Certified Information Security Manager CISM · Free Practice Question Easy
Question 85
A risk assessment has determined that the control is being operated improperly. How should this matter best be remedied?
- A Discontinue use of the control.
- B Assign ownership of the control to another person.
-
C
Require that the control owner will commit to improving control performance.
- D Change the design of the control.
Reveal correct answer
Correct answer: C
Explanation
Correct Answer:
"Require that the control owner will commit to improving control performance." is correct. Because the risk assessment did not specify that the design of the control is inappropriate, the best remedy is to require that the control owner attempt to manage the control more effectively.
Incorrect Answers:
Change the design of the control is incorrect because the scenario implies that the control design is sound, and specifies it is not being operated improperly.
Discontinue use of the control is incorrect because discontinuing use of the control is likely to increase risk.
Assign ownership of the control to another person is incorrect because the control's owner should first attempt to improve control operation. Assigning the control to another person may be more disruptive and introduce other problems.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
