The chief executive asks the security manager to exempt the executive team from multifactor authentication because it slows them down when traveling. What is the BEST response?
Select an answer to reveal the explanation.
Short Explanation
Executive accounts are the crown jewels that attackers love, so a quiet waiver is the worst of both worlds. You don't say no and you don't say yes; you lay out the risk and send it down the formal exception path so the right owner signs for it on the record. The trap is you, the security manager, accepting the risk yourself.
Full Explanation
Tone at the top is set as much by how leaders handle exceptions as by what policies say. Executive accounts are high-value targets, so removing a strong authentication control for them materially raises risk. The security manager's role is to explain that risk clearly, perhaps offering lower-friction authentication options, and to route any remaining request through the organization's formal policy exception process, where the risk is documented, compensating controls are considered, and acceptance is made by the appropriate risk owner with an expiry date. An informal waiver bypasses governance and signals to the whole organization that rules bend for seniority. Refusing outright and reporting the chief executive to the board escalates prematurely; the request is a legitimate business concern that has a defined handling path. Approving it personally, even with compensating monitoring, has the security manager accepting risk that belongs to business ownership and creates an undocumented precedent. Exam caveat: if the exception would breach a regulatory requirement, the answer becomes that it cannot be granted at all. Operational check: confirm the exception register shows the request, the risk analysis, the approver and the review date.