When likelihood is unknown, range-based estimates from subject-matter experts provideinformed and realistic insights into potential risk exposure. This approach helps approximate the inherent risk based on experience and expertise, supporting effective decision-making.

Cross-site scripting (XSS) and SQL injection are two common types of web application attacks that can compromise the confidentiality, integrity, and availability of data and systems. XSS allows an attacker to inject malicious code into a web page that is viewed by other users, while SQL injection allows an attacker to execute arbitrary commands on a database server by manipulating the input parameters of a web application.
Both attacks can result in data theft, unauthorized access, defacement, denial of service, and more.
To mitigate these attacks, the best option is to require the software vendor to remediate the vulnerabilities by applying secure coding practices, such as input validation, output encoding, parameterized queries, and HTML sanitization. These techniques can prevent or limit the impact of XSS and SQL injection by ensuring that user input is not interpreted as code or commands by the web browser or the database server. The software vendor should also provide regular updates and patches to fix any known or newly discovered vulnerabilities.
The other options are not effective or acceptable ways to mitigate these attacks. Monitoring the databases for abnormal activity can help detect and respond to SQL injection attacks, but it does not prevent them from happening or address the root cause of the vulnerability. Approving an exception to allow the software to continue operating can expose the organization to unnecessary risks and liabilities, as well as violate compliance requirements and standards. Accepting the risk and letting the vendor run the software as is can also have serious consequences for the organization, as it implies that the potential impact and likelihood of the attacks are low or acceptable, which may not be the case. References = IT Risk Resources | ISACA CRISC Certification | Certified in Risk and Information Systems Control | ISACA Cross Site Scripting Prevention Cheat Sheet - OWASP A novel technique to prevent SQL injection and cross-site scripting attacks using Knuth-Morris-Pratt string match algorithm | EURASIP Journal on Information Security | Full Text Difference Between XSS and SQL Injection - GeeksforGeeks

The correct answer isCbecause the best way to incorporatecontinuous monitoringin IT risk policies is todefine how risk thresholds are aligned with organizational objectives. Continuous monitoring is effective only when it is tied to measurable thresholds that indicate when risk is moving outside acceptable limits. Those thresholds must be aligned with business objectives, risk appetite, and tolerance to make monitoring meaningful.
The other options are less appropriate as the best policy-level approach:
* A. Implement a governance, risk, and compliance (GRC) toolmay support monitoring, but a tool is not the policy foundation.
* B. Establish a cross-functional risk steering committeeimproves governance, but it does not define how continuous monitoring should operate.
* D. Standardize IT risk mitigationhelps consistency, but continuous monitoring depends on thresholds and escalation criteria.
Exact Extracts supporting the answer:
* "The main purpose of continuous monitoring is detecting changes to the enterprise's risk environment."
* "The main purpose of risk monitoring is to provide timely information on the actual status of the enterprise with regard to risk with the risk profile offering an overall risk status."
* "Including thresholds that identify when controls no longer provide the intended value is essential when developing metrics to monitor the control life cycle."
* "The most important consideration when implementing key risk indicators is linking the metric to a specific risk."
* "The best approach for creating key risk indicators for quarterly reporting to senior leadership is identifying the enterprise risk appetite and metrics and measures of current risk." These extracts show that continuous monitoring must be based on defined thresholds linked to enterprise objectives and risk levels. Therefore, the best answer isdefine how risk thresholds are aligned with organizational objectives.

Conducting root cause analyses for risk events is the first recommendation that a risk practitioner should make when an increasing trend of risk events and subsequent losses has been identified, as this helps to identify the underlying causes and sources of the risk events, and to determine the appropriate actions to address them.
Root cause analysis is a systematic process of collecting and analyzing data, finding the root causes, and implementing solutions to prevent recurrence or reduce the impact of the risk events. Educating personnel on risk mitigation strategies, integrating the risk event and incident management processes, and implementing controls to prevent future risk events are not the first recommendations, but rather the possible outcomes or actions of conducting root cause analyses for risk events. References = CRISC Certified in Risk and Information Systems Control - Question208; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 208.

CRISC emphasizes thatuntested changes in productionrepresent high operational risk due to potential downtime, integrity issues, or security failures.
Supporting extract:
"Untested changes to production systems introduce the greatest amount of risk because they may disrupt operations or introduce security vulnerabilities." UAT failureordebuggingpose limited impact confined to pre-production stages.
Hence,Dis the correct and verified answer.
CRISC Reference:Domain 2 - IT Risk Assessment, Topic: Risk in the System Development Life Cycle.