CISM Information Security Risk Management Practice Test 4 — 15 Questions

Question 1

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

Accepted Answer

Implement compensating controls to reduce the risk. Option B is correct because mitigation through compensating controls reduces risk while maintaining operations. Option A is wrong because avoidance would mean discontinuing the system, which is not feasible. Option C is wrong because transfer shifts financial risk but not operational risk. Option D is wrong because acceptance without action is inappropriate for high risk.

Answer

Accept the risk as a cost of doing business

Answer

Avoid the risk by decommissioning the system

Answer

Purchase cyber insurance to transfer the risk

Question 2

A multinational organization is evaluating its risk appetite for a new cloud-based customer relationship management (CRM) system. The system will store personal data across multiple jurisdictions with varying data protection laws. The risk committee has set a risk appetite statement that allows only low residual risk. Which of the following controls is MOST critical to ensure compliance with the risk appetite?

Accepted Answer

Implement data classification and strict role-based access controls. Option C is correct because data classification and access controls ensure that only authorized users access data, addressing both legal and operational risks. Option A is wrong because encryption alone does not manage access. Option B is wrong because SLA enforcement focuses on vendor performance, not direct risk reduction. Option D is wrong because monitoring identifies issues but does not enforce controls.

Answer

Conduct continuous monitoring and logging of all system activities

Answer

Encrypt all data at rest and in transit using strong algorithms

Answer

Negotiate service-level agreements (SLAs) with cloud provider for uptime

Question 3

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. Option D is correct because after implementing controls, the organization should reassess residual risk to ensure it is within appetite. Option A is wrong because updating policies without reassessment may not address the actual risk level. Option B is wrong because training is important but not the immediate next step. Option C is wrong because transferring risk does not address the control effectiveness.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 4

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Accepted Answer

The cost to mitigate is higher than the potential financial loss from a breach. Option A is correct because accepting risk is justified when the cost of mitigation exceeds the potential loss. Option B is wrong because high vulnerability increases risk, making acceptance less appropriate. Option C is wrong because lack of controls increases inherent risk. Option D is wrong because business impact is a factor, but if mitigation cost is higher, acceptance may be appropriate.

Answer

The organization has no compensating controls in place

Answer

The risk is within the organization's risk appetite but the business impact is high

Answer

The vendor has a history of security incidents

Question 5

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. Option B is correct because ALE = asset value × EF × ARO = $2,000,000 × 0.25 × 0.5 = $250,000. Option A is wrong because it uses EF only. Option C is wrong because it multiplies by 2 instead of 0.5. Option D is wrong because it uses incorrect multiplication.

Answer

$1,000,000

Answer

$125,000

Answer

$500,000

Question 6

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

Accepted Answer

Evaluate the residual risk and decide on additional controls. Option C is correct because after evaluating existing controls, the next step is to determine if additional controls are needed to reduce residual risk. Option A is wrong because ignoring residual risk is not acceptable. Option B is wrong because immediate transfer may not be optimal. Option D is wrong because training alone is not a complete solution.

Answer

Accept the risk as it is already controlled

Answer

Transfer the risk to a cyber insurance provider

Answer

Conduct another round of user awareness training

Question 7

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Accepted Answer

The impact of losing both primary and backup data is unacceptably high. Option D is correct because a complete loss of backup integrity from a single event (e.g., fire) could be catastrophic, making the risk unacceptable. Option A is wrong because cost alone doesn't justify acceptance if impact is high. Option B is wrong because the risk owner's authority doesn't override risk committee. Option C is wrong because encryption is a mitigation, not a reason to challenge acceptance.

Answer

The risk owner does not have authority to accept risks

Answer

Encryption is not required as the facility is secure

Answer

The cost of implementing encrypted offsite backups is minimal

Question 8

An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?

Accepted Answer

Mitigate the risk by implementing controls to reduce impact. Option A is correct because even low likelihood risks with high impact may need mitigation to align with moderate risk appetite. Option B is wrong because acceptance is only appropriate if risk is within appetite. Option C is wrong because avoidance is extreme unless no other controls exist. Option D is wrong because transfer may not fully address the impact.

Answer

Accept the risk due to low likelihood

Answer

Avoid the risk by discontinuing the activity that generates it

Answer

Transfer the risk through insurance

Question 9

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Accepted Answer

Risk scenarios with likelihood and impact ratings. Options A and D are correct. A risk assessment report should include risk scenarios and risk treatment recommendations. Option B is wrong because vendor security ratings are not a universal component. Option C is wrong because asset inventory is input data, not part of the report. Option E is wrong because control testing results are part of a separate audit report.

Answer

Vendor security assessment ratings

Answer

Detailed results of control testing

Answer

Complete asset inventory

Question 10

Which THREE of the following are valid methods to identify information security risks? (Choose three.)

Accepted Answer

Business impact analysis (BIA). Options A, C, and D are correct. Threat modeling, vulnerability assessments, and business impact analysis are established risk identification methods. Option B is wrong because penetration testing identifies vulnerabilities but is not typically a standalone risk identification method; it's a control test. Option E is wrong because financial auditing is not a direct risk identification method for information security.

Answer

Financial audit

Answer

Penetration testing

Question 11

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing least privilege access controls. Options A and C are correct. Implementing intrusion detection systems and enforcing access controls are mitigation measures. Option B is wrong because purchasing insurance is transfer. Option D is wrong because ignoring the risk is acceptance. Option E is wrong because discontinuing a service is avoidance.

Answer

Discontinuing a high-risk business process

Answer

Purchasing cyber insurance

Answer

Accepting the risk in a formal statement

Question 12

A company is choosing a risk assessment methodology for a new cloud-based application. The CISO prefers a method that uses monetary values and numerical probabilities to compute annual loss expectancy. Which methodology should be selected?

Accepted Answer

Quantitative risk assessment using SLE, ARO, and ALE. Option B is correct because SLE is the expected monetary loss from a single incident, ARO is the annual rate of occurrence, and ALE = SLE × ARO, which yields a quantitative risk value. Option A is wrong because a qualitative method uses rankings like high/medium/low, not monetary values. Option C is wrong because NIST SP 800-30 is a risk assessment guide, not a specific methodology. Option D is wrong because OCTAVE is a qualitative methodology.

Answer

OCTAVE Allegro methodology

Answer

NIST SP 800-30 Revision 1 risk assessment process

Answer

Qualitative risk assessment using risk matrices

Question 13

During a risk assessment, an organization identifies that a legacy system processes credit card data and has a high likelihood of being exploited. The cost to remediate the vulnerability is $500,000, while the potential loss from a breach is $2 million with a 30% annual probability. What is the most appropriate risk treatment decision based on this information?

Accepted Answer

Risk mitigation by implementing controls to fix the vulnerability. Option C is correct because the annual loss expectancy (ALE) is $2,000,000 × 0.30 = $600,000, which exceeds the remediation cost of $500,000, making risk mitigation cost-effective. Option A is wrong because acceptance would leave the risk unaddressed when mitigation is cheaper than the expected loss. Option B is wrong because transferring would involve insurance premiums that likely exceed the expected loss. Option D is wrong because avoidance (removing the system) is more drastic and may not be necessary.

Answer

Risk transfer by purchasing cyber insurance

Answer

Risk acceptance because the probability is low

Answer

Risk avoidance by decommissioning the legacy system

Question 14

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

Accepted Answer

Risk owner. Option D is correct because risk owners are accountable for risk management decisions within their domain. Option A is wrong because the CISO oversees the security program but does not own specific risks. Option B is wrong because the board provides governance, not day-to-day risk management. Option C is wrong because the data owner is responsible for data classification and protection, not all risks.

Answer

Data owner

Answer

Chief Information Security Officer (CISO)

Answer

Board of directors

Question 15

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$5,000. Option A is correct because ALE = SLE × ARO = $10,000 × 0.5 = $5,000. Option B is wrong because it multiplies by 2. Option C is wrong because it divides by 2. Option D is wrong because it uses an arbitrary number.

Answer

$10,000

Answer

$20,000

Answer

$2,500