CISM Information Security Risk Management Practice Test 5 — 15 Questions

Question 1

A company has a risk appetite that is 'low' for operational risks. A risk assessment recently identified that a high-speed trading platform has a residual risk rating of 'high' after controls are applied. The cost to further reduce the risk is $1 million, which exceeds the expected benefit. What is the most appropriate action for the risk owner?

Accepted Answer

Accept the residual risk with formal sign-off from senior management. Option D is correct because risk acceptance requires explicit approval from senior management when residual risk exceeds appetite. Option A is wrong because risk appetite should not be changed without board approval, and the cost-benefit indicates acceptance is more practical. Option B is wrong because implementing controls that are not cost-effective is not prudent. Option C is wrong because risk transfer may not be available or cost-effective.

Answer

Adjust the risk appetite to 'moderate' to align with the residual risk

Answer

Transfer the risk by taking out an insurance policy

Answer

Approve additional controls to lower residual risk regardless of cost

Question 2

Which of the following best describes the difference between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the amount of risk an organization is willing to accept, while risk tolerance is the acceptable variation around that appetite for specific objectives. Option A is correct because risk appetite is the broad willingness to accept risk, while risk tolerance is the acceptable deviation around specific objectives. Option B is wrong because it reverses the definitions. Option C is wrong because both are quantitative or qualitative. Option D is wrong because tolerance is not a subset but a measurable boundary.

Answer

Risk appetite is the maximum risk tolerance

Answer

Risk tolerance is the total risk, and risk appetite is the residual risk

Answer

Risk appetite is qualitative, and risk tolerance is quantitative

Question 3

After implementing controls, an organization reassesses a risk and finds that the residual risk level exceeds the established risk tolerance. What is the most appropriate next step?

Accepted Answer

Seek management approval for acceptance or implement additional controls. Option C is correct because the organization must decide to either accept (with authorization) or further treat the risk. Option A is wrong because ignoring is not acceptable. Option B is wrong because lowering tolerance without justification is not appropriate. Option D is wrong because re-assessment alone does not resolve the issue.

Answer

Re-assess the risk using a different methodology

Answer

Lower the risk tolerance to match the residual risk

Answer

Ignore the residual risk since controls are already in place

Question 4

A security manager is preparing a risk report for the board of directors. Which of the following should be included to best support strategic risk-based decisions?

Accepted Answer

Summary of top risks, risk appetite alignment, and treatment status. Option A is correct because the board needs a high-level view of top risks and their status relative to appetite. Option B is wrong because technical details are not appropriate for board level. Option C is wrong because past incidents are historical, not forward-looking. Option D is wrong because daily operations are too granular.

Answer

Operational metrics such as number of firewalls and intrusion detection alerts

Answer

List of all past security incidents and their root causes

Answer

Detailed vulnerability scan results and patch levels

Question 5

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To provide early warning signals of increasing risk. Option C is correct because KRIs provide early warnings about changes in risk levels. Option A is wrong because that describes a Key Performance Indicator (KPI). Option B is wrong because KRIs measure risk, not compliance. Option D is wrong because KRIs are predictive, not historical.

Answer

To report on past incidents and losses

Answer

To measure the effectiveness of security controls

Answer

To demonstrate compliance with regulations

Question 6

Which TWO of the following are common approaches to information security risk assessment?

Accepted Answer

Qualitative. Options A and D are correct because quantitative and qualitative are the two main types. Quantitative uses numerical values, qualitative uses descriptive ranks. Option B is wrong because vulnerability assessment is a separate activity. Option C is wrong because it is not an assessment type. Option E is wrong because penetration testing is a specific test, not an assessment methodology.

Answer

Penetration testing

Answer

Vulnerability assessment

Answer

Business impact analysis

Question 7

Which THREE of the following are essential components of an information security risk management framework?

Accepted Answer

Risk identification. Options A, B, and D are correct as risk identification, assessment, and treatment are core processes. Option C is wrong because incident response is part of security operations, not the risk management framework itself (though related). Option E is wrong because compliance auditing is a separate assurance activity.

Answer

Incident response planning

Answer

Compliance auditing

Question 8

Which TWO of the following are valid risk response options?

Accepted Answer

Risk mitigation. Options A and B are correct because risk mitigation (reduce) and risk acceptance are standard responses. Options C and D are wrong because risk amplification and risk neutralization are not standard terms. Option E is wrong because risk retention is a form of acceptance but the term is less common; however, many frameworks use retention as a synonym for acceptance, but the question expects 'acceptance' and 'mitigation' as clear options. We'll correct: Actually retention is sometimes used as acceptance, but to avoid confusion, we'll stick with mitigation and acceptance as clearly correct. So E is not a standard term in COBIT/ISO 31000.

Answer

Risk amplification

Answer

Risk neutralization

Answer

Risk retention

Question 9

Which host should be prioritized for risk mitigation based on the vulnerability scan results?

Accepted Answer

192.168.10.35. Option C is correct because host 192.168.10.35 has the highest number of critical and high vulnerabilities (5+6=11), indicating the highest risk. Option A is wrong because host 192.168.10.25 has only 2 critical and 4 high (total 6). Option B is wrong because host 192.168.10.30 has 0 critical and 1 high (total 1). Option D is wrong because even though host 192.168.10.35 has many medium vulnerabilities, the critical and high are most important.

Answer

192.168.10.25

Answer

All hosts should be equally prioritized

Answer

192.168.10.30

Question 10

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

Accepted Answer

Confidential handling requirements. Option B is correct because salary information is typically classified as 'confidential' or 'highlyConfidential' depending on context, but the exhibit shows 'confidential' requires encryption in transit and need-to-know access. Sending to all staff violates need-to-know. Option A is wrong because 'public' allows disclosure. Option C is wrong because 'internal' allows internal use, but not to all staff. Option D is wrong because 'highlyConfidential' includes additional controls, but the minimum violated is confidential.

Answer

HighlyConfidential handling requirements

Answer

Internal handling requirements

Answer

Public handling requirements

Question 11

Which of the following is the most significant risk in this architecture?

Accepted Answer

Direct SQL authentication from application server to database. Option D is correct because direct SQL authentication from application server to database bypasses the principle of least privilege and can be exploited if the application server is compromised. Option A is wrong because TLS 1.3 is strong encryption. Option B is wrong because separating zones is good practice. Option C is wrong because VPN + jump host is a security measure.

Answer

Segmentation of network zones

Answer

Admin access via VPN and jump host

Answer

Use of TLS 1.3 for encryption

Question 12

A financial institution is implementing a risk management program and needs to select a methodology that balances quantitative and qualitative factors, complies with regulatory requirements, and provides a consistent framework for risk assessment across business units. Which methodology would best meet these requirements?

Accepted Answer

ISO 27005. ISO 27005 is an international standard for information security risk management that supports both qualitative and quantitative approaches, aligns with various regulations, and provides a consistent framework. OCTAVE is primarily qualitative and not a regulatory standard. FAIR is quantitative but not a comprehensive standard. NIST SP 800-30 is qualitative and specific to US federal agencies.

Answer

FAIR

Answer

OCTAVE

Answer

NIST SP 800-30

Question 13

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

Accepted Answer

Mitigate the risk by implementing stronger access controls. Mitigating the risk by implementing stronger access controls directly addresses the root cause and reduces the likelihood of future breaches. Accepting the risk is inappropriate when a breach has already occurred. Transferring via insurance only covers financial loss but does not reduce likelihood. Avoiding by discontinuing online services is extreme and not immediately necessary.

Answer

Avoid the risk by discontinuing online services

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Question 14

After implementing controls, the residual risk is calculated to be at a level that slightly exceeds the risk appetite. The business owner argues that the cost of further mitigation outweighs the benefit. What is the most appropriate action for the risk manager?

Accepted Answer

Document the risk and escalate to senior management for acceptance. The risk manager should document the risk and escalate to senior management for formal acceptance. Acceptance requires approval at an appropriate level. Simply accepting without documentation is not proper. Implementing controls regardless of cost ignores cost-benefit. Transferring via insurance does not address residual risk that already exceeds appetite.

Answer

Transfer the risk through insurance

Answer

Accept the residual risk as a business decision

Answer

Implement additional controls regardless of cost

Question 15

A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?

Accepted Answer

Mitigate by reducing the RTO to 1 hour through process automation. Since the current RTO exceeds the MTD, the organization is unable to meet its downtime tolerance. Reducing the RTO to 1 hour (below MTD) through process automation is the appropriate mitigation. Accepting the risk is not viable because the MTD is lower. Transfer via insurance does not address the RTO gap. Replacing the system is more drastic and may not be cost-effective.

Answer

Transfer the risk by purchasing business interruption insurance

Answer

Accept the risk because the RTO is shorter than the MTD

Answer

Avoid the risk by replacing the system with a more reliable one