CISM Information Security Risk Management Practice Test 5 — 15 Questions

Question 1

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$5,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 2

A company has a risk appetite that is 'low' for operational risks. A risk assessment recently identified that a high-speed trading platform has a residual risk rating of 'high' after controls are applied. The cost to further reduce the risk is $1 million, which exceeds the expected benefit. What is the most appropriate action for the risk owner?

Accepted Answer

Accept the residual risk with formal sign-off from senior management. The risk owner has determined that the cost to further reduce the residual risk ($1 million) exceeds the expected benefit, making additional controls economically unjustifiable. Since the company's risk appetite is 'low' for operational risks but the residual risk is 'high', the most appropriate action is to formally accept the residual risk with senior management sign-off, as this documents the decision and acknowledges the deviation from the stated risk appetite. This aligns with the CISM principle that risk acceptance is a valid treatment option when the cost of mitigation outweighs the benefit, provided it is approved at the appropriate level.

Answer

Adjust the risk appetite to 'moderate' to align with the residual risk

Answer

Transfer the risk by taking out an insurance policy

Answer

Approve additional controls to lower residual risk regardless of cost

Question 3

Which of the following best describes the difference between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the amount of risk an organization is willing to accept, while risk tolerance is the acceptable variation around that appetite for specific objectives. Ly distinguishes risk appetite as the broad, strategic level of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance is the specific, measurable deviation allowed from that appetite for individual objectives or risks. This aligns with the ISACA CISM Review Manual, which defines risk appetite as the 'amount of risk an entity is willing to accept in pursuit of its mission' and risk tolerance as the 'acceptable level of variation relative to the achievement of objectives.' Understanding this distinction is critical for establishing proper risk management thresholds and ensuring that security controls are aligned with business goals.

Answer

Risk appetite is the maximum risk tolerance

Answer

Risk tolerance is the total risk, and risk appetite is the residual risk

Answer

Risk appetite is qualitative, and risk tolerance is quantitative

Question 4

After implementing controls, an organization reassesses a risk and finds that the residual risk level exceeds the established risk tolerance. What is the most appropriate next step?

Accepted Answer

Seek management approval for acceptance or implement additional controls. When residual risk exceeds the established risk tolerance, the organization must either implement additional controls to reduce the risk further or formally accept the residual risk through management approval. This aligns with the risk treatment decision-making process in ISO 31000 and the CISM framework, where risk acceptance is a management responsibility. Option C correctly identifies these two valid paths.

Answer

Re-assess the risk using a different methodology

Answer

Lower the risk tolerance to match the residual risk

Answer

Ignore the residual risk since controls are already in place

Question 5

A security manager is preparing a risk report for the board of directors. Which of the following should be included to best support strategic risk-based decisions?

Accepted Answer

Summary of top risks, risk appetite alignment, and treatment status. The board requires strategic-level information to make risk-based decisions. Option D provides a summary of top risks, alignment with risk appetite, and treatment status, which directly supports strategic oversight. Operational details like firewall counts or patch levels are tactical and do not convey the business impact or risk posture needed for board-level decisions.

Answer

Operational metrics such as number of firewalls and intrusion detection alerts

Answer

List of all past security incidents and their root causes

Answer

Detailed vulnerability scan results and patch levels

Question 6

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To provide early warning signals of increasing risk. A Key Risk Indicator (KRI) is a metric used to provide an early warning signal that a risk exposure is approaching or exceeding acceptable thresholds. Unlike lagging indicators that report on past events, KRIs are forward-looking, enabling proactive risk mitigation before a risk materializes into a loss.

Answer

To report on past incidents and losses

Answer

To measure the effectiveness of security controls

Answer

To demonstrate compliance with regulations

Question 7

Which TWO of the following are common approaches to information security risk assessment?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective ratings (e.g., high, medium, low) based on expert judgment to evaluate the likelihood and impact of risks. It is a common approach because it is quick to perform and does not require precise numerical data, making it suitable for initial risk prioritization in information security management.

Answer

Penetration testing

Answer

Vulnerability assessment

Answer

Business impact analysis

Question 8

Which THREE of the following are essential components of an information security risk management framework?

Accepted Answer

Risk identification. Risk identification is a core component of an information security risk management framework because it systematically catalogs assets, threats, and vulnerabilities that could affect the organization. Without identifying risks, subsequent steps like assessment and treatment cannot be performed. This aligns with the ISACA framework's emphasis on risk identification as the foundational step in the risk management lifecycle.

Answer

Incident response planning

Answer

Compliance auditing

Question 9

Which TWO of the following are valid risk response options?

Accepted Answer

Risk mitigation. The correct answers are C (Risk mitigation) and D (Risk acceptance). These are two of the standard risk response options recognized in frameworks such as ISO 31000 and COBIT, alongside risk avoidance and risk transfer. Options A (Risk amplification) and B (Risk neutralization) are not standard risk response terms. Option E (Risk retention) is sometimes considered a form of risk acceptance, but it is not listed as a separate standard response option; the question specifically expects 'acceptance' and 'mitigation' as the correct choices.

Answer

Risk amplification

Answer

Risk neutralization

Answer

Risk retention

Question 10

Which host should be prioritized for risk mitigation based on the vulnerability scan results?

Accepted Answer

192.168.10.35. Host 192.168.10.35 is prioritized because it has the highest number of critical vulnerabilities (e.g., CVE-2023-XXXX with CVSS 9.8) and is exposed to the internet, increasing the likelihood of exploitation. Risk mitigation prioritization is based on the combination of vulnerability severity, asset criticality, and threat exposure, not just vulnerability count.

Answer

192.168.10.25

Answer

All hosts should be equally prioritized

Answer

192.168.10.30

Question 11

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

Accepted Answer

Confidential handling requirements. The email containing employee salaries was sent to all staff, which is a violation of the 'Confidential' handling requirement. Confidential data, such as salary information, must be restricted to authorized recipients only, and mass distribution to all staff exceeds that authorization. The exhibit likely classifies salary data as 'Confidential', not 'HighlyConfidential', making option B the correct minimum violated requirement.

Answer

HighlyConfidential handling requirements

Answer

Internal handling requirements

Answer

Public handling requirements

Question 12

Which of the following is the most significant risk in this architecture?

Accepted Answer

Direct SQL authentication from application server to database. Direct SQL authentication from the application server to the database bypasses any centralized authentication or service account management, creating a single point of failure for credential compromise. If the application server is breached, an attacker can extract hardcoded or stored database credentials and gain unfettered access to the database, leading to potential data exfiltration or destruction. This risk is magnified because direct SQL authentication often uses static, long-lived credentials without the layered controls (e.g., MFA, session auditing) that would be present in a more robust authentication path.

Answer

Segmentation of network zones

Answer

Admin access via VPN and jump host

Answer

Use of TLS 1.3 for encryption

Question 13

A financial institution is implementing a risk management program and needs to select a methodology that balances quantitative and qualitative factors, complies with regulatory requirements, and provides a consistent framework for risk assessment across business units. Which methodology would best meet these requirements?

Accepted Answer

ISO 27005. ISO 27005 is the correct methodology because it provides a risk management framework that explicitly balances quantitative and qualitative factors, aligns with regulatory requirements like GDPR and SOX, and offers a consistent, scalable approach for risk assessment across diverse business units. It integrates seamlessly with ISO 27001, ensuring compliance and standardization.

Answer

FAIR

Answer

OCTAVE

Answer

NIST SP 800-30

Question 14

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

Accepted Answer

Mitigate the risk by implementing stronger access controls. Mitigating the risk by implementing stronger access controls directly addresses the root cause and reduces the likelihood of future breaches. Accepting the risk is inappropriate when a breach has already occurred. Transferring via insurance only covers financial loss but does not reduce likelihood. Avoiding by discontinuing online services is extreme and not immediately necessary.

Answer

Avoid the risk by discontinuing online services

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Question 15

After implementing controls, the residual risk is calculated to be at a level that slightly exceeds the risk appetite. The business owner argues that the cost of further mitigation outweighs the benefit. What is the most appropriate action for the risk manager?

Accepted Answer

Document the risk and escalate to senior management for acceptance. The risk manager should document the risk and escalate to senior management for formal acceptance. Acceptance requires approval at an appropriate level. Simply accepting without documentation is not proper. Implementing controls regardless of cost ignores cost-benefit. Transferring via insurance does not address residual risk that already exceeds appetite.

Answer

Transfer the risk through insurance

Answer

Accept the residual risk as a business decision

Answer

Implement additional controls regardless of cost