN
Andrew
1 year ago
Okay, I think I've got it. App Engine seems like the best choice here since it will allow us to easily stage and promote new versions of the application without having to worry about the underlying infrastructure.
JA
Jaclyn
1 year ago
Who cares about the business goals? I just want to hack the system and make a quick buck. Oh wait, this is a serious exam. Definitely go with B.
ZE
Zena
1 year ago
User 4: Definitely go with B.
LA
Latricia
1 year ago
User 3: I agree with Latricia. Option B is the best choice for implementing an information security governance framework.
TH
Theola
1 year ago
User 2: Theola, that's not the right approach. We should prioritize balancing risks and controls to meet business goals.
ED
Edelmira
1 year ago
User 1: Who cares about the business goals? I just want to hack the system and make a quick buck.
WH
Whitley
1 year ago
A is not bad, but it feels a bit limiting. B covers the broader picture of aligning security with business objectives.
BO
Bobbye
1 year ago
User 3: B sounds like the best option for overall effectiveness.
CA
Caitlin
1 year ago
User 2: I agree, but B covers a broader perspective on aligning security with business goals.
DE
Deeanna
1 year ago
User 1: I think A is good for defining responsibilities.
BO
Bong
1 year ago
Hmm, D sounds like it could be useful, but I don't think that's the PRIMARY benefit. I'll have to go with B on this one.
JI
Jimmie
1 year ago
Option C sounds tempting, but let's be real, security is about protecting the business, not maximizing revenue. B is the way to go.
JO
Johna
1 year ago
C) The framework provides a roadmap to maximize revenue through the secure use of technology.
PA
Paulina
1 year ago
B) The framework provides direction to meet business goals while balancing risks and controls.
JU
Justine
1 year ago
A) The framework defines managerial responsibilities for risk impacts to business goals.
GL
Glenna
1 year ago
The primary benefit is clearly B. The framework provides direction to meet business goals while balancing risks and controls. Anything else is just a secondary consideration.
CO
Corazon
1 year ago
True, but ultimately option B is what helps achieve business goals while managing risks.
VI
Viva
1 year ago
I think option A is also important, as it defines managerial responsibilities for risk impacts.
KR
Kris
1 year ago
I agree, option B is definitely the primary benefit.
RO
Rosalind
1 year ago
I believe B) The framework provides direction to meet business goals while balancing risks and controls is also important. It helps in achieving business objectives while managing risks.
SE
Sena
1 year ago
I agree with Ozell. Having clear responsibilities is crucial for effective information security governance.
OZ
Ozell
2 years ago
I think the primary benefit is A) The framework defines managerial responsibilities for risk impacts to business goals.