Exam CRISC topic 1 question 849 discussion

Actual exam question from Isaca's CRISC

Question #: 849
Topic #: 1

An organization has identified that terminated employee accounts are not disabled or deleted within the time required by corporate policy. Unsure of the reason, the organization has decided to monitor the situation for three months to obtain more information. As a result of this decision, the risk has been:

A. accepted.
B. transferred.
C. avoided.
D. mitigated.

Show Suggested Answer

Suggested Answer: A 🗳️

by john_boogieman at Feb. 17, 2023, 11:12 a.m.

Comments

Submit Cancel

CbtL

9 months ago

Selected Answer: A

They are putting up with it for a few months, that is risk acceptance for the interim. Selecting A.

upvoted 1 times

...

john_boogieman

11 months ago

Selected Answer: A

The risk has not been fully addressed by the organization's decision to monitor the situation for three months. While monitoring can provide valuable information about the issue, it does not by itself reduce or mitigate the risk of terminated employee accounts not being disabled or deleted in a timely manner. By not taking immediate action to address the risk, the organization continues to expose itself to the potential consequences of unsecured terminated employee accounts, such as unauthorized access to sensitive data, loss of intellectual property, or reputation damage.

upvoted 1 times

...