フリー問題

問題文

A department cannot meet the password standard for a legacy application and asks for a permanent exemption. What should the governance process require before anything is granted?

選択肢

1. The process should require verbal manager agreement statements carrying an expiry date, and the request should describe compensating detective control steps that lowers the remaining exposure for the organization.
2. The process should require verbal manager agreement statements carrying an expiry date, and the request should describe technical vendor roadmap that lowers the remaining exposure for the organization.
3. The process should require documented risk acceptance carrying an expiry date, and the request should describe technical vendor roadmap that lowers the remaining exposure for the organization.
4. The process should require documented risk acceptance carrying an expiry date, and the request should describe compensating detective control steps that lowers the remaining exposure for the organization.