CISM Information Security Risk Management Practice Test 4 — 15 Questions

Question 1

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Accepted Answer

Monetary value of potential losses. Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Answer

Detailed technical vulnerabilities

Answer

Anecdotal stories of past incidents

Question 2

Order the steps for implementing a security awareness training program.

Accepted Answer

Needs Assessment, then Content Development, then Delivery, then Evaluation, then Continuous Improvement. Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Answer

Content Development, then Needs Assessment, then Delivery, then Evaluation, then Continuous Improvement

Answer

Needs Assessment, then Content Development, then Delivery, then Continuous Improvement, then Evaluation

Answer

Needs Assessment, then Content Development, then Evaluation, then Delivery, then Continuous Improvement

Question 3

Order the steps for implementing a data classification policy in an organization.

Accepted Answer

Define data classification categories, then define classification procedures and guidelines, then train employees on classification, then label data according to classifications, then monitor compliance and update policy.. Data classification starts with defining categories, then procedures, training, labeling, and monitoring.

Answer

Define data classification categories, then label data according to classifications, then define classification procedures and guidelines, then train employees on classification, then monitor compliance and update policy.

Answer

Train employees on classification, then define data classification categories, then define classification procedures and guidelines, then label data according to classifications, then monitor compliance and update policy.

Answer

Define data classification categories, then define classification procedures and guidelines, then label data according to classifications, then train employees on classification, then monitor compliance and update policy.

Question 4

Match each risk management term to its definition.

Accepted Answer

Risk: Effect of uncertainty on objectives. Key risk management terms from CISM: Risk is the effect of uncertainty on objectives; controls are measures that modify risk; vulnerabilities are weaknesses that can be exploited; threats are potential causes of incidents. The distractor pairs swap risk with threat and control with vulnerability.

Answer

Risk: A potential cause of an unwanted incident

Answer

Control: Weakness in an asset or control

Question 5

Match each business continuity term to its definition.

Accepted Answer

Business Continuity Plan: A documented set of procedures and information that helps an organization respond to a disruption and resume normal operations.. Correct matches: A-BCP, B-DRP, C-BIA. Common confusions: MTD is about downtime, RPO is about data loss.

Answer

Maximum Tolerable Downtime: The maximum amount of data loss, measured in time, that an organization can accept.

Answer

Recovery Point Objective: The maximum period of time that a system can be unavailable before causing significant harm to the business.

Question 6

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

Accepted Answer

Risk acceptance. Risk acceptance is the appropriate treatment when the cost of mitigating a risk exceeds the potential loss it represents. In this scenario, since mitigation costs more than the expected loss, accepting the risk is the most economically justified and effective strategy. The organization consciously retains the risk and monitors it, rather than spending more to prevent it than the loss would cost.

Answer

Risk avoidance

Answer

Risk reduction

Answer

Risk transfer

Question 7

A security manager is conducting a risk assessment for a new cloud-based system. The system will store sensitive customer data. Which of the following should be the FIRST step in the risk assessment process?

Accepted Answer

Identify and classify information assets. In the risk assessment process, the first step is to identify and classify information assets because you cannot assess risks to assets you haven't identified. For a cloud-based system storing sensitive customer data, this means cataloging data types (e.g., PII, financial records), their locations (e.g., specific cloud storage buckets), and their classification levels (e.g., confidential, restricted) before any threat or vulnerability analysis can be meaningfully performed.

Answer

Select appropriate security controls

Answer

Conduct vulnerability scanning

Answer

Identify potential threat sources

Question 8

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

Accepted Answer

Inaccurate risk profile leading to uninformed decisions. C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.

Answer

Increased audit findings

Answer

Regulatory fines for noncompliance

Answer

Higher insurance premiums

Question 9

A risk manager is presenting risk treatment options to senior management. Which of the following is the BEST approach to communicate risk in a way that supports informed decision-making?

Accepted Answer

Translate risk into potential financial impact. Translating risk into potential financial impact (Option C) is the best approach because it aligns risk with business objectives, enabling senior management to make cost-benefit decisions. Financial quantification, such as Annualized Loss Expectancy (ALE), provides a common language that executives understand, directly supporting informed decision-making on risk treatment options.

Answer

Focus only on high and extreme risks

Answer

Use technical language to accurately describe vulnerabilities

Answer

Present risk in qualitative terms only

Question 10

A company is implementing a risk management program and needs to define risk appetite. Which of the following is the MOST appropriate statement of risk appetite for a financial institution?

Accepted Answer

The organization will accept up to $5M in potential loss for operational risks. A risk appetite statement for a financial institution must be quantifiable and specific to operational risk, aligning with regulatory frameworks like Basel III which require explicit loss thresholds. Stating a maximum acceptable loss of $5M provides a clear, measurable boundary for risk-taking decisions, enabling the board and management to balance risk and reward effectively.

Answer

The organization will mitigate all risks to a low level

Answer

The organization will not invest in high-risk projects

Answer

The organization accepts no level of risk

Question 11

During a risk assessment, the risk team identifies that a key vendor has access to sensitive data. The vendor's security posture is unclear. Which of the following is the BEST course of action?

Accepted Answer

Conduct a third-party risk assessment. When a vendor's security posture is unclear and they have access to sensitive data, the best course of action is to conduct a third-party risk assessment. This assessment evaluates the vendor's security controls, compliance with standards (e.g., ISO 27001, SOC 2), and contractual obligations before making any decisions. It provides the necessary evidence to determine if the risk is acceptable or requires mitigation, rather than acting on assumptions.

Answer

Ignore the risk because the vendor is known

Answer

Terminate the vendor relationship immediately

Answer

Request the vendor's latest security certification

Question 12

Which of the following best describes residual risk?

Accepted Answer

Risk that remains after implementing controls. Residual risk is defined in information security risk management as the risk that remains after management has implemented all planned controls. This concept is central to the CISM framework because it represents the exposure that must be accepted, transferred, or further mitigated by the organization. Unlike inherent risk (before controls), residual risk accounts for the effectiveness of the security measures in place.

Answer

Risk before any controls are applied

Answer

The likelihood that a control will fail

Answer

The level of risk an organization is willing to accept

Question 13

A risk manager is evaluating a control that reduces the likelihood of a threat from high to low. The cost of the control is $100,000 annually. The expected loss without the control is $500,000 per year. Which of the following should the risk manager recommend?

Accepted Answer

Implement the control. The control reduces the annualized loss expectancy (ALE) from $500,000 to a much lower value (since likelihood drops from high to low). The annual cost of the control is $100,000, which is significantly less than the $500,000 expected loss without it. Implementing the control provides a positive return on investment (ROI) and is the most cost-effective risk mitigation strategy.

Answer

Avoid the risk by discontinuing the process

Answer

Transfer the risk through insurance

Answer

Accept the risk

Question 14

An organization's risk management policy requires a quantitative risk assessment for all new projects. The project team estimates that a data breach could occur once every 5 years with an average loss of $2 million. What is the annualized loss expectancy (ALE)?

Accepted Answer

$400,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, the ARO is 1/5 = 0.2 (one event every five years), and the SLE is $2,000,000. Thus, ALE = 0.2 × $2,000,000 = $400,000.

Answer

$10,000,000

Answer

$500,000

Answer

$2,000,000

Question 15

Which TWO of the following are key components of an information security risk assessment? (Choose two.)

Accepted Answer

Threat identification. Asset identification (E) is a foundational component of a risk assessment because you cannot evaluate risk without first knowing which information assets, systems, and data require protection and what value they hold to the organization. Threat identification (A) is equally essential, since risk is derived from identifying the threats (e.g., malware, insider abuse, natural disasters) that could exploit vulnerabilities and cause harm to those assets. Together, asset and threat identification feed into the core risk formula (risk = likelihood × impact), enabling analysts to prioritize risks and recommend treatment. The other options do not belong: security policy development (B) is a governance/risk-treatment output, incident response planning (C) is a reactive capability built after risks are understood, and control implementation (D) is a risk-mitigation activity that follows the assessment rather than forming part of it.

Answer

Security policy development

Answer

Incident response planning

Answer

Control implementation