CISM Information Security Risk Management — All Questions With Answers

Question 1hardmultiple choice

Read the full Information Security Risk Management explanation →

A security manager is evaluating risk treatment options for a high-risk vulnerability. Drag each option to the correct risk treatment category.

Options: - Apply a vendor patch - Purchase cyber insurance - Decommission the system - Accept the risk with formal sign-off - Install a WAF (Web Application Firewall)

Categories: - Mitigate - Transfer - Avoid - Accept

Answer choices are not available in this preview. Open the full question page for the complete review.

Question 2mediummultiple choice

Read the full Information Security Risk Management explanation →

A company is choosing a risk assessment methodology for a new cloud-based application. The CISO prefers a method that uses monetary values and numerical probabilities to compute annual loss expectancy. Which methodology should be selected?

Question 3easymultiple choice

Read the full Information Security Risk Management explanation →

A regional hospital is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). During an internal audit, it was discovered that patient electronic health records (EHRs) are transmitted over the internet without encryption. The risk manager has been asked to recommend a risk treatment. Which action should be prioritized to address this finding?

Question 4mediummultiple choice

Read the full Information Security Risk Management explanation →

A financial institution is implementing a new online banking platform. The risk assessment identified that the authentication module has a high likelihood of exploitation due to weak password policies. The risk owner has decided to implement multi-factor authentication (MFA) to reduce the risk. This is an example of which risk response strategy?

Question 5hardmultiple choice

Read the full Information Security Risk Management explanation →

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

Question 6easymultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, a CISM identifies that the organization's data backup process has a single point of failure. The backup server is located in the same data center as the primary server. Which risk response is most appropriate?

Question 7mediummultiple choice

Read the full Information Security Risk Management explanation →

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

Question 8hardmultiple choice

Read the full Information Security Risk Management explanation →

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Question 9easymultiple choice

Read the full Information Security Risk Management explanation →

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

Question 10hardmulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Question 11mediummulti select

Read the full Information Security Risk Management explanation →

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly three.)

Question 12hardmultiple choice

Read the full Information Security Risk Management explanation →

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Exhibit

Refer to the exhibit.

Exhibit:
```
CISCO ASA Firewall Config Snippet
access-list INSIDE extended permit tcp 10.0.0.0 255.255.255.0 any eq 443
access-list INSIDE extended permit udp 10.0.0.0 255.255.255.0 any eq 53
access-list OUTSIDE extended deny ip any any
```

Question 13mediummultiple choice

Read the full Information Security Risk Management explanation →

Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?

Exhibit

Refer to the exhibit.

Exhibit:
```
Log Entry:
Jan 15 09:23:45 server1 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Jan 15 09:23:47 server1 sshd[1235]: Failed password for admin from 10.0.0.5 port 22 ssh2
Jan 15 09:23:50 server1 sshd[1236]: Failed password for root from 10.0.0.5 port 22 ssh2
Jan 15 09:23:52 server1 sshd[1237]: Failed password for admin from 10.0.0.5 port 22 ssh2
```

Question 14hardmultiple choice

Read the full Information Security Risk Management explanation →

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Question 15mediummultiple choice

Read the full Information Security Risk Management explanation →

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Question 16hardmulti select

Read the full Information Security Risk Management explanation →

An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?

Question 17easymultiple choice

Read the full Information Security Risk Management explanation →

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Exhibit

Refer to the exhibit.

```
Risk Assessment Log
Date: 2025-03-01
Asset: Database Server DB-01
Threat: Unauthorized access
Vulnerability: Weak password policy
Current Controls: Password complexity enabled, account lockout after 5 failed attempts
Likelihood: 3 (Moderate)
Impact: 4 (Major)
Risk Level: 12 (High)
Risk Appetite Threshold: 10
```

Question 18hardmultiple choice

Read the full Information Security Risk Management explanation →

A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?

Question 19mediummultiple choice

Read the full Information Security Risk Management explanation →

Which of the following is the PRIMARY reason for an information security manager to integrate risk management into the organization's enterprise risk management (ERM) framework?

Question 20hardmultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Question 21mediummulti select

Read the full Information Security Risk Management explanation →

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Question 22hardmulti select

Read the full Information Security Risk Management explanation →

An organization has a high residual risk after implementing all feasible controls. According to CISM best practices, which of the following should the information security manager do? (Select TWO.)

Question 23mediummultiple choice

Read the full Information Security Risk Management explanation →

Match each risk assessment activity with the correct phase of the risk management lifecycle:

Activities: 1. Identify assets and threats 2. Determine risk level 3. Select controls to reduce risk 4. Monitor risk over time

Phases: A. Risk Assessment B. Risk Treatment C. Risk Monitoring D. Risk Communication (not used)

Question 24easymultiple choice

Read the full Information Security Risk Management explanation →

Which of the following is the PRIMARY purpose of an information security risk assessment?

Question 25mediummultiple choice

Read the full Information Security Risk Management explanation →

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Question 26hardmultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

Question 27mediummulti select

Read the full Information Security Risk Management explanation →

Which of the following are key components of an information security risk management program? (Select TWO)

Question 28hardmulti select

Read the full Information Security Risk Management explanation →

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Question 29mediumdrag order

Read the full Information Security Risk Management explanation →

Order the steps for implementing a security awareness training program.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 30mediumdrag order

Read the full Information Security Risk Management explanation →

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 31mediumdrag order

Read the full Information Security Risk Management explanation →

Order the steps for implementing a data classification policy in an organization.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 32mediummatching

Read the full Information Security Risk Management explanation →

Match each risk management term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Risk level before controls are applied

Risk remaining after controls are implemented

Amount of risk the organization is willing to accept

Acceptable variation around the risk appetite

Process of modifying risk by applying controls

Question 33mediummatching

Read the full Information Security Risk Management explanation →

Match each business continuity term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Maximum time to restore a process after disruption

Maximum age of data that must be recovered

Plan to maintain business functions during disruption

Plan to restore IT infrastructure after disaster

Process to identify critical functions and dependencies

Question 34mediummatching

Read the full Information Security Risk Management explanation →

Match each cryptographic term to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Uses same key for encryption and decryption

Uses public/private key pair

One-way transformation producing fixed-size digest

Provides authenticity and non-repudiation

Framework managing digital certificates and keys

Question 35easymultiple choice

Read the full Information Security Risk Management explanation →

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

Question 36mediummultiple choice

Read the full Information Security Risk Management explanation →

A security manager is conducting a risk assessment for a new cloud-based system. The system will store sensitive customer data. Which of the following should be the FIRST step in the risk assessment process?

Question 37hardmultiple choice

Read the full Information Security Risk Management explanation →

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

Question 38easymultiple choice

Read the full Information Security Risk Management explanation →

A risk manager is presenting risk treatment options to senior management. Which of the following is the BEST approach to communicate risk in a way that supports informed decision-making?

Question 39mediummultiple choice

Read the full Information Security Risk Management explanation →

A company is implementing a risk management program and needs to define risk appetite. Which of the following is the MOST appropriate statement of risk appetite for a financial institution?

Question 40hardmultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, the risk team identifies that a key vendor has access to sensitive data. The vendor's security posture is unclear. Which of the following is the BEST course of action?

Question 41easymultiple choice

Read the full Information Security Risk Management explanation →

Which of the following best describes residual risk?

Question 42mediummultiple choice

Read the full Information Security Risk Management explanation →

A risk manager is evaluating a control that reduces the likelihood of a threat from high to low. The cost of the control is $100,000 annually. The expected loss without the control is $500,000 per year. Which of the following should the risk manager recommend?

Question 43hardmultiple choice

Read the full Information Security Risk Management explanation →

An organization's risk management policy requires a quantitative risk assessment for all new projects. The project team estimates that a data breach could occur once every 5 years with an average loss of $2 million. What is the annualized loss expectancy (ALE)?

Question 44easymulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are key components of an information security risk assessment? (Choose two.)

Question 45mediummulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are valid risk treatment options according to ISO 31000? (Choose two.)

Question 46hardmulti select

Read the full Information Security Risk Management explanation →

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Question 47easymultiple choice

Read the full Information Security Risk Management explanation →

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Question 48mediummultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

Question 49hardmultiple choice

Read the full Information Security Risk Management explanation →

A multinational organization is evaluating its risk appetite for a new cloud-based customer relationship management (CRM) system. The system will store personal data across multiple jurisdictions with varying data protection laws. The risk committee has set a risk appetite statement that allows only low residual risk. Which of the following controls is MOST critical to ensure compliance with the risk appetite?

Question 50easymultiple choice

Read the full Information Security Risk Management explanation →

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Question 51mediummultiple choice

Read the full Information Security Risk Management explanation →

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Question 52hardmultiple choice

Read the full Information Security Risk Management explanation →

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Question 53easymultiple choice

Read the full Information Security Risk Management explanation →

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

Question 54mediummultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Question 55hardmultiple choice

Read the full Information Security Risk Management explanation →

An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?

Question 56mediummulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Question 57hardmulti select

Read the full Information Security Risk Management explanation →

Which THREE of the following are valid methods to identify information security risks? (Choose three.)

Question 58easymulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Question 59hardmultiple choice

Read the full Information Security Risk Management explanation →

During a risk assessment, an organization identifies that a legacy system processes credit card data and has a high likelihood of being exploited. The cost to remediate the vulnerability is $500,000, while the potential loss from a breach is $2 million with a 30% annual probability. What is the most appropriate risk treatment decision based on this information?

Question 60easymultiple choice

Read the full Information Security Risk Management explanation →

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

Question 61mediummultiple choice

Read the full Information Security Risk Management explanation →

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Question 62hardmultiple choice

Read the full Information Security Risk Management explanation →

A company has a risk appetite that is 'low' for operational risks. A risk assessment recently identified that a high-speed trading platform has a residual risk rating of 'high' after controls are applied. The cost to further reduce the risk is $1 million, which exceeds the expected benefit. What is the most appropriate action for the risk owner?

Question 63easymultiple choice

Read the full Information Security Risk Management explanation →

Which of the following best describes the difference between risk appetite and risk tolerance?

Question 64mediummultiple choice

Read the full Information Security Risk Management explanation →

After implementing controls, an organization reassesses a risk and finds that the residual risk level exceeds the established risk tolerance. What is the most appropriate next step?

Question 65hardmultiple choice

Read the full Information Security Risk Management explanation →

A security manager is preparing a risk report for the board of directors. Which of the following should be included to best support strategic risk-based decisions?

Question 66easymultiple choice

Read the full Information Security Risk Management explanation →

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Question 67mediummulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are common approaches to information security risk assessment?

Question 68hardmulti select

Read the full Information Security Risk Management explanation →

Which THREE of the following are essential components of an information security risk management framework?

Question 69easymulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are valid risk response options?

Question 70hardmultiple choice

Read the full Information Security Risk Management explanation →

Which host should be prioritized for risk mitigation based on the vulnerability scan results?

Exhibit

Refer to the exhibit.

Vulnerability Scan Summary Report
11-Jun-2023 04:15:42

Host: 192.168.10.25
Total vulnerabilities: 12
Critical: 2
High: 4
Medium: 3
Low: 3

Host: 192.168.10.30
Total vulnerabilities: 8
Critical: 0
High: 1
Medium: 5
Low: 2

Host: 192.168.10.35
Total vulnerabilities: 20
Critical: 5
High: 6
Medium: 7
Low: 2

Question 71mediummultiple choice

Read the full Information Security Risk Management explanation →

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

Exhibit

Refer to the exhibit.

{
  "dataClassification": {
    "public": {
      "description": "Information that can be disclosed to anyone",
      "handling": "No special protection required"
    },
    "internal": {
      "description": "Information for internal use only",
      "handling": "Must be stored on internal systems, encrypted in transit"
    },
    "confidential": {
      "description": "Sensitive information with legal or contractual obligations",
      "handling": "Must be encrypted at rest and in transit, access on a need-to-know basis"
    },
    "highlyConfidential": {
      "description": "Information that could cause severe reputational damage if disclosed",
      "handling": "All 'confidential' protections plus multifactor authentication, data loss prevention, and quarterly access reviews"
    }
  }
}

Question 72easymultiple choice

Read the full Information Security Risk Management explanation →

Which of the following is the most significant risk in this architecture?

Exhibit

Refer to the exhibit.

Network Architecture Description:
- Internet facing web server (DMZ)
- Application server (internal trust zone)
- Database server (restricted zone)
- All zones separated by firewalls
- Admin access to database server requires VPN + jump host
- All traffic from web server to application server encrypted with TLS 1.3
- Application server has direct access to database using SQL authentication

Question 73mediummultiple choice

Read the full Information Security Risk Management explanation →

A financial institution is implementing a risk management program and needs to select a methodology that balances quantitative and qualitative factors, complies with regulatory requirements, and provides a consistent framework for risk assessment across business units. Which methodology would best meet these requirements?

Question 74easymultiple choice

Read the full Information Security Risk Management explanation →

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

Question 75hardmultiple choice

Read the full Information Security Risk Management explanation →

After implementing controls, the residual risk is calculated to be at a level that slightly exceeds the risk appetite. The business owner argues that the cost of further mitigation outweighs the benefit. What is the most appropriate action for the risk manager?

Question 76mediummultiple choice

Read the full Information Security Risk Management explanation →

A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?

Question 77easymultiple choice

Read the full Information Security Risk Management explanation →

A company engages a third-party vendor to process customer data. Which of the following is the most critical step in managing the associated risk?

Question 78hardmultiple choice

Read the full Information Security Risk Management explanation →

A risk manager is aggregating risks across the enterprise and finds that multiple individual risks, each with low impact and low probability, could combine to create a significant risk. What is the best approach to address this?

Question 79mediummultiple choice

Read the full Information Security Risk Management explanation →

An organization selects a control to mitigate a risk, but after implementation, the risk level remains unchanged. What should the risk manager do first?

Question 80easymultiple choice

Read the full Information Security Risk Management explanation →

Which of the following is the primary purpose of communicating risk assessment results to senior management?

Question 81hardmultiple choice

Read the full Information Security Risk Management explanation →

A risk manager is establishing risk appetite for a new product line. Which of the following best describes the relationship between risk appetite and risk tolerance?

Question 82easymulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are risk treatment strategies as defined in ISO 27005?

Question 83easymulti select

Read the full Information Security Risk Management explanation →

Which TWO of the following are examples of key risk indicators (KRIs) for cybersecurity risk?

Question 84mediummulti select

Read the full Information Security Risk Management explanation →

Which THREE of the following are typical steps in a qualitative risk assessment?

Question 85mediummultiple choice

Read the full Information Security Risk Management explanation →

Based on the exhibit, which risk should be addressed first if the organization has limited resources?

Network Topology

Question 86hardmultiple choice

Read the full Information Security Risk Management explanation →

A multinational corporation is expanding its cloud infrastructure across multiple regions. The risk team has identified that the shared responsibility model for cloud security is not well understood by business units. After a recent audit, several misconfigurations led to a data exposure incident that affected one region. The CISO wants to implement a risk management program that ensures consistent control across all regions. As the risk manager, what is the most effective course of action to reduce the risk of similar incidents?

Question 87hardmultiple choice

Read the full Information Security Risk Management explanation →

A healthcare organization is merging with another entity and must integrate their IT systems. During due diligence, it is discovered that the acquired company has a high number of unpatched critical vulnerabilities in its electronic health record (EHR) system. The merger timeline is aggressive and the integration team wants to proceed as planned. As the risk manager, what is the best course of action?

Question 88mediummulti select

Read the full Information Security Risk Management explanation →

A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?

Question 89easymultiple choice

Read the full Information Security Risk Management explanation →

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

Question 90mediummultiple choice

Read the full Information Security Risk Management explanation →

A large retail chain with hundreds of stores uses point-of-sale (POS) systems that run an outdated operating system. The annual risk assessment identified this as a high-risk issue because the OS is no longer patched and has known vulnerabilities. The business unit manager opposes replacing all POS systems immediately due to cost and potential disruption to operations. As the risk manager, you need to recommend a risk response that balances risk reduction with business continuity. Which strategy is most appropriate?

Question 91hardmultiple choice

Read the full Information Security Risk Management explanation →

A global financial services firm uses a Monte Carlo simulation model to quantify the potential financial impact of cyber events. The model inputs include historical loss data, threat intelligence, and control effectiveness. Over the past year, the model has consistently underestimated actual losses by an average of 40%. The risk manager suspects model risk but the quantitative team argues the model is peer-reviewed. The board is concerned about the accuracy of risk reporting. What is the best course of action for the risk manager?

Question 92hardmultiple choice

Read the full Information Security Risk Management explanation →

A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?

Question 93mediummulti select

Read the full Information Security Risk Management explanation →

An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?

Question 94hardmultiple choice

Read the full Information Security Risk Management explanation →

Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?

Exhibit

Risk Register Extract:
Risk ID: R-001
Description: Unauthorized access to sensitive data
Current Controls: Firewall, Access control lists
Inherent Risk: High (Likelihood: 4, Impact: 5)
Residual Risk: Medium (Likelihood: 3, Impact: 4)
Risk Appetite: Low

Risk ID: R-002
Description: Data corruption due to malware
Current Controls: Antivirus software
Inherent Risk: High (Likelihood: 5, Impact: 4)
Residual Risk: High (Likelihood: 4, Impact: 4)
Risk Appetite: Low

Question 95easymultiple choice

Read the full Information Security Risk Management explanation →

A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?

Question 96mediummultiple choice

Read the full Information Security Risk Management explanation →

An organization has implemented a risk management framework based on ISO 27005. During the risk identification phase, a new vulnerability is discovered in a critical business application that could lead to a data breach. According to ISO 27005, which of the following is the NEXT step the organization should take?

Question 97hardmultiple choice

Read the full Information Security Risk Management explanation →

A multinational corporation is establishing a risk appetite framework. The board has defined risk appetite as 'no more than one major security incident per year resulting in financial loss exceeding $1M'. Which of the following best represents the risk tolerance for a specific business unit's annual cybersecurity budget allocation?

Question 98easymultiple choice

Read the full Information Security Risk Management explanation →

An information security manager is designing a risk dashboard for the board of directors. Which of the following key risk indicators (KRIs) would be MOST effective for monitoring changes in the organization's security posture related to third-party risk?

Question 99mediummulti select

Read the full Information Security Risk Management explanation →

A financial services company is updating its risk treatment plan for a high-risk legacy system that processes customer data. The risk owner has recommended acceptance of the risk. Which TWO conditions must be met for the risk acceptance to be valid according to ISACA CISM (Certified Information Security Manager) best practices?

Question 100mediummulti select

Read the full Information Security Risk Management explanation →

An organization is implementing a new cloud-based ERP system. As part of the emerging risk assessment, the information security manager needs to identify potential risks associated with the cloud migration. Which THREE of the following should be considered as part of the emerging risk assessment for cloud adoption?

Refer to the exhibit. Exhibit: ``` CISCO ASA Firewall Config Snippet access-list INSIDE extended permit tcp 10.0.0.0 255.255.255.0 any eq 443 access-list INSIDE extended permit udp 10.0.0.0 255.255.255.0 any eq 53 access-list OUTSIDE extended deny ip any any ```

Refer to the exhibit. Exhibit: ``` Log Entry: Jan 15 09:23:45 server1 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2 Jan 15 09:23:47 server1 sshd[1235]: Failed password for admin from 10.0.0.5 port 22 ssh2 Jan 15 09:23:50 server1 sshd[1236]: Failed password for root from 10.0.0.5 port 22 ssh2 Jan 15 09:23:52 server1 sshd[1237]: Failed password for admin from 10.0.0.5 port 22 ssh2 ```

Refer to the exhibit. ``` Risk Assessment Log Date: 2025-03-01 Asset: Database Server DB-01 Threat: Unauthorized access Vulnerability: Weak password policy Current Controls: Password complexity enabled, account lockout after 5 failed attempts Likelihood: 3 (Moderate) Impact: 4 (Major) Risk Level: 12 (High) Risk Appetite Threshold: 10 ```

Refer to the exhibit. Vulnerability Scan Summary Report 11-Jun-2023 04:15:42 Host: 192.168.10.25 Total vulnerabilities: 12 Critical: 2 High: 4 Medium: 3 Low: 3 Host: 192.168.10.30 Total vulnerabilities: 8 Critical: 0 High: 1 Medium: 5 Low: 2 Host: 192.168.10.35 Total vulnerabilities: 20 Critical: 5 High: 6 Medium: 7 Low: 2

Refer to the exhibit. { "dataClassification": { "public": { "description": "Information that can be disclosed to anyone", "handling": "No special protection required" }, "internal": { "description": "Information for internal use only", "handling": "Must be stored on internal systems, encrypted in transit" }, "confidential": { "description": "Sensitive information with legal or contractual obligations", "handling": "Must be encrypted at rest and in transit, access on a need-to-know basis" }, "highlyConfidential": { "description": "Information that could cause severe reputational damage if disclosed", "handling": "All 'confidential' protections plus multifactor authentication, data loss prevention, and quarterly access reviews" } } }

Refer to the exhibit. Network Architecture Description: - Internet facing web server (DMZ) - Application server (internal trust zone) - Database server (restricted zone) - All zones separated by firewalls - Admin access to database server requires VPN + jump host - All traffic from web server to application server encrypted with TLS 1.3 - Application server has direct access to database using SQL authentication

Risk Register Extract: Risk ID: R-001 Description: Unauthorized access to sensitive data Current Controls: Firewall, Access control lists Inherent Risk: High (Likelihood: 4, Impact: 5) Residual Risk: Medium (Likelihood: 3, Impact: 4) Risk Appetite: Low Risk ID: R-002 Description: Data corruption due to malware Current Controls: Antivirus software Inherent Risk: High (Likelihood: 5, Impact: 4) Residual Risk: High (Likelihood: 4, Impact: 4) Risk Appetite: Low