MENU
Which of the following is the MOST likely reason that a list of control deficiencies identified in a recent security assessment would be excluded from an IT risk register?
Suggested Answer: C
Get Premium IT Risk Fundamentals Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The most likely reason to exclude control deficiencies from an IT risk register is that they have already been resolved. The risk register should focus on current risks that require attention or action.
While deficiencies with no business relevance (A) might be lower priority, they could still be relevant to the risk register. Actual misconfigurations (B) are definitely relevant and should be included.
12 comments · newest first
MO
Monroe
3 days ago
C) is definitely a valid reason, no point in listing resolved issues.
NO
Novella
8 days ago
I disagree, even minor issues can have business relevance!
OR
Ora
13 days ago
A) makes sense, if they don't matter to the business.
CI
Ciara
18 days ago
I think B) should always be noted, even if fixed.
PA
Pamella
23 days ago
Wait, how can misconfigurations not be relevant?
BR
Brandon
29 days ago
C) is probably the best reason, resolved issues shouldn't stay.
TI
Tiara
1 month ago
I disagree, even minor issues can matter!
BR
Brynn
1 month ago
A) makes sense, if they're not relevant.
RI
Rikki
1 month ago
I recall discussing how only relevant risks should be in the register, so option A seems like the most logical choice to me.
AL
Alise
2 months ago
I feel like option B could be a reason too, but misconfigurations might still have some relevance. It's confusing!
JE
Jesus
2 months ago
I'm not sure, but I remember a practice question where resolved issues were excluded from the risk register. So maybe option C is correct?
PE
Pedro
2 months ago
I think option A makes sense because if the deficiencies don't impact the business, they might not be worth tracking.