問題文
A quarterly configuration review passes every item of the chosen benchmark, yet an incident occurs the following month through a path the benchmark does not mention. Which conclusion should the team draw about how to use such reviews?
選択肢
- The benchmark must be replaced with a different one, because a list that failed to mention the path used in this incident cannot be an adequate reference.
- Configuration reviews provide no value and should be discontinued, so the effort can go to incident response instead.
- The review frequency should be increased to weekly and nothing else needs to change, so the same checklist can simply be run more often.
- A point-in-time review of a fixed checklist measures conformance to that list, so it has to be complemented by continuous checking and by threat modeling of their own environment.