CISM Information Security Risk Management Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are valid risk treatment options according to ISO 31000? (Choose two.)

Accepted Answer

Risk avoidance. According to ISO 31000, risk treatment options include avoiding the risk by deciding not to start or continue the activity that gives rise to it, which is why option A (Risk avoidance) is correct. ISO 31000 also recognizes retaining the risk by informed decision, which is option E (Risk retention), as a valid treatment option when the risk is accepted and no further action is taken. Options B (Risk measurement), C (Risk identification), and D (Risk communication) are not treatment options; they are elements of the risk assessment and communication processes within the ISO 31000 framework, not ways of modifying risk.

Answer

Risk measurement

Answer

Risk identification

Answer

Risk communication

Question 2

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Accepted Answer

Lack of senior management support. Option A (Lack of senior management support) is correct because a risk management program requires executive sponsorship, budget, and authority to enforce policies; without it, risk initiatives stall and risk ownership cannot be driven across the organization. Option B (Inability to quantify risks in financial terms) is correct because translating technical or operational risk into monetary values (e.g., ALE = SLE × ARO) is difficult and often subjective, which hampers cost-benefit justification of controls and prioritization. Option D (Resistance to change from business units) is correct because risk management typically introduces new processes, ownership, and controls that business units may perceive as bureaucratic overhead, slowing adoption. Option C is not a standard challenge in itself; implementing too many controls too quickly is a symptom of poor phasing rather than a recognized common implementation challenge. Option E is not a common challenge; a well-defined risk appetite is generally desirable, and the issue is more often an undefined or misaligned appetite, not one that is overly detailed.

Answer

Too many controls implemented too quickly

Answer

Overly detailed risk appetite

Question 3

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Accepted Answer

Assess the business impact of each asset's compromise. The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Answer

Use the asset's purchase value to determine priority

Answer

Perform a vulnerability scan and prioritize based on findings

Answer

Review historical incident reports for each asset

Question 4

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

Accepted Answer

Implement compensating controls to reduce the risk. Implementing compensating controls, such as network segmentation, application-layer firewalls, or intrusion detection systems (IDS), directly reduces the residual risk of exploiting unpatched vulnerabilities in the legacy payment system without disrupting its critical daily operations. This aligns with the CISM principle that when a risk cannot be remediated (e.g., due to system criticality or vendor end-of-life), compensating controls are the primary treatment to bring risk within the organization's appetite.

Answer

Accept the risk as a cost of doing business

Answer

Avoid the risk by decommissioning the system

Answer

Purchase cyber insurance to transfer the risk

Question 5

A multinational organization is evaluating its risk appetite for a new cloud-based customer relationship management (CRM) system. The system will store personal data across multiple jurisdictions with varying data protection laws. The risk committee has set a risk appetite statement that allows only low residual risk. Which of the following controls is MOST critical to ensure compliance with the risk appetite?

Accepted Answer

Implement data classification and strict role-based access controls. The risk appetite allows only low residual risk, meaning controls must directly reduce the likelihood or impact of a data breach to an acceptable level. Data classification and strict role-based access controls (RBAC) are the most critical because they enforce least-privilege access to personal data, directly mitigating the primary risk of unauthorized exposure across jurisdictions with varying data protection laws. Without proper classification and RBAC, even encryption or monitoring cannot prevent an authorized user from improperly accessing or exfiltrating data, leaving residual risk above the low threshold.

Answer

Conduct continuous monitoring and logging of all system activities

Answer

Encrypt all data at rest and in transit using strong algorithms

Answer

Negotiate service-level agreements (SLAs) with cloud provider for uptime

Question 6

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 7

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Accepted Answer

The cost to mitigate is higher than the potential financial loss from a breach. Risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

Answer

The organization has no compensating controls in place

Answer

The risk is within the organization's risk appetite but the business impact is high

Answer

The vendor has a history of security incidents

Question 8

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Answer

$1,000,000

Answer

$125,000

Answer

$500,000

Question 9

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

Accepted Answer

Evaluate the residual risk and decide on additional controls. After implementing initial controls (spam filtering and user awareness training), the organization must evaluate the residual risk—the risk that remains after controls are applied. This step is required by the CISM risk management process to determine whether the residual risk level is acceptable or if additional controls are needed. Option B correctly follows the risk assessment lifecycle: identify risk, apply controls, assess residual risk, then decide on further action.

Answer

Accept the risk as it is already controlled

Answer

Transfer the risk to a cyber insurance provider

Answer

Conduct another round of user awareness training

Question 10

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Accepted Answer

The impact of losing both primary and backup data is unacceptably high. The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach. The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.

Answer

The risk owner does not have authority to accept risks

Answer

Encryption is not required as the facility is secure

Answer

The cost of implementing encrypted offsite backups is minimal

Question 11

An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?

Accepted Answer

Mitigate the risk by implementing controls to reduce impact. ISO 31000's risk evaluation phase requires aligning treatment decisions with the organization's risk appetite. With a moderate risk appetite, a low-likelihood but very-high-impact risk cannot simply be accepted (as it exceeds appetite), nor is avoidance necessary since the likelihood is low. Mitigation through controls that reduce the impact is the most balanced approach, bringing the residual risk within the moderate appetite threshold.

Answer

Accept the risk due to low likelihood

Answer

Avoid the risk by discontinuing the activity that generates it

Answer

Transfer the risk through insurance

Question 12

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Accepted Answer

Risk scenarios with likelihood and impact ratings. Option B is correct because a risk assessment report must document identified risk scenarios together with their likelihood and impact ratings, which are the core analytical outputs that let stakeholders understand and prioritize each risk. Option D is correct because the report should provide risk treatment recommendations (such as mitigate, transfer, avoid, or accept) so decision-makers know how each identified risk should be addressed. Options A, C, and E are not key components of a risk assessment report: vendor security assessment ratings belong to third-party/vendor risk management artifacts, detailed control testing results are outputs of control testing or audit reports, and a complete asset inventory is an input to the risk assessment process rather than a required section of the report itself.

Answer

Vendor security assessment ratings

Answer

Detailed results of control testing

Answer

Complete asset inventory

Question 13

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing least privilege access controls. Option A (Enforcing least privilege access controls) is a risk mitigation control because it reduces the likelihood and impact of unauthorized access by limiting users to only the permissions required for their role, directly lowering exposure to threats. Option B (Implementing intrusion detection systems) is also a mitigation control because it detects malicious activity and enables timely response, thereby reducing the potential damage from attacks. In contrast, Option C (Discontinuing a high-risk business process) is risk avoidance, as the activity is eliminated rather than controlled. Option D (Purchasing cyber insurance) is risk transference, shifting financial consequences to an insurer. Option E (Accepting the risk in a formal statement) is risk acceptance, where no control is implemented and the risk is knowingly retained.

Answer

Discontinuing a high-risk business process

Answer

Purchasing cyber insurance

Answer

Accepting the risk in a formal statement

Question 14

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

Accepted Answer

Risk owner. The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

Answer

Data owner

Answer

Chief Information Security Officer (CISO)

Answer

Board of directors

Question 15

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$5,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.

Answer

$10,000

Answer

$20,000

Answer

$2,500