CAS-001 Question #391: Real Exam Question with Answer & Explanation

Question

Options

• ABusiness or technical justification for not implementing the requirements.
• BRisks associated with the inability to implement the requirements.
• CIndustry best practices with respect to the technical implementation of the current controls.
• DAll section of the policy that may justify non-implementation of the requirements.
• EA revised DRP and COOP plan to the exception form.
• FInternal procedures that may justify a budget submission to implement the new requirement.
• GCurrent and planned controls to mitigate the risks.

Explanation

A policy exception form is a formal request to deviate from a security requirement for a defined period. It must be decision-quality documentation for the CIO. Option A (business/technical justification) explains WHY the requirement cannot be met - in this case, budget constraints preventing two-factor authentication implementation for two years. Option B (risks associated with non-implementation) quantifies the security exposure the organization accepts by granting the exception; the CIO cannot responsibly approve without understanding the risk. Option G (current and planned controls to mitigate) demonstrates due diligence - that compensating controls are in place to reduce risk during the exception window. Industry best practices (C) are informational but not required in an exception form. Policy sections (D) are already known to the CIO. A revised DRP/COOP (E) is unrelated to a wireless authentication exception. Internal budget procedures (F) are a process concern, not a security risk management deliverable.

No community discussion yet for this question.