CISM Information Security Risk Management Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Accepted Answer

Lack of senior management support. Lack of senior management support (A) is a common challenge because risk management programs require executive sponsorship to enforce policies, allocate budget, and drive cross-departmental compliance. Without C-level backing, risk assessments and remediation efforts often stall due to insufficient authority and resources.

Answer

Too many controls implemented too quickly

Answer

Overly detailed risk appetite

Question 2

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Accepted Answer

Assess the business impact of each asset's compromise. The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Answer

Use the asset's purchase value to determine priority

Answer

Perform a vulnerability scan and prioritize based on findings

Answer

Review historical incident reports for each asset

Question 3

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

Accepted Answer

Implement compensating controls to reduce the risk. Implementing compensating controls, such as network segmentation, application-layer firewalls, or intrusion detection systems (IDS), directly reduces the residual risk of exploiting unpatched vulnerabilities in the legacy payment system without disrupting its critical daily operations. This aligns with the CISM principle that when a risk cannot be remediated (e.g., due to system criticality or vendor end-of-life), compensating controls are the primary treatment to bring risk within the organization's appetite.

Answer

Accept the risk as a cost of doing business

Answer

Avoid the risk by decommissioning the system

Answer

Purchase cyber insurance to transfer the risk

Question 4

A multinational organization is evaluating its risk appetite for a new cloud-based customer relationship management (CRM) system. The system will store personal data across multiple jurisdictions with varying data protection laws. The risk committee has set a risk appetite statement that allows only low residual risk. Which of the following controls is MOST critical to ensure compliance with the risk appetite?

Accepted Answer

Implement data classification and strict role-based access controls. The risk appetite allows only low residual risk, meaning controls must directly reduce the likelihood or impact of a data breach to an acceptable level. Data classification and strict role-based access controls (RBAC) are the most critical because they enforce least-privilege access to personal data, directly mitigating the primary risk of unauthorized exposure across jurisdictions with varying data protection laws. Without proper classification and RBAC, even encryption or monitoring cannot prevent an authorized user from improperly accessing or exfiltrating data, leaving residual risk above the low threshold.

Answer

Conduct continuous monitoring and logging of all system activities

Answer

Encrypt all data at rest and in transit using strong algorithms

Answer

Negotiate service-level agreements (SLAs) with cloud provider for uptime

Question 5

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 6

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Accepted Answer

The cost to mitigate is higher than the potential financial loss from a breach. Risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

Answer

The organization has no compensating controls in place

Answer

The risk is within the organization's risk appetite but the business impact is high

Answer

The vendor has a history of security incidents

Question 7

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Answer

$1,000,000

Answer

$125,000

Answer

$500,000

Question 8

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

Accepted Answer

Evaluate the residual risk and decide on additional controls. After implementing initial controls (spam filtering and user awareness training), the organization must evaluate the residual risk—the risk that remains after controls are applied. This step is required by the CISM risk management process to determine whether the residual risk level is acceptable or if additional controls are needed. Option B correctly follows the risk assessment lifecycle: identify risk, apply controls, assess residual risk, then decide on further action.

Answer

Accept the risk as it is already controlled

Answer

Transfer the risk to a cyber insurance provider

Answer

Conduct another round of user awareness training

Question 9

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Accepted Answer

The impact of losing both primary and backup data is unacceptably high. The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach. The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.

Answer

The risk owner does not have authority to accept risks

Answer

Encryption is not required as the facility is secure

Answer

The cost of implementing encrypted offsite backups is minimal

Question 10

An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?

Accepted Answer

Mitigate the risk by implementing controls to reduce impact. ISO 31000's risk evaluation phase requires aligning treatment decisions with the organization's risk appetite. With a moderate risk appetite, a low-likelihood but very-high-impact risk cannot simply be accepted (as it exceeds appetite), nor is avoidance necessary since the likelihood is low. Mitigation through controls that reduce the impact is the most balanced approach, bringing the residual risk within the moderate appetite threshold.

Answer

Accept the risk due to low likelihood

Answer

Avoid the risk by discontinuing the activity that generates it

Answer

Transfer the risk through insurance

Question 11

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Accepted Answer

Risk scenarios with likelihood and impact ratings. Risk scenarios with likelihood and impact ratings are a core component of a risk assessment report because they provide a structured narrative of how a threat could exploit a vulnerability, enabling the organization to prioritize risks based on quantitative or qualitative measures. This aligns with ISACA's best practices for risk communication, ensuring decision-makers understand the potential business impact.

Answer

Vendor security assessment ratings

Answer

Detailed results of control testing

Answer

Complete asset inventory

Question 12

Which THREE of the following are valid methods to identify information security risks? (Choose three.)

Accepted Answer

Business impact analysis (BIA). A Business Impact Analysis (BIA) is a systematic process to identify and evaluate the potential effects of disruptions to critical business functions, thereby identifying information security risks by quantifying the impact of loss of confidentiality, integrity, or availability. It directly links business processes to the underlying IT assets and their security requirements, making it a valid risk identification method as per CISM domain guidance.

Answer

Financial audit

Answer

Penetration testing

Question 13

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing least privilege access controls. Options A and B are correct. Enforcing least privilege access controls reduces the risk by limiting user permissions, and implementing intrusion detection systems mitigates risk by detecting and alerting on threats. Option C (discontinuing a high-risk business process) is risk avoidance, option D (purchasing cyber insurance) is risk transfer, and option E (accepting the risk in a formal statement) is risk acceptance.

Answer

Discontinuing a high-risk business process

Answer

Purchasing cyber insurance

Answer

Accepting the risk in a formal statement

Question 14

During a risk assessment, an organization identifies that a legacy system processes credit card data and has a high likelihood of being exploited. The cost to remediate the vulnerability is $500,000, while the potential loss from a breach is $2 million with a 30% annual probability. What is the most appropriate risk treatment decision based on this information?

Accepted Answer

Risk mitigation by implementing controls to fix the vulnerability. The annualized loss expectancy (ALE) is $600,000 (30% × $2,000,000), which exceeds the $500,000 remediation cost, making mitigation economically justified. Implementing controls to fix the vulnerability directly reduces the high likelihood of exploitation on the legacy system processing credit card data, aligning with PCI DSS requirements for protecting cardholder data.

Answer

Risk transfer by purchasing cyber insurance

Answer

Risk acceptance because the probability is low

Answer

Risk avoidance by decommissioning the legacy system

Question 15

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

Accepted Answer

Risk owner. The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

Answer

Data owner

Answer

Chief Information Security Officer (CISO)

Answer

Board of directors