CISM Information Security Risk Management Practice Test 10 — 15 Questions

Question 1

A retail company's risk committee is reviewing the annual risk assessment. The CISO notes that the organization's stated risk appetite for customer data confidentiality is low, but a business unit wants to launch a loyalty program that shares purchase history with a third-party analytics provider. Which of the following should the CISO do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a risk assessment of the proposed data sharing and compare the residual risk to the defined risk appetite.. Risk decisions should begin with assessment. The CISO must evaluate the data-sharing risk and compare residual exposure to the organization's low confidentiality appetite before recommending acceptance, mitigation, or rejection. Approving on reputation, escalating without analysis, or rejecting categorically all skip the assessment step that makes the decision defensible.

Answer

Approve the program because the third party has a strong security reputation.

Answer

Reject the program because any third-party data sharing exceeds a low risk appetite.

Answer

Escalate the decision to the board of directors immediately.

Question 2

A retail company has a documented risk appetite stating that it will accept no more than a moderate level of risk to customer payment data. A recent assessment shows the payment environment carries a high residual risk after existing controls. What should the information security manager do FIRST?

Accepted Answer

Escalate the residual risk to senior management as a risk above the approved appetite.. Risk appetite defines the amount of risk leadership is willing to accept in pursuit of objectives. When residual risk exceeds that boundary, the information security manager's first obligation is to escalate the exception to senior management, who own the decision to remediate, accept, or adjust strategy. Acting unilaterally or rewriting the appetite statement would bypass proper governance.

Answer

Document the residual risk in the risk register and continue monitoring it on the normal reporting cycle.

Answer

Revise the risk appetite statement so the current residual risk falls within acceptable limits.

Answer

Immediately implement additional controls and then report the change in risk level.

Question 3

A software-as-a-service provider must decide how to treat a newly identified risk: a critical vulnerability in an open-source library used by its customer-facing application. No patch is available from the maintainer, and exploitation in the wild has been observed at other firms. The vulnerability cannot be removed without breaking core functionality. Which risk treatment option is being applied if the company deploys a virtual patch at the web application firewall and tightens monitoring?

Accepted Answer

Risk mitigation. The organization is reducing the likelihood of exploitation through compensating technical controls while a permanent remedy is unavailable, which is the essence of risk mitigation. Avoidance would require removing the vulnerable function, transfer would require an insurer or contractual party to absorb the loss, and acceptance would mean taking no action. Virtual patching and monitoring modify the risk itself.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Question 4

A healthcare insurer's third-party risk manager learns that a critical claims-processing vendor has been acquired by a foreign parent company subject to different data protection laws. The vendor contract contains no change-of-control clause. What should the risk manager do FIRST?

Accepted Answer

Perform a risk assessment of the change in ownership and its impact on data protection obligations.. A change of control at a critical vendor is a risk event that must be reassessed before any treatment decision. Because the contract lacks a change-of-control clause, the organization cannot rely on contractual levers and must understand the new legal, privacy, and operational exposure. Assessing first supports an informed choice among renegotiation, added controls, or managed exit, and preserves evidence of due diligence.

Answer

Immediately terminate the vendor contract and migrate claims processing in-house.

Answer

Report the acquisition to the regulator and await instructions before taking any action.

Answer

Accept the change because the vendor's service-level agreement remains unchanged.

Question 5

A financial services firm is building a risk register for its information security program. The CISO wants to ensure the register supports effective risk treatment decisions. Which TWO of the following elements are MOST essential to include for each identified risk? (Choose two.)

Accepted Answer

The risk owner accountable for managing the risk.. A risk owner and assessed likelihood and impact are essential because they enable accountability and prioritization. The owner ensures action is taken, while likelihood and impact ratings allow the CISO to compare risks and decide on treatment. Other details, such as identification date, auditor name or a specific vulnerability, may be useful for context but do not directly drive risk treatment decisions.

Answer

The name of the auditor who reviewed the risk.

Answer

The specific technical vulnerability that generated the risk.

Answer

The date the risk was first identified.

Question 6

A manufacturing company is integrating a newly acquired subsidiary into its enterprise risk management program. The CISO must establish controls to ensure risk assessments from the subsidiary are reliable. Which TWO of the following activities BEST provide assurance that the subsidiary's risk assessment results are trustworthy? (Choose two.)

Accepted Answer

Require the subsidiary to use the parent company's approved risk assessment methodology, scales, and scoring criteria.. Reliability of subsidiary risk data rests on two pillars: a common methodology so outputs are comparable, and independent validation so the process is actually followed and conclusions are evidence-based. Filtering reported risks, retaining divergent templates, and delegating acceptance without oversight each undermine one or both pillars, leaving the parent unable to trust or aggregate subsidiary assessments.

Answer

Delegate full authority for risk acceptance to the subsidiary's local management without oversight.

Answer

Allow the subsidiary to retain its existing risk assessment templates to preserve continuity with prior years.

Answer

Instruct the subsidiary to report only risks that exceed the enterprise risk appetite threshold.

Question 7

An information security manager is building a risk register for a newly formed risk management program. Which TWO of the following elements are essential components of each documented risk entry? (Choose two.)

Accepted Answer

The likelihood and impact ratings used to determine the risk level.. A risk register entry must identify who owns the risk and how severe it is. The named owner provides accountability for treatment and reporting, while likelihood and impact ratings establish the risk level that drives prioritization. Supporting details such as product versions, access lists, and network diagrams live in other repositories and should be referenced rather than embedded in the register.

Answer

The complete network diagram of the data center hosting the asset.

Answer

The specific antivirus product version deployed on affected endpoints.

Answer

The names of every employee who has access to the affected system.

Question 8

An information security manager is reviewing a risk assessment for a core banking application. The assessment shows a high likelihood of insider misuse of privileged accounts and a high impact on regulatory compliance. The application owner proposes adding database activity monitoring, but the budget is limited and the control would take nine months to deploy. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Implement interim compensating controls such as privileged access review, session logging, and least privilege while planning the monitoring deployment.. When a strategic control cannot be deployed quickly, interim compensating controls reduce exposure in the near term. Privileged access reviews, session logging, and least privilege target the insider misuse scenario directly and are feasible within budget. Acceptance, insurance-only transfer, or full delegation do not adequately address a high-likelihood compliance risk during the deployment gap.

Answer

Accept the risk until the monitoring solution is deployed and document the decision.

Answer

Transfer the risk by purchasing cyber insurance covering insider fraud.

Answer

Defer the risk decision to the application owner because they own the budget.

Question 9

An information security manager is calculating the annualized loss expectancy for a data center outage. The facility has a single point of failure, and a full outage is estimated to occur once every 25 years with a loss of $4,000,000 per event. A redundant power and cooling project would cost $900,000 and reduce the frequency to once every 100 years. What is the expected annual risk reduction, and how should the manager interpret it?

Accepted Answer

$120,000; the manager should compare it with the project cost and consider qualitative factors before recommending treatment.. Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. Before the project the value is $160,000; after it is $40,000; the expected annual risk reduction is $120,000. The manager should treat this as one input, comparing it with the project cost and weighing qualitative and regulatory factors before recommending treatment.

Answer

$120,000; the project cost exceeds the annual benefit and should be rejected outright.

Answer

$40,000; the project should be approved because any reduction in high-impact risk is always cost-justified.

Answer

$160,000; the project is justified because the reduction equals the current annualized loss expectancy.

Question 10

A CISO is explaining the concept of risk appetite to a newly formed security steering committee. Which of the following BEST describes risk appetite?

Accepted Answer

The amount and type of risk that the organization is willing to pursue or retain to achieve its objectives.. Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. It is a strategic, governance-level concept that sets the boundaries for risk-taking and guides decisions about security investments and risk treatment. It is distinct from tolerance, which defines acceptable variation, and from assessment or residual risk, which are operational concepts.

Answer

The residual risk that remains after all reasonable controls have been implemented.

Answer

The process of identifying, analyzing and evaluating risks to determine their significance.

Answer

The maximum level of risk that the organization can tolerate before exceeding its risk tolerance.

Question 11

A software company is entering a market that requires compliance with a new data protection regulation. The CISO must present a risk-based implementation plan to the executive committee. Which of the following BEST demonstrates alignment between the security program and the organization's compliance obligations?

Accepted Answer

A gap assessment mapping current controls to each regulatory requirement with prioritized remediation based on risk.. A gap assessment that maps controls to regulatory requirements and prioritizes remediation by risk directly demonstrates alignment between the security program and compliance obligations. It gives executives a clear view of exposure and a plan for closure. Tool inventories, commitment statements, and peer benchmarks lack the requirement-to-control mapping needed for a risk-based implementation plan.

Answer

A benchmark comparison showing that peer companies spend more on security.

Answer

A list of all security tools currently deployed with their license costs.

Answer

A statement that the organization will comply with the regulation by the deadline.

Question 12

A security manager is building a risk register for a newly deployed customer relationship management platform. Which TWO of the following entries are most appropriate to record as risks rather than as controls or assets? (Choose two.)

Accepted Answer

A disgruntled employee could export the entire customer database before their account is disabled.. A risk register records uncertain events that could affect objectives, expressed as a threat exploiting a weakness with a potential impact. The misconfigured API exposure and the disgruntled employee data export both meet that definition and require owners, likelihood, impact, and treatment. The access control, redundant data center, and service-level agreement are controls or assurances, not risks.

Answer

The platform enforces role-based access control for all administrative functions.

Answer

The platform is hosted in a tier III data center with redundant power and cooling.

Answer

The vendor's contract includes a 99.9 percent uptime service-level agreement.

Question 13

An information security manager is advising a business unit that wants to launch a customer-facing mobile application in a market with new data protection regulations. The unit's leadership prefers to launch quickly and address compliance later. Which action BEST aligns with effective information security risk management?

Accepted Answer

Perform a risk assessment of the launch against the new regulations and present treatment options with business impact to leadership.. Effective risk management supports business objectives by making risk visible and manageable rather than by blocking initiatives. Assessing the launch against the new regulations and presenting treatment options with their business impact allows leadership to weigh speed against compliance exposure and make a documented, risk-aware decision within their authority.

Answer

Recommend blocking the launch until the security team completes a full independent audit of the application.

Answer

Delegate the regulatory risk decision to the business unit's legal counsel and document the outcome.

Answer

Advise the unit to proceed with the launch and remediate regulatory gaps in a post-launch phase.

Question 14

A security manager is selecting a risk analysis method for a new mobile banking feature. The team has limited historical data, and leadership wants a defensible view of which threats matter most before committing budget. Which approach BEST fits this situation?

Accepted Answer

Qualitative analysis using structured scenario ranking with defined likelihood and impact scales.. When historical loss data is scarce, a structured qualitative analysis using consistent likelihood and impact scales lets the organization rank threats defensibly and allocate budget. It relies on expert judgment but remains repeatable and auditable, and it can transition to quantitative methods as actual incident and loss data become available for the new feature.

Answer

A control self-assessment survey completed by the mobile development team.

Answer

A penetration test of the mobile application to identify exploitable vulnerabilities.

Answer

Quantitative analysis using annualized loss expectancy derived from actuarial tables.

Question 15

A risk manager is updating the organization's risk assessment methodology. The current approach uses a qualitative scale (High/Medium/Low) for likelihood and impact. Senior management wants a more objective and consistent way to compare risks across different business units. Which of the following should the risk manager implement to BEST meet this requirement?

Accepted Answer

Adopt a quantitative risk assessment approach using monetary values for impact and annualized loss expectancy.. A quantitative risk assessment approach using monetary values and annualized loss expectancy provides objective, numerical data that can be consistently compared across business units. This meets senior management's requirement for a more objective and consistent methodology. Qualitative enhancements like more levels, risk matrices, or Delphi exercises still rely on subjective judgments and do not offer the same level of comparability or objectivity as quantitative methods.

Answer

Enhance the qualitative scale by adding more levels (e.g., Very High, High, Medium, Low, Very Low).

Answer

Use a risk matrix that combines likelihood and impact into a single risk score.

Answer

Conduct a Delphi technique exercise with subject matter experts to reach consensus on risk ratings.