Exam CRISC topic 1 question 978 discussion

D. Residual risk is reduced. Automated system configuration validation tools help reduce the residual risk, which is the risk that remains after controls and mitigation efforts have been implemented. By automatically identifying and rectifying configuration errors and vulnerabilities, these tools help ensure that systems are operating in a secure and compliant manner. This, in turn, reduces the likelihood of security incidents and breaches, ultimately lowering the residual risk to the organization.

An automated validation tool will most likely reduce the likelihood of the incorrect configuration which will reduce the risk risk.

I go with "B". Manual validation is more costly, think of this as man-days. Automated validation will make the process more efficient with less cost. For option "D", I do believe that the automated validation is not necessarily will reduce the Residual risk, is some cases it will find more vulnerabilities not rectified compared to manual validation i.e. the residual risk is increased

Agree it is D.

From a risk management perspective, the PRIMARY benefit of using automated system configuration validation tools is D. Residual risk is reduced. Automated system configuration validation tools can help reduce residual risk, which is the level of risk that remains after risk management strategies have been implemented. By automatically validating system configurations against industry standards, best practices, and compliance requirements, these tools can help identify and mitigate configuration-related vulnerabilities and reduce the likelihood of security incidents and system failures.

Trick question: 'from a risk management point of view', the correct answer would be that residual risk is reduced as misconfigurations are minimized.

B: Operational costs are reduced is more appropriate. it greatly improves efficiency and makes configuration management of large systems manageable.