Exam CISM topic 1 question 250 discussion

It should be “b”

"B" appears correct to me as opposed to "A". I'm getting less confident about Exam Topics quality assurance.

B - I don't see how this can be a D

B. update the risk assessment. Updating the risk assessment is crucial because it allows the organization to identify and evaluate any new security risks or vulnerabilities introduced by the code change. This ensures that the security posture of the application remains current and effective. While the other options are also important, such as informing senior management, validating UAT, and modifying key risk indicators, they should be considered as complementary actions rather than the most critical one in the context of security. Updating the risk assessment provides a foundation for making informed decisions regarding the other actions.

A significant change to the underlying code of an application can introduce new vulnerabilities, risks, and potential security issues. Therefore, it is crucial for the information security manager to update the risk assessment to reflect the changes and assess the impact on the overall security posture of the application.

B. update the risk assessment.

(A) This is only done after the risk assessment (B) It's a risk assessment that needs to occur cause risk is based on impact and probability, both which are based on the attack surface which of course is based on the functionality of the app. This is what has changed and needs to be reflected in the risk assessment (C) Information security should be focused on UAT that's a developer role (D) KRI probable but unlikely.

B. Risk assessment as the underlying code has changed significantly.

Should be B

B is the right answer

I think there's no better answer than A. INFOSEC manager dont update but perform risk assessment. I am not sure how risk assessment can be updated, it is the risk register that we need to update.

update risk assessment due to changes

right answer : B. update the risk assessment

Agree B is the correct answer

B is the answer

should be b