CISM Practice Test 5 — 10 Questions

Question 1

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement compensating controls to reduce the risk. Implementing compensating controls, such as network segmentation, application-layer firewalls, or intrusion detection systems (IDS), directly reduces the residual risk of exploiting unpatched vulnerabilities in the legacy payment system without disrupting its critical daily operations. This aligns with the CISM principle that when a risk cannot be remediated (e.g., due to system criticality or vendor end-of-life), compensating controls are the primary treatment to bring risk within the organization's appetite.

Answer

Accept the risk as a cost of doing business

Answer

Avoid the risk by decommissioning the system

Answer

Purchase cyber insurance to transfer the risk

Question 2

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

Accepted Answer

Inaccurate risk profile leading to uninformed decisions. C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.

Answer

Increased audit findings

Answer

Regulatory fines for noncompliance

Answer

Higher insurance premiums

Question 3

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 4

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Accepted Answer

Assess the business impact of each asset's compromise. The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Answer

Use the asset's purchase value to determine priority

Answer

Perform a vulnerability scan and prioritize based on findings

Answer

Review historical incident reports for each asset

Question 5

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Accepted Answer

The cost to mitigate is higher than the potential financial loss from a breach. Risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

Answer

The organization has no compensating controls in place

Answer

The risk is within the organization's risk appetite but the business impact is high

Answer

The vendor has a history of security incidents

Question 6

A risk manager is evaluating a control that reduces the likelihood of a threat from high to low. The cost of the control is $100,000 annually. The expected loss without the control is $500,000 per year. Which of the following should the risk manager recommend?

Accepted Answer

Implement the control. The control reduces the annualized loss expectancy (ALE) from $500,000 to a much lower value (since likelihood drops from high to low). The annual cost of the control is $100,000, which is significantly less than the $500,000 expected loss without it. Implementing the control provides a positive return on investment (ROI) and is the most cost-effective risk mitigation strategy.

Answer

Avoid the risk by discontinuing the process

Answer

Transfer the risk through insurance

Answer

Accept the risk

Question 7

Which of the following is the primary purpose of communicating risk assessment results to senior management?

Accepted Answer

To enable informed decision-making about risk acceptance. The primary purpose of communicating risk assessment results to senior management is to provide the necessary information for informed decision-making regarding risk acceptance, transfer, or mitigation. Senior management holds the authority to accept residual risk based on a clear understanding of the potential impact and likelihood, which is a core tenet of the CISM framework for information security risk management.

Answer

To comply with regulatory requirements

Answer

To assign blame for security failures

Answer

To justify the security budget

Question 8

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Accepted Answer

The impact of losing both primary and backup data is unacceptably high. The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach. The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.

Answer

The risk owner does not have authority to accept risks

Answer

Encryption is not required as the facility is secure

Answer

The cost of implementing encrypted offsite backups is minimal

Question 9

A multinational corporation must comply with both GDPR and CCPA. Which governance approach is most effective?

Accepted Answer

Develop a unified data protection framework with regional adjustments. A unified data protection framework with regional adjustments allows the organization to maintain consistent governance principles while accommodating specific legal requirements of GDPR (e.g., data subject rights, 72-hour breach notification) and CCPA (e.g., opt-out rights, broader definition of personal information). This approach aligns with the CISM domain of Information Security Governance by enabling scalable, risk-based compliance without duplicating efforts or creating conflicts between policies.

Answer

Create a single rigid unified policy applicable everywhere

Answer

Implement separate compliance programs for each regulation

Answer

Outsource compliance to a third-party service provider

Question 10

Which board-level metric is MOST useful for measuring the effectiveness of the incident response process?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures how quickly the incident response team acts on detected incidents, which directly reflects the effectiveness of the response process itself. It is the board-level metric that isolates response capability from detection (MTTD) or prevention (patch compliance).

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents