CISM Information Security Risk Management — 25 Questions

Question 1

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Avoid the risk by not engaging vendors that cannot meet security requirements.. Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.

Answer

Mitigate the risk by conducting regular vendor audits.

Answer

Transfer the risk by requiring vendors to have cyber insurance.

Answer

Accept the risk because third-party risks are unavoidable.

Question 2

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Accepted Answer

Risk of data exfiltration via DNS tunneling.. The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Answer

Risk of unauthorized external access to internal services.

Answer

Risk of denial-of-service attacks from internal hosts.

Answer

Risk of IP spoofing attacks from the inside network.

Question 3

Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?

Accepted Answer

Implement account lockout after 3 failed attempts.. Implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.

Answer

Change the password policy to require 12-character passwords.

Answer

Increase logging verbosity to capture more details.

Answer

Disable SSH access and use console only.

Question 4

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Accepted Answer

Recommend implementing multifactor authentication to reduce the risk. Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer

Accept the risk because the likelihood is only moderate

Answer

Reassess the risk with a higher risk appetite threshold

Answer

Transfer the risk by purchasing cyber insurance

Question 5

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Accepted Answer

Risk acceptance with formal sign-off by senior management. When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.

Answer

Risk mitigation by implementing compensating controls

Answer

Risk transfer through cyber insurance

Answer

Risk avoidance by decommissioning the system

Question 6

An organization has a high residual risk after implementing all feasible controls. According to CISM best practices, which of the following should the information security manager do? (Select TWO.)

Accepted Answer

Escalate to senior management for risk acceptance. When residual risk remains high after all feasible controls are implemented, the information security manager should escalate the risk to senior management for formal risk acceptance (Option A). This aligns with CISM best practices, as senior management holds the authority to accept risks that exceed the organization's risk appetite. Additionally, implementing compensating controls (Option C) can further reduce residual risk to an acceptable level, even if primary controls are already in place.

Answer

Document the risk in the risk register and accept it

Answer

Immediately perform a new risk assessment

Question 7

Match each risk assessment activity with the correct phase of the risk management lifecycle:

Activities:
1. Identify assets and threats
2. Determine risk level
3. Select controls to reduce risk
4. Monitor risk over time

Phases:
A. Risk Assessment
B. Risk Treatment
C. Risk Monitoring
D. Risk Communication (not used)

Answer

Identify assets and threats

Answer

Determine risk level

Answer

Select controls to reduce risk

Answer

Monitor risk over time

Question 8

A security manager is evaluating risk treatment options for a high-risk vulnerability. Drag each option to the correct risk treatment category.

Options:
- Apply a vendor patch
- Purchase cyber insurance
- Decommission the system
- Accept the risk with formal sign-off
- Install a WAF (Web Application Firewall)

Categories:
- Mitigate
- Transfer
- Avoid
- Accept

Question 9

Which of the following are key components of an information security risk management program? (Select TWO)

Accepted Answer

Risk assessment. Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

Answer

Vulnerability scanning

Answer

Incident response

Question 10

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Accepted Answer

Scope definition, then Planning, then Execution, then Documentation, then Reporting. Audits start with scope definition, planning, execution, documentation, and reporting.

Answer

Planning, then Scope definition, then Execution, then Documentation, then Reporting

Answer

Scope definition, then Planning, then Reporting, then Execution, then Documentation

Answer

Scope definition, then Execution, then Planning, then Documentation, then Reporting

Question 11

Match each cryptographic term to its description.

Accepted Answer

Symmetric Encryption: Uses a single shared key for both encryption and decryption. The correct matches are: Symmetric Encryption uses a shared key, Asymmetric Encryption uses a key pair, and Hash Function produces a one-way digest. Distractors confuse the purpose of digital signatures and the nature of PKI.

Answer

Digital Signature: Ensures confidentiality of data

Answer

Public Key Infrastructure (PKI): Uses a single shared key for both encryption and decryption

Question 12

Which THREE of the following are valid methods to identify information security risks? (Choose three.)

Accepted Answer

Business impact analysis (BIA). Business impact analysis (BIA) is correct because it systematically identifies and evaluates the potential effects of disruptions to critical business functions, which surfaces information security risks tied to availability, integrity, and business continuity. Threat modeling workshops are correct because they bring architects and stakeholders together to enumerate threats, attack vectors, and weaknesses against a system's design, directly identifying security risks before they materialize. Vulnerability scanning is correct because it uses tools to probe systems, networks, and applications for known weaknesses (e.g., missing patches, misconfigurations, CVEs), producing concrete evidence of existing information security risks. A financial audit focuses on the accuracy of financial statements and controls over financial reporting, not on identifying information security risks. Penetration testing is an exploitation-focused validation of existing vulnerabilities and controls rather than a primary risk-identification method, so it is not among the three correct answers here.

Answer

Financial audit

Answer

Penetration testing

Question 13

A company is choosing a risk assessment methodology for a new cloud-based application. The CISO prefers a method that uses monetary values and numerical probabilities to compute annual loss expectancy. Which methodology should be selected?

Accepted Answer

Quantitative risk assessment using SLE, ARO, and ALE. The CISO requires a methodology that uses monetary values and numerical probabilities to compute annual loss expectancy (ALE). Quantitative risk assessment directly calculates ALE using the formula ALE = SLE × ARO, where SLE (Single Loss Expectancy) is expressed in monetary terms and ARO (Annualized Rate of Occurrence) is a numerical probability. This matches the requirement precisely, whereas qualitative methods (like OCTAVE Allegro or risk matrices) use subjective scales, not hard monetary figures.

Answer

OCTAVE Allegro methodology

Answer

NIST SP 800-30 Revision 1 risk assessment process

Answer

Qualitative risk assessment using risk matrices

Question 14

During a risk assessment, an organization identifies that a legacy system processes credit card data and has a high likelihood of being exploited. The cost to remediate the vulnerability is $500,000, while the potential loss from a breach is $2 million with a 30% annual probability. What is the most appropriate risk treatment decision based on this information?

Accepted Answer

Risk mitigation by implementing controls to fix the vulnerability. The annualized loss expectancy (ALE) is $600,000 (30% × $2,000,000), which exceeds the $500,000 remediation cost, making mitigation economically justified. Implementing controls to fix the vulnerability directly reduces the high likelihood of exploitation on the legacy system processing credit card data, aligning with PCI DSS requirements for protecting cardholder data.

Answer

Risk transfer by purchasing cyber insurance

Answer

Risk acceptance because the probability is low

Answer

Risk avoidance by decommissioning the legacy system

Question 15

Which TWO of the following are valid risk response options?

Accepted Answer

Risk mitigation. Risk mitigation (C) is a valid risk response because it reduces either the probability or the impact of a threat by applying controls such as patching, segmentation, or encryption. Risk acceptance (D) is also valid: the organization acknowledges the risk and decides to take no action, typically because the cost of the control exceeds the potential loss or the risk falls within the defined risk appetite. Risk amplification (A) is not a recognized risk response; it would mean deliberately increasing exposure, which is not part of standard risk treatment. Risk neutralization (B) is not a standard term in risk management frameworks such as ISO 31000 or NIST RMF; risks are treated, not neutralized. Risk retention (E) is essentially a synonym for risk acceptance, but since the question asks for two answers and only C and D are marked correct, E is not counted as a separate valid option here.

Answer

Risk amplification

Answer

Risk neutralization

Answer

Risk retention

Question 16

Which host should be prioritized for risk mitigation based on the vulnerability scan results?

Accepted Answer

192.168.10.35. Host 192.168.10.35 is prioritized because it has the highest number of critical vulnerabilities (e.g., CVE-2023-XXXX with CVSS 9.8) and is exposed to the internet, increasing the likelihood of exploitation. Risk mitigation prioritization is based on the combination of vulnerability severity, asset criticality, and threat exposure, not just vulnerability count.

Answer

192.168.10.25

Answer

All hosts should be equally prioritized

Answer

192.168.10.30

Question 17

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

Accepted Answer

Confidential handling requirements. The email containing employee salaries was sent to all staff, which is a violation of the 'Confidential' handling requirement. Confidential data, such as salary information, must be restricted to authorized recipients only, and mass distribution to all staff exceeds that authorization. The exhibit likely classifies salary data as 'Confidential', not 'HighlyConfidential', making option B the correct minimum violated requirement.

Answer

HighlyConfidential handling requirements

Answer

Internal handling requirements

Answer

Public handling requirements

Question 18

Which of the following is the most significant risk in this architecture?

Accepted Answer

Direct SQL authentication from application server to database. Direct SQL authentication from the application server to the database bypasses any centralized authentication or service account management, creating a single point of failure for credential compromise. If the application server is breached, an attacker can extract hardcoded or stored database credentials and gain unfettered access to the database, leading to potential data exfiltration or destruction. This risk is magnified because direct SQL authentication often uses static, long-lived credentials without the layered controls (e.g., MFA, session auditing) that would be present in a more robust authentication path.

Answer

Segmentation of network zones

Answer

Admin access via VPN and jump host

Answer

Use of TLS 1.3 for encryption

Question 19

A financial institution is implementing a risk management program and needs to select a methodology that balances quantitative and qualitative factors, complies with regulatory requirements, and provides a consistent framework for risk assessment across business units. Which methodology would best meet these requirements?

Accepted Answer

ISO 27005. ISO 27005 is the correct methodology because it provides a risk management framework that explicitly balances quantitative and qualitative factors, aligns with regulatory requirements like GDPR and SOX, and offers a consistent, scalable approach for risk assessment across diverse business units. It integrates seamlessly with ISO 27001, ensuring compliance and standardization.

Answer

FAIR

Answer

OCTAVE

Answer

NIST SP 800-30

Question 20

Which TWO of the following are examples of key risk indicators (KRIs) for cybersecurity risk?

Accepted Answer

Time to patch critical vulnerabilities. Option A (Time to patch critical vulnerabilities) is a valid KRI because it is a forward-looking metric that measures exposure window and predicts the likelihood of exploitation, directly indicating how much risk accumulates while systems remain unpatched. Option D (Number of unresolved security incidents) is also a valid KRI because a growing backlog of open incidents signals deteriorating incident-response capability and elevated residual risk, making it a predictive indicator of potential breaches. Option B (Number of successful phishing simulations) is a training/awareness outcome metric rather than a risk indicator, as it measures employee susceptibility in a controlled exercise, not actual risk exposure. Option C (Number of vendors with SOC 2 reports) is a third-party assurance/compliance count, not a KRI, since it reflects due-diligence status rather than a measurable risk trend. Option E (Percentage of employees completing security training) is a compliance/training completion metric (a KPI), not a predictive risk indicator.

Answer

Number of successful phishing simulations

Answer

Number of vendors with SOC 2 reports

Answer

Percentage of employees completing security training