CISM Information Security Risk Management Practice Test 2 — 15 Questions

Question 1

An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?

Accepted Answer

Likelihood of threat actors targeting the system. Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.

Answer

Organization's risk appetite

Answer

Effectiveness of existing security controls

Question 2

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Accepted Answer

Recommend implementing multifactor authentication to reduce the risk. Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer

Accept the risk because the likelihood is only moderate

Answer

Reassess the risk with a higher risk appetite threshold

Answer

Transfer the risk by purchasing cyber insurance

Question 3

A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?

Accepted Answer

Require the CSP to provide dedicated hardware security modules and restrict data storage to approved regions through contractual terms. It directly addresses the root causes: data residency non-compliance and lack of control over encryption keys. Requiring dedicated hardware security modules (HSMs) and restricting data storage to approved regions through contractual terms ensures that the organization retains control over key management and meets regulatory requirements. This aligns with the low risk appetite and the board's mandate to mitigate risks to an acceptable level.

Option B (accept the risk) is incorrect because it contradicts the board's mandate to mitigate all risks, and certifications alone do not guarantee compliance.
Option C (cancel migration) is too drastic and costly; the organization can achieve compliance with the CSP rather than abandoning the cloud migration.
Option D (transfer risk via insurance) does not achieve regulatory compliance; fines may still be imposed regardless of insurance coverage.

Answer

Accept the risk because the CSP has strong security certifications and the likelihood of a breach is low

Answer

Cancel the cloud migration and build a new private data center in a compliant location

Answer

Transfer the risk by purchasing cyber insurance that covers regulatory fines

Question 4

Which of the following is the PRIMARY reason for an information security manager to integrate risk management into the organization's enterprise risk management (ERM) framework?

Accepted Answer

To support informed decision-making by aligning security risks with business objectives. Integrating information security risk into ERM ensures that security risks are considered alongside business risks, enabling better prioritization and resource allocation. This alignment helps the organization make informed decisions that balance risk appetite and business objectives. The primary driver is to support strategic decision-making, not just compliance or reporting.

Answer

To ensure compliance with regulatory requirements

Answer

To provide a consistent risk reporting structure across the enterprise

Answer

To reduce the cost of risk management through shared resources

Question 5

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Accepted Answer

Risk acceptance with formal sign-off by senior management. When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.

Answer

Risk mitigation by implementing compensating controls

Answer

Risk transfer through cyber insurance

Answer

Risk avoidance by decommissioning the system

Question 6

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Accepted Answer

Establishing a risk management framework. A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Answer

Conducting vulnerability scanning

Answer

Performing internal audits

Question 7

An organization has a high residual risk after implementing all feasible controls. According to CISM best practices, which of the following should the information security manager do? (Select TWO.)

Accepted Answer

Escalate to senior management for risk acceptance. When residual risk remains high after all feasible controls are implemented, the information security manager should escalate the risk to senior management for formal risk acceptance (Option A). This aligns with CISM best practices, as senior management holds the authority to accept risks that exceed the organization's risk appetite. Additionally, implementing compensating controls (Option C) can further reduce residual risk to an acceptable level, even if primary controls are already in place.

Answer

Document the risk in the risk register and accept it

Answer

Immediately perform a new risk assessment

Question 8

Match each risk assessment activity with the correct phase of the risk management lifecycle:

Activities:
1. Identify assets and threats
2. Determine risk level
3. Select controls to reduce risk
4. Monitor risk over time

Phases:
A. Risk Assessment
B. Risk Treatment
C. Risk Monitoring
D. Risk Communication (not used)

Answer

Identify assets and threats

Answer

Determine risk level

Answer

Select controls to reduce risk

Answer

Monitor risk over time

Question 9

Which of the following is the PRIMARY purpose of an information security risk assessment?

Accepted Answer

To identify and evaluate risks in terms of likelihood and impact. The primary purpose of an information security risk assessment is to identify and evaluate risks in terms of their likelihood and impact. This process enables an organization to prioritize risks and determine appropriate risk treatment options, such as mitigation, transfer, acceptance, or avoidance, based on a clear understanding of the risk landscape. Without this evaluation, any subsequent risk management decisions would lack a defensible basis.

Answer

To eliminate all identified risks

Answer

To comply with regulatory requirements

Answer

To assign blame for security incidents

Question 10

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Accepted Answer

Risk acceptance. When mitigation cost exceeds potential loss, risk acceptance is appropriate if the risk is within the organization's risk appetite. Alternatively, risk transfer (e.g., insurance) could be considered, but acceptance is often the primary choice when the cost-benefit is negative.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 11

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

Accepted Answer

Escalate the residual risk to senior management. When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

Answer

Implement additional controls immediately

Answer

Document the risk as accepted

Answer

Reassess the risk using a different methodology

Question 12

Which of the following are key components of an information security risk management program? (Select TWO)

Accepted Answer

Risk assessment. Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

Answer

Vulnerability scanning

Answer

Incident response

Question 13

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Accepted Answer

Monetary value of potential losses. Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Answer

Detailed technical vulnerabilities

Answer

Anecdotal stories of past incidents

Question 14

Order the steps for implementing a security awareness training program.

Accepted Answer

Needs Assessment, then Content Development, then Delivery, then Evaluation, then Continuous Improvement. Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Answer

Content Development, then Needs Assessment, then Delivery, then Evaluation, then Continuous Improvement

Answer

Needs Assessment, then Content Development, then Delivery, then Continuous Improvement, then Evaluation

Answer

Needs Assessment, then Content Development, then Evaluation, then Delivery, then Continuous Improvement

Question 15

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Accepted Answer

Scope definition, then Planning, then Execution, then Documentation, then Reporting. Audits start with scope definition, planning, execution, documentation, and reporting.

Answer

Planning, then Scope definition, then Execution, then Documentation, then Reporting

Answer

Scope definition, then Planning, then Reporting, then Execution, then Documentation

Answer

Scope definition, then Execution, then Planning, then Documentation, then Reporting