CISM Information Security Risk Management Practice Test 3 — 15 Questions

Question 1

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insist on additional controls to reduce residual risk to at least 'medium'.. The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Answer

Accept the risk since the risk owner has agreed.

Answer

Transfer the risk to an insurance company.

Answer

Recommend revising the risk appetite to accommodate this risk.

Question 2

During a risk assessment, a CISM identifies that the organization's data backup process has a single point of failure. The backup server is located in the same data center as the primary server. Which risk response is most appropriate?

Accepted Answer

Mitigate by moving the backup server to a geographically separate location.. Moving the backup server to a geographically separate location directly eliminates the single point of failure by ensuring that a localized disaster (e.g., fire, flood, power outage) at the primary data center does not simultaneously destroy both the primary and backup data. This is a classic risk mitigation strategy that reduces the likelihood and impact of data loss, aligning with the principle of geographic redundancy for disaster recovery.

Answer

Transfer the risk by purchasing business interruption insurance.

Answer

Avoid the risk by discontinuing the backup process.

Answer

Accept the risk because the cost of mitigation is high.

Question 3

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 4

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

Accepted Answer

Use a hybrid approach that includes both qualitative and quantitative assessments.. A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

Answer

Switch to a fully quantitative risk assessment methodology.

Answer

Replace qualitative scales with precise monetary values.

Answer

Continue using qualitative method since it is simpler.

Question 5

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Accepted Answer

Risk appetite and tolerance. ISACA defines risk appetite and tolerance (B) as key components because they establish the amount of risk an organization is willing to accept in pursuit of its objectives, providing the criteria against which risks are evaluated and prioritized. A risk assessment methodology (D) is also essential, as it defines the structured approach (e.g., identifying, analyzing, and evaluating risks per frameworks like ISO 31000 or NIST RMF) used to determine likelihood and impact consistently across the enterprise. Together, these two elements form the governance and analytical backbone of an information risk management program. By contrast, a business continuity plan (A) is a response/recovery capability, a data classification scheme (C) is a supporting control/inventory tool, and vulnerability scanning (E) is a technical detection activity — all valuable, but none are the core program components ISACA identifies.

Answer

Business continuity plan

Answer

Data classification scheme

Answer

Vulnerability scanning process

Question 6

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly three.)

Accepted Answer

Risk transfer (sharing). According to ISO 31000, risk treatment options include avoiding the risk (Option C), which means deciding not to start or continue the activity that gives rise to the risk, thereby removing the exposure entirely. Option B, risk transfer (sharing), is also valid because it involves sharing the risk with another party, such as through insurance or contractual arrangements, while retaining some residual risk. Option D, risk mitigation (reduction), is correct because ISO 31000 recognizes modifying the likelihood and/or consequence of the risk to reduce it to an acceptable level. Option A, risk elimination, is not one of the standard ISO 31000 treatment categories; while avoidance can eliminate exposure, 'elimination' is not the named treatment option. Option E, risk deferral, is not a recognized ISO 31000 risk treatment option, as postponing a risk does not by itself treat it and ISO 31000 does not list deferral among its treatment choices.

Answer

Risk elimination

Answer

Risk deferral

Question 7

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Accepted Answer

Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.. A formal vulnerability management program with defined remediation SLAs directly addresses the root cause: the known vulnerability was not patched due to competing priorities. By tying remediation timelines to risk severity (e.g., critical vulnerabilities patched within 7 days, high within 30 days), the company operationalizes its 'moderate' risk appetite and ensures that penetration test findings are acted upon before they can be exploited. This is the most cost-effective approach given the limited budget, as it leverages existing staff and processes rather than requiring new hires or expensive rewrites.

Answer

Hire two additional security analysts to improve monitoring and incident response.

Answer

Increase cyber liability insurance coverage to $5 million to cover potential breach costs.

Answer

Rewrite the web application using a secure development framework to eliminate vulnerabilities.

Question 8

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Accepted Answer

Remediate the risk by implementing parameterized queries and input validation. Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing the web application

Answer

Accept the risk because the likelihood is low after compensating controls

Question 9

An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?

Accepted Answer

Likelihood of threat actors targeting the system. Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.

Answer

Organization's risk appetite

Answer

Effectiveness of existing security controls

Question 10

A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?

Accepted Answer

Require the CSP to provide dedicated hardware security modules and restrict data storage to approved regions through contractual terms. It directly addresses the root causes: data residency non-compliance and lack of control over encryption keys. Requiring dedicated hardware security modules (HSMs) and restricting data storage to approved regions through contractual terms ensures that the organization retains control over key management and meets regulatory requirements. This aligns with the low risk appetite and the board's mandate to mitigate risks to an acceptable level.

Option B (accept the risk) is incorrect because it contradicts the board's mandate to mitigate all risks, and certifications alone do not guarantee compliance.
Option C (cancel migration) is too drastic and costly; the organization can achieve compliance with the CSP rather than abandoning the cloud migration.
Option D (transfer risk via insurance) does not achieve regulatory compliance; fines may still be imposed regardless of insurance coverage.

Answer

Accept the risk because the CSP has strong security certifications and the likelihood of a breach is low

Answer

Cancel the cloud migration and build a new private data center in a compliant location

Answer

Transfer the risk by purchasing cyber insurance that covers regulatory fines

Question 11

Which of the following is the PRIMARY reason for an information security manager to integrate risk management into the organization's enterprise risk management (ERM) framework?

Accepted Answer

To support informed decision-making by aligning security risks with business objectives. The primary purpose of integrating information security risk management into ERM is to enable informed decision-making by ensuring security risks are evaluated in the same language and context as business, financial, and operational risks. This alignment lets leadership prioritize investments and accept or mitigate risks based on their impact on business objectives, not in isolation. CISM emphasizes that security exists to support the business, so alignment with business objectives is the fundamental driver.

Answer

To ensure compliance with regulatory requirements

Answer

To provide a consistent risk reporting structure across the enterprise

Answer

To reduce the cost of risk management through shared resources

Question 12

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Accepted Answer

Establishing a risk management framework. A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Answer

Conducting vulnerability scanning

Answer

Performing internal audits

Question 13

Which of the following is the PRIMARY purpose of an information security risk assessment?

Accepted Answer

To identify and evaluate risks in terms of likelihood and impact. The primary purpose of an information security risk assessment is to identify and evaluate risks in terms of their likelihood and impact. This process enables an organization to prioritize risks and determine appropriate risk treatment options, such as mitigation, transfer, acceptance, or avoidance, based on a clear understanding of the risk landscape. Without this evaluation, any subsequent risk management decisions would lack a defensible basis.

Answer

To eliminate all identified risks

Answer

To comply with regulatory requirements

Answer

To assign blame for security incidents

Question 14

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Accepted Answer

Risk acceptance. When the cost of mitigating a risk exceeds the potential loss, the most appropriate strategy is risk acceptance. This means the organization acknowledges the risk and decides to bear the potential loss, as the cost of mitigation is not justified. Risk acceptance is a valid treatment when the risk is within the organization's risk appetite.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 15

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

Accepted Answer

Escalate the residual risk to senior management. When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

Answer

Implement additional controls immediately

Answer

Document the risk as accepted

Answer

Reassess the risk using a different methodology