CRISC · Question #476
A failure in an organization s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following sho
The correct answer is D. Threats are not being detected.. The immediate concern when EDR software is missing is that the primary purpose of EDR-detecting and responding to threats-is compromised, leaving systems vulnerable.
Question
A failure in an organization s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following should be the risk practitioner's IMMEDIATE concern?
Options
- AMultiple corporate build images exist.
- BThe process documentation was not updated.
- CThe IT build process was not followed.
- DThreats are not being detected.
How the community answered
(31 responses)- A6% (2)
- B3% (1)
- C13% (4)
- D77% (24)
Why each option
The immediate concern when EDR software is missing is that the primary purpose of EDR-detecting and responding to threats-is compromised, leaving systems vulnerable.
Multiple build images might be a root cause, but the immediate operational impact is the lack of detection, not the existence of images themselves.
Outdated process documentation is a process issue, not the immediate security concern stemming from missing EDR software on live systems.
The IT build process not being followed is the root cause of the problem, but the immediate concern for a risk practitioner is the direct consequence of that failure – the exposure to threats.
The absence of EDR software on several computers means these endpoints lack critical security visibility and protective capabilities, making them immediately vulnerable to undetected and unmitigated threats.
Concept tested: Immediate security operational impact
Topics
Community Discussion
No community discussion yet for this question.