CISM Information Security Risk Management Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are risk treatment strategies as defined in ISO 27005?

Accepted Answer

Risk avoidance. Risk avoidance (C) is a valid ISO 27005 risk treatment strategy in which the organization eliminates the activity or condition that gives rise to the risk, thereby removing the exposure entirely. Risk transfer (D) is also a valid treatment strategy, where the risk is shared with or shifted to another party, such as through insurance or contractual agreements, while the organization retains ultimate accountability. These two belong to the ISO 27005 treatment options that also include risk modification/reduction and risk retention. Risk analysis (A) is part of the risk assessment process, not a treatment strategy, as it identifies and evaluates risks. Risk monitoring (B) is an ongoing review and surveillance activity within the risk management process, not a treatment choice. Risk communication (E) is a supporting process for exchanging risk information among stakeholders, not a treatment strategy itself.

Answer

Risk analysis

Answer

Risk monitoring

Answer

Risk communication

Question 2

Which THREE of the following are typical steps in a qualitative risk assessment?

Accepted Answer

Estimate likelihood and impact using rating scales. Option C is correct because identifying assets and threats is the foundational step of any risk assessment, including qualitative ones, since you must know what you are protecting and what could harm it before evaluating risk. Option A is correct because qualitative risk assessment characteristically uses subjective rating scales (such as High/Medium/Low or 1–5) to estimate likelihood and impact rather than numeric monetary values. Option B is correct because once risks are rated on those scales, the results are used to prioritize risks so that the highest-rated risks receive attention first. Option D is not correct because calculating annualized loss expectancy (ALE = SLE × ARO) is a quantitative technique requiring monetary figures. Option E is not correct because assigning monetary values to impact is also a quantitative step, whereas qualitative assessment relies on descriptive or ordinal ratings.

Answer

Calculate annualized loss expectancy (ALE)

Answer

Assign monetary values to impact

Question 3

A multinational corporation is expanding its cloud infrastructure across multiple regions. The risk team has identified that the shared responsibility model for cloud security is not well understood by business units. After a recent audit, several misconfigurations led to a data exposure incident that affected one region. The CISO wants to implement a risk management program that ensures consistent control across all regions. As the risk manager, what is the most effective course of action to reduce the risk of similar incidents?

Accepted Answer

Develop and enforce cloud security baseline standards and conduct regular compliance audits.. Developing and enforcing cloud security baseline standards with regular compliance audits directly addresses the root cause: inconsistent controls and misconfigurations across regions. This proactive risk management approach ensures all business units adhere to a unified security posture, reducing the likelihood of data exposure incidents. It aligns with the CISM domain of risk management and control.

Answer

Transfer the risk to cloud providers by renegotiating contracts to include liability clauses.

Answer

Implement a cloud access security broker (CASB) to monitor all cloud activities centrally.

Answer

Accept the risk as inherent to cloud adoption and focus resources on incident response.

Question 4

A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?

Accepted Answer

Aligns security spending with business objectives. Option A is correct because risk assessment results tie each security project to the likelihood and impact of risks to business processes, so funding flows to initiatives that protect the organization's most important objectives and assets, aligning security spending with business priorities. Option B is correct because documented risk assessment outputs (identified threats, vulnerabilities, likelihood, and impact ratings) provide an auditable, defensible rationale for why specific security investments are chosen and prioritized, which is essential for justifying budgets to executives, auditors, and regulators. Option C is incorrect because risk-based prioritization still relies on qualitative analysis (for example, ordinal likelihood/impact scales) and often combines it with quantitative methods; it does not eliminate qualitative analysis. Option D is incorrect because risk assessment prioritization does not by itself guarantee compliance with all applicable regulations; compliance is a separate obligation that may require controls regardless of assessed risk level. Option E is incorrect because prioritizing projects by risk does not reduce the total number of security controls needed; it only orders which controls are implemented first, and a risk-based approach may even increase controls for high-risk areas.

Answer

Eliminates the need for qualitative analysis

Answer

Ensures compliance with all applicable regulations

Answer

Reduces the total number of security controls needed

Question 5

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

Accepted Answer

Conduct a risk assessment to identify assets, threats, and vulnerabilities. The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Answer

Purchase a comprehensive cyber insurance policy

Answer

Fire the IT staff responsible for the security failures

Answer

Immediately implement a backup and disaster recovery solution

Question 6

A regional hospital is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). During an internal audit, it was discovered that patient electronic health records (EHRs) are transmitted over the internet without encryption. The risk manager has been asked to recommend a risk treatment. Which action should be prioritized to address this finding?

Accepted Answer

Implement encryption for all data in transit. HIPAA's Security Rule requires covered entities to protect ePHI in transit using encryption or an equivalent alternative, and transmitting unencrypted EHRs over the internet is a direct violation. Implementing encryption for all data in transit is the prioritized risk treatment because it directly mitigates the identified vulnerability, is technically feasible, and aligns with regulatory requirements. Other options either avoid the risk, transfer it, or disrupt operations without fixing the root cause.

Answer

Accept the risk because the likelihood of interception is low

Answer

Purchase cyber insurance to cover potential data breach costs

Answer

Discontinue all electronic transmission of patient data

Question 7

A large retail chain with hundreds of stores uses point-of-sale (POS) systems that run an outdated operating system. The annual risk assessment identified this as a high-risk issue because the OS is no longer patched and has known vulnerabilities. The business unit manager opposes replacing all POS systems immediately due to cost and potential disruption to operations. As the risk manager, you need to recommend a risk response that balances risk reduction with business continuity. Which strategy is most appropriate?

Accepted Answer

Risk mitigation: implement compensating controls and schedule a phased upgrade. Risk mitigation with compensating controls and a phased upgrade balances risk reduction with business continuity. It acknowledges the high risk of outdated POS systems, implements immediate compensating controls (e.g., network segmentation, enhanced monitoring, virtual patching) to reduce exposure, and schedules a phased replacement to avoid operational disruption and spread costs over time.

Answer

Risk avoidance: immediately replace all POS systems with modern ones

Answer

Risk acceptance: accept the risk because the business cannot afford replacement

Answer

Risk transfer: purchase cyber insurance to cover potential losses from POS attacks

Question 8

A global financial services firm uses a Monte Carlo simulation model to quantify the potential financial impact of cyber events. The model inputs include historical loss data, threat intelligence, and control effectiveness. Over the past year, the model has consistently underestimated actual losses by an average of 40%. The risk manager suspects model risk but the quantitative team argues the model is peer-reviewed. The board is concerned about the accuracy of risk reporting. What is the best course of action for the risk manager?

Accepted Answer

Perform a comprehensive model validation and sensitivity analysis. When a quantitative risk model consistently underestimates actual losses by a material margin (40% here), the model itself is the problem — its assumptions, distributions, correlations, or data inputs are flawed. The risk manager's obligation is to validate the model independently and stress-test its sensitivity to key assumptions before the board relies on its outputs. Model validation and sensitivity analysis directly address the root cause (model risk) rather than masking the symptom.

Answer

Increase the risk appetite to accommodate the underestimation

Answer

Replace the quantitative model with a qualitative risk assessment

Answer

Adjust the model parameters to align with observed losses

Question 9

A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?

Accepted Answer

Develop and communicate a revised risk appetite statement approved by the board. Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.

Answer

Outsource all information security operations to a managed service provider

Answer

Immediately deploy a suite of technical security controls

Answer

Recommend the termination of the CEO for previous risk decisions

Question 10

An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?

Accepted Answer

Analyzing threats and vulnerabilities. Analyzing threats and vulnerabilities is a core step in the risk assessment process, as defined by the NIST SP 800-30 and ISO 31000 frameworks. This activity identifies potential threat sources and existing vulnerabilities that could be exploited, enabling the calculation of likelihood and impact for risk scenarios.

Answer

Determining acceptable risk levels

Answer

Monitoring incident response plans

Answer

Selecting controls to mitigate risks

Question 11

A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?

Accepted Answer

Escalate the issue to the risk management committee for a decision on whether to accept, mitigate, or defer the risk.. When a risk owner refuses to accept a risk that exceeds the organization's stated risk appetite and the risk owner also refuses to treat it, the information security manager must escalate through the defined governance channel — here, the risk management committee. The risk appetite statement only permits moderate residual risk with explicit CRO approval, so the head of network operations cannot unilaterally defer a high-rated regulatory risk. Escalation ensures the decision is made at the appropriate authority level with full visibility of regulatory and reputational exposure.

Answer

Conduct a detailed cost-benefit analysis to convince the risk owner to upgrade, but do not escalate until the analysis is complete.

Answer

Accept the risk owner's decision and update the risk register to reflect the deferred treatment with a note of the risk owner's acceptance.

Answer

Implement a compensating control, such as strong application-layer encryption, to reduce the residual risk to an acceptable level without upgrading TLS.

Question 12

An organization has implemented a risk management framework based on ISO 27005. During the risk identification phase, a new vulnerability is discovered in a critical business application that could lead to a data breach. According to ISO 27005, which of the following is the NEXT step the organization should take?

Accepted Answer

Analyze the likelihood and impact of the vulnerability being exploited.. According to ISO 27005, after risk identification (including discovering a new vulnerability), the next step is risk analysis, which involves assessing the likelihood and impact of the vulnerability being exploited. This analysis is required before any decision on risk treatment (e.g., mitigation, acceptance) can be made. Option C correctly identifies this sequential step in the ISO 27005 risk management process.

Answer

Escalate the vulnerability to senior management for acceptance.

Answer

Update the risk register with the new vulnerability.

Answer

Select and implement controls to mitigate the vulnerability.

Question 13

A global insurer completes an annual enterprise risk assessment and reports its top information security risk as a residual risk score of 16 (5x3 on a 5x5 matrix) after applying a data loss prevention solution and security awareness training. The board has stated that any residual risk above 12 must be escalated for a formal risk treatment decision. The CISO is asked to present options at the next risk committee meeting. Which of the following is the MOST appropriate action for the CISO to take FIRST?

Accepted Answer

Present the residual risk to the risk committee with documented treatment options, including additional controls, risk transfer, or risk avoidance, and their associated costs and impacts.. Because the residual risk exceeds the board-defined threshold of 12, the CISO must escalate it to the risk committee for a formal treatment decision. The most appropriate first action is to present the risk along with viable treatment options, costs, and business impacts so the committee can make an informed choice. This respects governance, ensures accountability, and provides the decision-makers with the information they need.

Answer

Escalate the residual risk to the risk committee with a recommendation to accept the risk because the existing controls already reduce it below the original inherent score.

Answer

Initiate a new risk assessment to recalculate the inherent risk score, because the residual score may be inaccurate due to control effectiveness assumptions.

Answer

Implement additional technical controls immediately to reduce the residual risk below 12, then inform the risk committee of the change at the next quarterly meeting.

Question 14

A healthcare insurer has completed an annual risk assessment. The CISO must present the results to the board and recommend a treatment strategy for a risk involving a legacy claims-processing application. The board has stated that it will not accept any risk that could result in a regulatory fine exceeding $1 million. Which of the following is the MOST appropriate action for the CISO to take FIRST?

Accepted Answer

Compare the assessed risk exposure to the board's risk tolerance and present treatment options with residual risk estimates.. Because the board has articulated a specific risk tolerance threshold, the CISO must first evaluate the assessed risk against that threshold and then present treatment options with their residual risk implications. This ensures the recommendation is grounded in the organization's stated appetite and supports a defensible, business-aligned decision rather than an arbitrary technical fix.

Answer

Recommend immediate decommissioning of the legacy application.

Answer

Transfer the risk by purchasing additional cyber insurance coverage.

Answer

Accept the risk and document it in the risk register pending next year's assessment.

Question 15

A global manufacturing firm is expanding into a new region where data residency laws differ significantly from its home country. The CISO must present a risk treatment plan to the board. Which of the following is the MOST appropriate FIRST step in aligning risk treatment with the organization's risk appetite?

Accepted Answer

Review the board's risk appetite statement and tolerance levels for the new region.. Aligning risk treatment with risk appetite begins with understanding the board's appetite and tolerance. The risk appetite statement defines the amount and type of risk the organization is willing to accept, which then guides the selection of controls. Only after this alignment can a gap analysis, BIA, or control implementation be effectively prioritized. Thus, reviewing the board's risk appetite is the essential first step.

Answer

Implement encryption for all data stored in the new region.

Answer

Perform a gap analysis of current controls against the new region's regulatory requirements.

Answer

Conduct a business impact analysis (BIA) for all regional operations.