CISM Information Security Risk Management — 10 Questions

Question 1

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Avoid the risk by not engaging vendors that cannot meet security requirements.. Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.

Answer

Mitigate the risk by conducting regular vendor audits.

Answer

Transfer the risk by requiring vendors to have cyber insurance.

Answer

Accept the risk because third-party risks are unavoidable.

Question 2

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Accepted Answer

Risk of data exfiltration via DNS tunneling.. The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Answer

Risk of unauthorized external access to internal services.

Answer

Risk of denial-of-service attacks from internal hosts.

Answer

Risk of IP spoofing attacks from the inside network.

Question 3

Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?

Accepted Answer

Implement account lockout after 3 failed attempts.. Implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.

Answer

Change the password policy to require 12-character passwords.

Answer

Increase logging verbosity to capture more details.

Answer

Disable SSH access and use console only.

Question 4

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Accepted Answer

Recommend implementing multifactor authentication to reduce the risk. Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer

Accept the risk because the likelihood is only moderate

Answer

Reassess the risk with a higher risk appetite threshold

Answer

Transfer the risk by purchasing cyber insurance

Question 5

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Accepted Answer

Risk acceptance with formal sign-off by senior management. When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.

Answer

Risk mitigation by implementing compensating controls

Answer

Risk transfer through cyber insurance

Answer

Risk avoidance by decommissioning the system

Question 6

An organization has a high residual risk after implementing all feasible controls. According to CISM best practices, which of the following should the information security manager do? (Select TWO.)

Accepted Answer

Escalate to senior management for risk acceptance. When residual risk remains high after all feasible controls are implemented, the information security manager should escalate the risk to senior management for formal risk acceptance (Option A). This aligns with CISM best practices, as senior management holds the authority to accept risks that exceed the organization's risk appetite. Additionally, implementing compensating controls (Option C) can further reduce residual risk to an acceptable level, even if primary controls are already in place.

Answer

Document the risk in the risk register and accept it

Answer

Immediately perform a new risk assessment

Question 7

Match each risk assessment activity with the correct phase of the risk management lifecycle:

Activities:
1. Identify assets and threats
2. Determine risk level
3. Select controls to reduce risk
4. Monitor risk over time

Phases:
A. Risk Assessment
B. Risk Treatment
C. Risk Monitoring
D. Risk Communication (not used)

Answer

Identify assets and threats

Answer

Determine risk level

Answer

Select controls to reduce risk

Answer

Monitor risk over time

Question 8

A security manager is evaluating risk treatment options for a high-risk vulnerability. Drag each option to the correct risk treatment category.

Options:
- Apply a vendor patch
- Purchase cyber insurance
- Decommission the system
- Accept the risk with formal sign-off
- Install a WAF (Web Application Firewall)

Categories:
- Mitigate
- Transfer
- Avoid
- Accept

Question 9

Which of the following are key components of an information security risk management program? (Select TWO)

Accepted Answer

Risk assessment. Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

Answer

Vulnerability scanning

Answer

Incident response

Question 10

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Accepted Answer

Scope definition, then Planning, then Execution, then Documentation, then Reporting. Audits start with scope definition, planning, execution, documentation, and reporting.

Answer

Planning, then Scope definition, then Execution, then Documentation, then Reporting

Answer

Scope definition, then Planning, then Reporting, then Execution, then Documentation

Answer

Scope definition, then Execution, then Planning, then Documentation, then Reporting