CompTIA CASP+ Practice Test

Before deploying a new system, what must the risk management director require from developers?

1. A detailed user manual

2. A plan for backups

3. A plan of action for addressing vulnerabilities

4. A list of all potential risks

The correct answer is: A plan of action for addressing vulnerabilities

The correct choice involves requiring developers to provide a plan of action for addressing vulnerabilities, which is essential for minimizing security risks associated with the new system. This plan is critical because it outlines how the organization intends to identify, assess, and mitigate potential vulnerabilities that could be exploited by malicious actors. By having a comprehensive plan in place, the organization demonstrates proactive risk management and ensures that any discovered vulnerabilities will be effectively handled, thereby enhancing the overall security posture of the system. In contrast, a detailed user manual, while useful for end-users to understand how to operate the system, does not specifically address security concerns. A plan for backups is important for data recovery but does not directly focus on vulnerability management. Similarly, a list of all potential risks is valuable for understanding threats but lacks the necessary actionable steps that the organization needs to take in response to those threats. Thus, the emphasis on having a plan of action for addressing vulnerabilities is crucial in the context of risk management prior to deploying a new system.