Isaca Exam CISM Topic 1 Question 79 Discussion

Actual exam question for Isaca's CISM exam

Question #: 79
Topic #: 1

[All CISM Questions]

Of the following, who is accountable for data loss in the event of an information security incident at a third-party provider?

AThe information security manager

BThe service provider that hosts the data

CThe incident response team

DThe business data owner

Show Suggested Answer

Suggested Answer: A

Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.

https://simplicable.com/risk/risk-treatment

https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.

by Cathern at Jul 16, 2024, 12:52 AM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Micaela

1 months ago

I don't know, man. I'm just hoping the correct answer isn't 'all of the above'. That would be a real plot twist, am I right?

upvoted 0 times

...

Maybelle

1 months ago

Hmm, I'm gonna have to go with the business data owner on this one. After all, they're the ones who decided to outsource their data, so they should be prepared to deal with the consequences.

upvoted 0 times

...

1 months ago

Nah, it's definitely the service provider's responsibility. They're the ones hosting the data, so they should be the ones held accountable.

upvoted 0 times

Alexia

17 days ago

C) The incident response team

upvoted 0 times

...

Wilda

30 days ago

B) The service provider that hosts the data

upvoted 0 times

...

Aleisha

1 months ago

A) The information security manager

upvoted 0 times

...

3 months ago

I think the business data owner is accountable for data loss.

upvoted 0 times

...