CDPSE · Question #289
Which of the following is the BEST course of action to manage privacy risk when a significant vulnerability is identified in the operating system (OS) that supports an organization's customer…
The correct answer is B. Manage system permissions and access more strictly. When a significant OS vulnerability is identified, the immediate priority is to reduce the attack surface while a proper patch management process - which requires testing to avoid breaking the CRM - is prepared. Tightening permissions and enforcing least-privilege access limits…
Question
Which of the following is the BEST course of action to manage privacy risk when a significant vulnerability is identified in the operating system (OS) that supports an organization’s customer relationship management (CRM) system?
Options
- AApply OS patching to fix the vulnerability immediately.
- BManage system permissions and access more strictly.
- CEnable comprehensive logging of activities at the OS level.
- DPerform a vulnerability assessment to determine the impact.
How the community answered
(23 responses)- A13% (3)
- B57% (13)
- C26% (6)
- D4% (1)
Explanation
When a significant OS vulnerability is identified, the immediate priority is to reduce the attack surface while a proper patch management process - which requires testing to avoid breaking the CRM - is prepared. Tightening permissions and enforcing least-privilege access limits what an attacker could do even if the vulnerability is exploited, making it the most effective compensating control. Applying the patch immediately (A) without testing could disrupt the CRM system. Enabling logging (C) is a detective control that does not prevent exploitation. A vulnerability assessment (D) helps quantify impact but does not reduce risk on its own and would typically precede patching decisions, not replace risk reduction actions.
Topics
Community Discussion
No community discussion yet for this question.