CISM Information Security Risk Management Practice Test 8 — 15 Questions

Question 1

A global insurance provider has completed a risk assessment for a new policyholder web portal. The risk treatment plan includes purchasing cyber insurance to transfer a portion of the financial impact. Which of the following is the PRIMARY consideration when evaluating this treatment option?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cost of the premium relative to the potential financial impact and risk appetite. Risk transfer via insurance is justified when the premium is reasonable relative to the potential loss and the residual risk after deductibles and limits remains within the organization's risk appetite. The other factors, such as speed, peer adoption, or hopes of full coverage, do not address the fundamental cost-benefit and risk tolerance alignment required for effective treatment selection.

Answer

The number of other organizations that have purchased similar coverage

Answer

The insurer's ability to cover the full impact of a catastrophic breach

Answer

The speed at which the policy can be underwritten and bound

Question 2

A global insurance provider has just completed a quantitative risk assessment for a new claims-processing application. The assessment used the Annualized Loss Expectancy (ALE) formula and produced an ALE of $850,000 for the risk of a data breach. The vendor's proposed control has an Annualized Cost of the Safeguard (ACS) of $300,000 and a projected risk reduction of 60%. The CISO asks the information security manager to determine the cost-benefit of implementing this control. What is the net benefit (or loss) of the control?

Accepted Answer

$210,000 net benefit. The control reduces the ALE by 60%, leaving a residual ALE of $340,000. The value of that reduction is $510,000. After deducting the $300,000 annual safeguard cost, the net benefit is $210,000. This demonstrates a positive return and supports implementing the control, provided the quantitative assumptions are validated and the risk remains within tolerance.

Answer

$510,000 net benefit

Answer

$340,000 net benefit

Answer

$550,000 net loss

Question 3

An information security manager is reviewing a risk register that contains a risk with a risk score of 20 (likelihood 5, impact 4). The risk owner proposes to accept the risk because the cost of mitigation exceeds the potential loss. Which of the following should the security manager do NEXT?

Accepted Answer

Validate the cost-benefit analysis and ensure the risk is accepted by the appropriate authority.. Before a risk can be accepted, the cost-benefit analysis must be validated, and acceptance must be authorized by the appropriate level of management based on the risk score. The security manager's role is to facilitate this process, ensuring that the decision is informed and within governance. Thus, validating the analysis and obtaining proper authorization is the correct next step.

Answer

Approve the risk acceptance and document it in the risk register.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Implement compensating controls to reduce the risk to an acceptable level.

Question 4

An information security manager is reviewing a risk register entry for a customer-facing web application. The entry lists a vulnerability that could allow unauthorized access to customer records. The application owner has proposed applying a vendor patch that has been available for 30 days. Which of the following risk treatment categories does applying the patch represent?

Accepted Answer

Risk mitigation. Risk mitigation involves applying controls that reduce the likelihood or impact of a risk while allowing the underlying business activity to continue. Patching a known vulnerability lowers the probability of exploitation, so it falls squarely into the mitigation category rather than avoidance, transfer, or acceptance, each of which describes a fundamentally different treatment approach.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 5

A healthcare organization is conducting a risk assessment for a new telehealth platform that will process protected health information. The assessment team proposes using a qualitative approach because of tight deadlines. Which of the following is the MOST significant limitation of relying solely on qualitative risk assessment for this initiative?

Accepted Answer

It may produce inconsistent ratings that are difficult to compare across systems or justify to regulators. Qualitative risk assessment relies on subjective judgment and descriptive scales, which can lead to inconsistent ratings across assessors and make it difficult to compare risks or provide defensible evidence to regulators. For a telehealth platform processing protected health information, the organization needs consistent, auditable risk prioritization, so the lack of repeatability and comparability is the most significant limitation.

Answer

It takes significantly longer to complete than a quantitative assessment

Answer

It cannot incorporate input from clinical staff who understand patient workflows

Answer

It requires specialized statistical software that the organization may not have licensed

Question 6

A healthcare organization is evaluating a new telehealth platform that will process protected health information. The security manager has completed a risk assessment and identified several risks. The CISO asks which of the following is the MOST important factor when determining whether to accept, mitigate, transfer, or avoid a risk?

Accepted Answer

The organization's risk appetite and tolerance. Risk treatment must be driven by the organization's risk appetite and tolerance, because these express how much risk leadership is willing to accept while pursuing objectives. Technical severity, control cost, and risk counts inform the analysis, but they do not determine acceptability. The chosen treatment should bring residual risk within tolerance and remain consistent with regulatory and business obligations.

Answer

The number of similar risks already identified in the risk register

Answer

The cost of the control compared to the asset's book value

Answer

The technical severity rating from the vulnerability scanner

Question 7

A healthcare organization is conducting a risk assessment for its electronic health record (EHR) system. The security manager is identifying threats and vulnerabilities. Which TWO of the following are considered vulnerabilities rather than threats? (Choose two.)

Accepted Answer

Unpatched software on the EHR server.. Vulnerabilities are weaknesses or gaps in controls that can be exploited by threats. Unpatched software and weak password policies are examples of such weaknesses because they represent deficiencies in security controls. Threats, on the other hand, are actors or events that can exploit vulnerabilities, such as disgruntled employees, ransomware groups, or natural disasters. Correctly distinguishing between the two is essential for accurate risk assessment.

Answer

Natural disasters such as floods in the data center region.

Answer

A ransomware group targeting healthcare providers.

Answer

A disgruntled employee with administrative access.

Question 8

A global manufacturing firm is establishing a formal risk management program. The CISO has been asked to ensure that risk assessment outputs are consistently comparable across business units and over time. Which TWO of the following practices BEST support this objective? (Choose two.)

Accepted Answer

Adopting a common risk taxonomy and standardized likelihood and impact scales.. Comparability across units and over time depends on consistent definitions and repeatable methods. A common taxonomy with calibrated scales lets assessments be aggregated, while a documented methodology lets different assessors and different years produce ratings that can be meaningfully compared. Local scoring variation, purely qualitative records, and rotating frameworks all undermine that consistency.

Answer

Recording only qualitative ratings and omitting any quantitative data.

Answer

Reassessing all risks annually using a newly selected framework each cycle.

Answer

Allowing each business unit to define its own risk scoring methodology.

Question 9

A retail company's risk register lists a vulnerability in its point-of-sale system that could expose customer payment card data. The Chief Information Security Officer (CISO) wants to ensure the risk is managed appropriately. Which of the following should be the FIRST step in the risk treatment process?

Accepted Answer

Validate the risk and determine its priority based on likelihood and impact. The risk treatment process starts with validating the identified risk and prioritizing it based on likelihood, impact, and risk appetite. Only after the risk is confirmed and ranked can the organization evaluate treatment options such as mitigation, transfer, avoidance, or acceptance. Jumping directly to a control, insurance, or external reporting bypasses this essential prioritization step and may misallocate resources.

Answer

Report the vulnerability to the payment card brand immediately

Answer

Implement a web application firewall in front of the point-of-sale system

Answer

Purchase a cyber insurance policy to cover potential card replacement costs

Question 10

A retail company is building an information security risk register to support its risk management program. The risk manager wants to ensure the register captures the information needed to track and report risks to senior management. Which TWO of the following are essential elements that should be included for each identified risk? (Choose two.)

Accepted Answer

Risk owner and risk response. A useful risk register must record who owns each risk and what response is planned, because accountability and treatment drive progress. It must also capture likelihood and impact so risks can be scored, compared, and prioritized consistently. Other details may be linked or tracked elsewhere, but these two elements are fundamental for managing and reporting risk to senior management.

Answer

The name of the auditor who discovered the risk

Answer

The budget code of the department that reported the risk

Answer

A detailed list of every technical vulnerability associated with the risk

Question 11

A retail company has a risk register that includes a risk related to point-of-sale (POS) malware. The risk owner has decided to implement an endpoint detection and response (EDR) solution to reduce the risk. Which risk treatment strategy is being applied?

Accepted Answer

Risk mitigation. Risk mitigation is the process of implementing controls to reduce the likelihood or impact of a risk. By deploying EDR, the organization aims to detect and respond to POS malware, thereby lowering the risk. Avoidance would mean stopping the activity, transfer would involve insurance, and acceptance would mean no action. Therefore, mitigation is the correct treatment strategy.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk avoidance

Question 12

An information security manager is updating the organization's risk register after a significant change in the threat landscape. The manager needs to ensure the register remains a useful tool for decision-making. Which TWO of the following activities are MOST important for maintaining the risk register's effectiveness? (Choose two.)

Accepted Answer

Assigning a risk owner for each entry who is accountable for treatment and monitoring. An effective risk register requires ongoing maintenance through scheduled and event-driven reviews, and clear assignment of risk owners who are accountable for treatment and monitoring. These two practices ensure the register stays current, actionable, and aligned with governance requirements. Removing accepted risks, restricting access, or limiting entries to technical vulnerabilities would reduce its value and completeness.

Answer

Limiting access to the risk register to only the information security team

Answer

Populating the register exclusively with technical vulnerabilities identified by scanners

Answer

Removing all risks that have been accepted by senior management to reduce clutter

Question 13

A retail company's risk register shows that its point-of-sale terminals run an unsupported operating system. The CIO proposes replacing the terminals over 18 months, but the CISO believes the exposure is unacceptable in the interim. The CEO asks the CISO to recommend a course of action that balances business continuity with risk reduction. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring while the replacement proceeds.. When permanent remediation will take time, compensating controls allow the organization to reduce risk to a tolerable level while maintaining business operations. Network segmentation and enhanced monitoring address the unsupported platform's exposure without interrupting sales, and they give the CISO a defensible interim posture that can be revisited as the replacement program progresses.

Answer

Transfer the risk to the terminal vendor through the existing support contract.

Answer

Accept the risk because the CIO has committed to an 18-month replacement schedule.

Answer

Immediately disconnect all point-of-sale terminals until they are replaced.

Question 14

A mid-sized manufacturing firm has decided to transfer the risk of a ransomware attack on its production network by purchasing a cyber insurance policy. The policy includes a $1 million coverage limit and a $50,000 deductible. Six months later, a ransomware incident causes $400,000 in recovery costs. The insurer approves the claim. What is the organization's financial responsibility for this incident?

Accepted Answer

$50,000. When a risk is transferred through insurance and the claim is approved, the organization bears the deductible while the insurer covers the covered loss above it, up to the policy limit. Here the loss is well below the limit, so the organization pays only the $50,000 deductible. This illustrates how insurance reduces financial impact but does not eliminate all residual risk.

Answer

$400,000

Answer

$350,000

Answer

$1,000,000

Question 15

A healthcare insurer is completing its annual enterprise risk assessment. The CISO has compiled a list of 40 information security risks, each scored for likelihood and impact. The CIO asks which risks should be escalated to the board's risk committee for formal acceptance. What is the MOST appropriate criterion for selecting which risks to escalate?

Accepted Answer

Risks whose residual risk level exceeds the organization's defined risk appetite.. Board-level risk acceptance is triggered when residual risk exceeds the appetite and tolerance thresholds that executive management has established. Inherent scores, business criticality, and remediation delays are inputs to analysis but do not by themselves indicate that a decision above delegated authority is required. Routing only appetite-breaching residual risks keeps the committee focused on exposures that genuinely require formal acceptance.

Answer

Risks that the security team has been unable to remediate within the current fiscal year.

Answer

Risks that received the highest inherent risk scores before any controls were applied.

Answer

Risks associated with systems that support the organization's most revenue-generating business processes.