CRISC · Question #575
A failure in an organization's IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following…
The correct answer is A. Threats are not being detected. The immediate concern for a risk practitioner when EDR software is missing is that the fundamental security control for detecting and responding to threats on those endpoints is absent, leaving them vulnerable.
Question
A failure in an organization's IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following should be the risk practitioner's IMMEDIATE concern?
Options
- AThreats are not being detected.
- BMultiple corporate build images exist.
- CThe IT build process was not followed.
- DThe process documentation was not updated.
How the community answered
(32 responses)- A91% (29)
- B6% (2)
- D3% (1)
Why each option
The immediate concern for a risk practitioner when EDR software is missing is that the fundamental security control for detecting and responding to threats on those endpoints is absent, leaving them vulnerable.
EDR software is a critical control designed to detect and respond to malicious activities on endpoints. Its absence directly means that the capability to identify and mitigate threats on affected machines is severely compromised, posing an immediate security risk to the organization.
Multiple corporate build images might be the root cause, but the immediate concern is the consequence of that cause, which is the lack of detection.
The build process not being followed is the root cause, but the immediate risk concern is the resulting vulnerability and lack of detection.
Documentation not being updated is a process issue, but it's not the immediate security risk that missing EDR software presents.
Concept tested: Immediate risk of missing EDR
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide
Topics
Community Discussion
No community discussion yet for this question.