Exam CISSP topic 1 question 163 discussion

ISC2 identifies lack of change control as a common cause of security failures in its Common Body of Knowledge (CBK). It includes a section on Security Operations, which covers topics such as change management, configuration management, and incident management. Within this section, lack of change control is identified as a common cause of security failures. Additionally, many other sources in the field of information security also identify lack of change control as a common issue that can lead to security incidents.

C. Lack of logging and monitoring / you have to check the logs and monitor.

I m leaning more towards C: System and Security "Failures" ---- unrecoverable The lack of logging and monitoring in a system poses significant security risks, including limited visibility into activities, delayed incident detection, challenges in incident investigation, non-compliance with regulations, and difficulties in forensic analysis. It also hampers threat hunting efforts, monitoring user activities, ensuring accountability, receiving timely alerts for anomalies, and detecting security baseline deviations. To mitigate these risks, organizations should implement robust logging, monitoring, and incident response practices.

its B for sure

Lack of a good change control process, and the solid implementation of it, will cause internal problems like that, and can also result in data breaches. https://totalsecurityadvisor.blr.com/cybersecurity/why-cybersecurity-and-change-control-go-together-like-peanut-butter-and-jelly/