nerdexam
Isaca

CRISC · Question #575

A failure in an organization's IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following…

The correct answer is A. Threats are not being detected. The immediate concern for a risk practitioner when EDR software is missing is that the fundamental security control for detecting and responding to threats on those endpoints is absent, leaving them vulnerable.

Submitted by wei.xz· Apr 18, 2026Information Technology and Security

Question

A failure in an organization's IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following should be the risk practitioner's IMMEDIATE concern?

Options

  • AThreats are not being detected.
  • BMultiple corporate build images exist.
  • CThe IT build process was not followed.
  • DThe process documentation was not updated.

How the community answered

(32 responses)
  • A
    91% (29)
  • B
    6% (2)
  • D
    3% (1)

Why each option

The immediate concern for a risk practitioner when EDR software is missing is that the fundamental security control for detecting and responding to threats on those endpoints is absent, leaving them vulnerable.

AThreats are not being detected.Correct

EDR software is a critical control designed to detect and respond to malicious activities on endpoints. Its absence directly means that the capability to identify and mitigate threats on affected machines is severely compromised, posing an immediate security risk to the organization.

BMultiple corporate build images exist.

Multiple corporate build images might be the root cause, but the immediate concern is the consequence of that cause, which is the lack of detection.

CThe IT build process was not followed.

The build process not being followed is the root cause, but the immediate risk concern is the resulting vulnerability and lack of detection.

DThe process documentation was not updated.

Documentation not being updated is a process issue, but it's not the immediate security risk that missing EDR software presents.

Concept tested: Immediate risk of missing EDR

Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide

Topics

#Security Control Failure#Threat Detection#Risk Impact#Endpoint Security

Community Discussion

No community discussion yet for this question.

Full CRISC Practice