CISM Information Security Risk Management Practice Test 6 — 15 Questions

Question 1

A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mitigate by reducing the RTO to 1 hour through process automation. The current RTO of 4 hours exceeds the MTD of 2 hours, meaning the system cannot be restored within the maximum tolerable downtime, resulting in unacceptable business impact. Reducing the RTO to 1 hour through process automation brings recovery time well within the MTD, effectively mitigating the risk to an acceptable level. This aligns with the risk management principle of applying controls to close the gap between RTO and MTD.

Answer

Transfer the risk by purchasing business interruption insurance

Answer

Accept the risk because the RTO is shorter than the MTD

Answer

Avoid the risk by replacing the system with a more reliable one

Question 2

A company engages a third-party vendor to process customer data. Which of the following is the most critical step in managing the associated risk?

Accepted Answer

Conducting a due diligence assessment before contracting. Conducting due diligence before contracting is essential to identify risks and ensure the vendor meets security requirements. Vulnerability scans are part of due diligence but not the most critical step. NDA and liability clauses are important but secondary to initial assessment.

Answer

Requiring the vendor to sign a non-disclosure agreement

Answer

Performing a vulnerability scan of the vendor's network

Answer

Including a clause that transfers liability to the vendor

Question 3

A risk manager is aggregating risks across the enterprise and finds that multiple individual risks, each with low impact and low probability, could combine to create a significant risk. What is the best approach to address this?

Accepted Answer

Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls. Risk aggregation models are specifically designed to quantify the cumulative impact of multiple low-level risks that, when combined, exceed the enterprise's risk appetite. This approach aligns with the CISM domain of Information Security Risk Management, where enterprise-level controls (e.g., centralized monitoring, compensating controls) are necessary to address systemic risk that individual risk treatments cannot mitigate. The key insight is that the combined probability of correlated or cascading events may be higher than the product of individual probabilities, especially when risks share common root causes.

Answer

Ignore the individual risks as they are low priority

Answer

Accept the risk because the probability of all occurring simultaneously is negligible

Answer

Treat each individual risk separately with minimal controls

Question 4

An organization selects a control to mitigate a risk, but after implementation, the risk level remains unchanged. What should the risk manager do first?

Accepted Answer

Re-assess the risk and control effectiveness. When a control is implemented but the risk level remains unchanged, the risk manager must first re-assess the risk and control effectiveness to determine why the control failed to reduce the risk. This aligns with the CISM risk management process, which mandates that controls be evaluated for proper design and operation before any escalation or acceptance decisions are made. Without this re-assessment, the organization cannot know whether the control is misconfigured, insufficient, or simply not addressing the correct threat vector.

Answer

Increase the control strength

Answer

Report to senior management

Answer

Accept the risk as residual

Question 5

Which of the following is the primary purpose of communicating risk assessment results to senior management?

Accepted Answer

To enable informed decision-making about risk acceptance. The primary purpose of communicating risk assessment results to senior management is to provide the necessary information for informed decision-making regarding risk acceptance, transfer, or mitigation. Senior management holds the authority to accept residual risk based on a clear understanding of the potential impact and likelihood, which is a core tenet of the CISM framework for information security risk management.

Answer

To comply with regulatory requirements

Answer

To assign blame for security failures

Answer

To justify the security budget

Question 6

A risk manager is establishing risk appetite for a new product line. Which of the following best describes the relationship between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the general approach to risk; tolerance defines acceptable variation in performance. Risk appetite is the broad, high-level amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance translates that appetite into specific, measurable boundaries for individual risks. Option D correctly captures this relationship: appetite is the general approach, and tolerance defines the acceptable variation in performance metrics (e.g., a 5% deviation in revenue targets). This distinction is critical for aligning risk management with business strategy in information security risk management.

Answer

Risk appetite and tolerance are interchangeable terms

Answer

Risk appetite is set by regulatory bodies; tolerance is set by the board

Answer

Risk appetite is the specific limit for each risk; tolerance is the overall willingness to accept risk

Question 7

Which TWO of the following are risk treatment strategies as defined in ISO 27005?

Accepted Answer

Risk avoidance. Risk avoidance is a defined risk treatment strategy in ISO 27005 where the organization decides to avoid the risk by not engaging in the activity that gives rise to it, such as discontinuing a service or choosing an alternative technology. Option C is correct because ISO 27005 explicitly lists risk avoidance as one of the four primary risk treatment options (avoidance, reduction, retention, and transfer).

Answer

Risk analysis

Answer

Risk monitoring

Answer

Risk communication

Question 8

Which TWO of the following are examples of key risk indicators (KRIs) for cybersecurity risk?

Accepted Answer

Time to patch critical vulnerabilities. The time to patch critical vulnerabilities directly measures the organization's exposure window to known exploits, which is a leading indicator of cybersecurity risk. A longer patch time increases the likelihood of a successful attack, making it a key risk indicator (KRI) for vulnerability management.

Answer

Number of successful phishing simulations

Answer

Number of vendors with SOC 2 reports

Answer

Percentage of employees completing security training

Question 9

Which THREE of the following are typical steps in a qualitative risk assessment?

Accepted Answer

Estimate likelihood and impact using rating scales. Qualitative risk assessment uses ordinal rating scales (e.g., 1-5 or Low-Medium-High) to estimate likelihood and impact based on expert judgment, not precise numerical values. This approach is standard in frameworks like ISO 27005 and NIST SP 800-30, which define qualitative analysis as relying on subjective categorization rather than hard financial data.

Answer

Calculate annualized loss expectancy (ALE)

Answer

Assign monetary values to impact

Question 10

Based on the exhibit, which risk should be addressed first if the organization has limited resources?

Accepted Answer

R001. R001 should be addressed first because it has the highest risk level, as indicated by its placement in the top-right quadrant of the risk heat map (high likelihood and high impact). With limited resources, the organization must prioritize risks that pose the greatest potential damage and are most likely to occur, which aligns with the foundational risk management principle of treating high-priority risks first.

Answer

R002

Answer

R003

Answer

R004

Question 11

A multinational corporation is expanding its cloud infrastructure across multiple regions. The risk team has identified that the shared responsibility model for cloud security is not well understood by business units. After a recent audit, several misconfigurations led to a data exposure incident that affected one region. The CISO wants to implement a risk management program that ensures consistent control across all regions. As the risk manager, what is the most effective course of action to reduce the risk of similar incidents?

Accepted Answer

Develop and enforce cloud security baseline standards and conduct regular compliance audits.. Developing and enforcing cloud security baseline standards and conducting regular compliance audits directly address the root cause of misconfigurations due to lack of understanding. A CASB provides monitoring but does not enforce standards. Transferring risk to cloud providers shifts liability but does not prevent misconfigurations. Acceptance with focus on incident response is reactive and does not reduce likelihood.

Answer

Transfer the risk to cloud providers by renegotiating contracts to include liability clauses.

Answer

Implement a cloud access security broker (CASB) to monitor all cloud activities centrally.

Answer

Accept the risk as inherent to cloud adoption and focus resources on incident response.

Question 12

A healthcare organization is merging with another entity and must integrate their IT systems. During due diligence, it is discovered that the acquired company has a high number of unpatched critical vulnerabilities in its electronic health record (EHR) system. The merger timeline is aggressive and the integration team wants to proceed as planned. As the risk manager, what is the best course of action?

Accepted Answer

Recommend delaying the integration until vulnerabilities are patched.. Delaying integration until the critical vulnerabilities are patched is the most prudent action to prevent exploitation during and after integration. Proceeding with compensating controls may not be sufficient given the criticality, and accepting the risk could lead to a major breach. Insurance does not prevent the breach.

Answer

Accept the risk because the vulnerabilities are in the legacy system which will be replaced.

Answer

Transfer the risk by purchasing cyber insurance for the combined entity.

Answer

Proceed with integration but implement compensating controls like network segmentation.

Question 13

A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?

Accepted Answer

Aligns security spending with business objectives. A risk-based approach ensures that security spending is directed toward mitigating the risks that most threaten the institution's critical business objectives, such as protecting customer financial data or ensuring transaction integrity. By prioritizing initiatives based on assessed risk levels, the organization directly links security investments to business value, avoiding waste on low-priority controls.

Answer

Eliminates the need for qualitative analysis

Answer

Ensures compliance with all applicable regulations

Answer

Reduces the total number of security controls needed

Question 14

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

Accepted Answer

Conduct a risk assessment to identify assets, threats, and vulnerabilities. The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Answer

Purchase a comprehensive cyber insurance policy

Answer

Fire the IT staff responsible for the security failures

Answer

Immediately implement a backup and disaster recovery solution

Question 15

A large retail chain with hundreds of stores uses point-of-sale (POS) systems that run an outdated operating system. The annual risk assessment identified this as a high-risk issue because the OS is no longer patched and has known vulnerabilities. The business unit manager opposes replacing all POS systems immediately due to cost and potential disruption to operations. As the risk manager, you need to recommend a risk response that balances risk reduction with business continuity. Which strategy is most appropriate?

Accepted Answer

Risk mitigation: implement compensating controls and schedule a phased upgrade. Risk mitigation through compensating controls (e.g., network segmentation, strict access controls, intrusion detection) combined with a phased upgrade reduces risk while allowing continued operations. Option A is risk avoidance but is too disruptive and costly. Option D is risk transfer via insurance, but insurance does not prevent the incident or reduce the operational impact. Option C is risk acceptance without action, which is inappropriate for a high-risk issue.

Answer

Risk avoidance: immediately replace all POS systems with modern ones

Answer

Risk acceptance: accept the risk because the business cannot afford replacement

Answer

Risk transfer: purchase cyber insurance to cover potential losses from POS attacks