Inherent Risk not impacted with Patch activity fail in my opinion, only residual risk impact in patching either it will inside the risk apatite of organization or will increase. So I will still go with D
It is D. Inherent risk is the risk without the control. The control exists, patching, it simply is not optimal in the scenario. Lack of current patches raises residual risk. To increase inherent risk you need to start a new activity like a new business process etc, without this, the inherent risk "just is".
I think It should be increase in inherent risk, since the patch was not applied the application is more vulnerable, also there's no mention of any controls being implemented
upvoted 3 times
...
This section is not available anymore. Please use the main Exam Page.CRISC Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Raj1510
Highly Voted 1 year, 12 months agotsangckl
Highly Voted 1 year, 9 months agoCbtL
Most Recent 9 months, 2 weeks agojohn_boogieman
11 months, 1 week agofora
1 year, 9 months agoVirginiaJessamine
2 years agoMusMus
2 years ago