問題文
A finding states that privileged sessions on the database servers are not recorded. A team member drafts a recommendation that names a particular vendor's session recorder and its license tier. Why should the wording be changed?
選択肢
- Because the recommendation should state the product choice that the control must reach and leave the required result to the supplier, so that the auditor does not take design responsibility for the remedy.
- Because the recommendation should state the required outcome that the control must reach and leave the product choice to the supplier, so that the auditor does not exceed agreed scope for the remedy.
- Because the recommendation should state the lowest price that the control must reach and leave the required result to the management, so that the auditor does not exceed agreed scope for the remedy.
- Because the recommendation should state the required outcome that the control must reach and leave the product choice to the management, so that the auditor does not take design responsibility for the remedy.