Security and Risk Management
Question #24
A company acted swiftly to stop a ransomware attack, but the investigation reveals ransomware wasn't addressed in any policies or DR/BC plans. What is the correct conclusion?
A. The company takes prudent actions.
B. The company lacks both due care and due diligence.
C. The company has completed its risk assessment.
D. The company demonstrates due care but lacks due diligence.
Domain Concept: Security and Risk Management
This scenario evaluates management-level decision making in Security and Risk Management. In CISSP exam scenarios, evaluate answers through executive governance, risk assessment, life safety, and due diligence before implementing technical controls.
💡 View the Answer & Detailed Explanation
The correct answer to this scenario-based question requires an understanding of the CISSP Managerial Mindset. Register to view our in-depth explanation and access 1100+ adaptive questions completely free.