Exam CGEIT topic 1 question 173 discussion

Actual exam question from Isaca's CGEIT

Question #: 173
Topic #: 1

An enterprise has a zero-tolerance policy regarding security. This policy is causing a large number of email attachments to be blocked and is a disruption to the enterprise. Which of the following should be the FIRST governance step to address this email issue?

A. Obtain senior management input based on identified risk.
B. Direct the development of an email usage policy.
C. Recommend business sign-off on the zero-tolerance policy.
D. Introduce an exception process.

Show Suggested Answer

Suggested Answer: B 🗳️

by John_Connor at Nov. 8, 2021, 7:53 a.m.

Comments

Submit Cancel

shiowbah

9 months, 3 weeks ago

D. Introduce an exception process.

upvoted 1 times

...

SuperMax

1 year, 1 month ago

Selected Answer: A

A. Obtain senior management input based on identified risk. In order to address the disruption caused by the zero-tolerance policy, it's crucial to involve senior management to assess the identified risks associated with the policy. This step ensures that decisions about security policies are aligned with the overall risk appetite and business objectives of the enterprise. Obtaining senior management input will help in understanding the potential impact on business operations, and it can guide the development of a balanced approach to security that considers both risk mitigation and business continuity.

upvoted 1 times

...

John_Connor

3 years, 2 months ago

Why not D, an exception process? I understand C is not the best step since business will want everything to go through and when a security incident occurs, point fingers at IT or IT governance.

upvoted 1 times

...