Exam CISA topic 1 question 102 discussion

C. Recommend that management enhance the policy and improve threat awareness training.

option A only addresses the immediate concern, however, option C is the BEST way to address the situation.

There might me some risks not resolved. You need to ivestigate further before enhancing policies and awareness.

While further reviewing closed unactioned alerts (Option A) could provide insights into specific instances of mishandling, recommending enhancements to the policy and training (Option C) addresses the underlying issue more comprehensively. It allows the organization to proactively improve its network threat response process rather than just reacting to past incidents.

Further review

why answer B?

By recommending that management enhances the policy and improves threat awareness training, the auditor addresses the underlying issues. Enhancing the policy can provide clearer guidelines and expectations for handling alerts, including criteria for closure. Improving threat awareness training can better equip the support team with the knowledge and skills to evaluate alerts effectively and take appropriate action.