CISM Information Security Risk Management Practice Test 9 — 15 Questions

Question 1

An information security manager is integrating risk management with the organization's enterprise risk management (ERM) program. The ERM director asks how information security risk should be reported alongside financial and operational risks. Which of the following is the MOST appropriate approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Express security risks in business impact terms and integrate them into the enterprise risk register using common scales.. Integrating security risk into ERM requires translating technical exposure into business impact and using the enterprise's common scales so that cyber risk can be compared, aggregated, and prioritized alongside other risk types. This gives executives a unified view while preserving enough detail for ownership and treatment decisions.

Answer

Convert all security risks into a single aggregate score and report only that score to ERM.

Answer

Report security risks separately to the CISO only, keeping ERM focused on financial and operational risks.

Answer

Report only risks that have already materialized as incidents so ERM deals with confirmed events.

Question 2

A software development company is assessing the risk of using a third-party cloud provider to host its source code repository. The security manager must determine whether the provider's security controls are sufficient. Which of the following is the MOST effective way to obtain assurance about the provider's security posture?

Accepted Answer

Request the provider's most recent independent audit report, such as SOC 2 Type II. Independent audit reports such as SOC 2 Type II provide validated evidence that a third-party provider's controls operated effectively over a defined period. They are prepared by a qualified auditor and cover relevant trust services criteria, giving the organization reliable assurance for risk assessment and vendor management. Self-reported materials, questionnaires, or unauthorized testing do not offer the same level of independent, ongoing verification.

Answer

Ask the provider to complete a security questionnaire and sign a confidentiality agreement

Answer

Review the provider's public marketing materials and security whitepapers

Answer

Conduct a penetration test of the provider's infrastructure without notifying them

Question 3

An information security manager at a multinational bank is reviewing the risk assessment methodology. The bank operates in multiple jurisdictions with different regulatory requirements. The manager wants to ensure the methodology produces consistent and comparable risk results across all business units. Which of the following is the MOST important characteristic of the risk assessment methodology?

Accepted Answer

It uses a defined and consistently applied risk scoring scale. Consistency across business units and jurisdictions depends on a defined, uniformly applied risk scoring scale. This ensures that likelihood and impact ratings are comparable, allowing the bank to aggregate risks, prioritize investments, and report meaningfully to the board and regulators. Local judgment and qualitative input are valuable, but they must operate within a common framework to produce reliable enterprise risk information.

Answer

It automatically assigns the highest possible risk rating to all regulatory findings

Answer

It uses qualitative ratings only, avoiding numerical scores

Answer

It relies on the judgment of each local risk manager without central guidance

Question 4

A hospital's information security manager is assessing a radiology system that stores patient images on a vendor-managed cloud. The vendor reports a 99.9% uptime SLA and annual SOC 2 Type II reports, but the hospital's radiology staff continue to store local copies on unencrypted workstations for convenience. Which of the following is the MOST appropriate risk treatment for the risk introduced by the local copies?

Accepted Answer

Mitigate the risk by enforcing full-disk encryption, access controls, and a policy prohibiting unauthorized local copies.. The risk arises from hospital-controlled endpoints, so the effective treatment is mitigation through encryption, access control, and policy enforcement. Transfer and acceptance do not address the internal behavior, and avoidance of the vendor relationship is misdirected because the vendor is not the source of the exposure. Risk treatment should be matched to the party that actually controls the risk.

Answer

Transfer the risk to the cloud vendor by amending the SLA to include the local workstations.

Answer

Accept the risk because the cloud vendor holds SOC 2 Type II attestation.

Answer

Avoid the risk by terminating the contract with the cloud vendor and returning to on-premises storage.

Question 5

A healthcare organization's risk register shows a critical patient-records system with an annualized loss expectancy (ALE) of $2,400,000. A proposed control costs $300,000 per year and is estimated to reduce the ALE to $400,000. The CISO must present the strongest financial justification to the executive committee. Which of the following is the MOST appropriate metric to present?

Accepted Answer

A cost-benefit analysis showing a net benefit of $1,700,000 per year from the control.. Cost-benefit analysis translates the risk reduction into a monetary figure that decision-makers can weigh against the control's annual cost. Here the control lowers expected annual loss by $2,000,000 while costing $300,000, producing a $1,700,000 net benefit. This quantitative justification is far more persuasive to an executive committee than residual risk, asset value, or qualitative ratings alone.

Answer

The residual risk of $400,000 after the control is implemented.

Answer

The control's annualized cost of $300,000 compared with the total asset value of the patient-records system.

Answer

The likelihood and impact ratings of the threat before and after the control.

Question 6

A global retailer is preparing to adopt a new cloud-based point-of-sale platform. The CISO must ensure the risk assessment approach is repeatable and comparable over time. Which of the following is the MOST important characteristic of the risk assessment methodology to achieve this?

Accepted Answer

It uses a consistent set of defined likelihood and impact criteria.. Repeatability and comparability depend on consistent measurement criteria. By defining what likelihood and impact mean and how they are rated, the organization ensures that different assessors evaluating the cloud POS platform or other systems will produce results that can be compared and trended. Documentation, governance approval and ERM alignment support the process but do not by themselves eliminate subjective variation in risk ratings.

Answer

It documents the risk assessment results in a centralized risk register.

Answer

It aligns with the organization’s overall enterprise risk management framework.

Answer

It is reviewed and approved annually by the board of directors.

Question 7

A global manufacturing company is expanding its operations into a region with unstable political conditions. The CISO has been asked by the board to provide a recommendation on the risk associated with building a new data center in that region. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a country risk assessment to identify threats and vulnerabilities specific to the region.. The correct first step is to conduct a country risk assessment. This provides the necessary information about the specific threats and vulnerabilities of operating in that region, enabling the board to make an informed decision. Other options like insurance, redundancy, or acceptance are all risk treatment strategies that should only be considered after the risk has been properly assessed and evaluated against the organization's risk appetite.

Answer

Implement a redundant data center in a stable region to ensure business continuity.

Answer

Accept the risk because the expansion is a strategic business decision.

Answer

Purchase political risk insurance to transfer the potential financial losses.

Question 8

A global retailer operates point-of-sale systems in 12 countries. The risk register shows a single entry titled 'Payment card data breach' with a likelihood of 4 and an impact of 5. A new CISO argues this entry is too coarse to support treatment decisions. Which action BEST improves the usefulness of the risk register for decision-making?

Accepted Answer

Decompose the entry into distinct risk scenarios mapped to specific threat events, assets, and existing controls.. Risk registers support decisions only when entries describe discrete scenarios that can be individually assessed, owned, and treated. Splitting an aggregated payment card breach entry into specific threat-asset-control combinations enables targeted control selection, meaningful residual scoring, and clear accountability. Merely re-scoring, downgrading to qualitative labels, or transferring to insurance leaves the underlying analytical deficiency untouched.

Answer

Transfer the risk to a cyber insurance policy and remove it from the active risk register.

Answer

Replace the numeric likelihood and impact scores with a simple high, medium, or low qualitative rating.

Answer

Increase the impact rating to 5 and add a note that the risk is critical to the business.

Question 9

A global manufacturer is building a risk register for its operational technology (OT) environment. The CISO wants to ensure the register captures risk at the appropriate level and supports prioritization. Which TWO of the following practices BEST support an effective OT risk register? (Choose two.)

Accepted Answer

Record each risk with an owner, inherent and residual ratings, and the linked business process or asset.. An effective risk register captures ownership, inherent and residual ratings, and business linkage, and it maps risks to the obligations they could affect. These practices enable prioritization and accountability. Aggregating findings, using only financial impact, or excluding controlled risks all reduce the register's usefulness for managing OT exposure where safety and availability are critical.

Answer

Rate every OT risk using only the maximum potential financial loss to keep scoring consistent.

Answer

Exclude risks that already have compensating controls from the register to reduce noise.

Answer

Aggregate all OT findings into a single enterprise risk to simplify board reporting.

Question 10

An information security manager is selecting a risk analysis methodology for a new enterprise resource planning (ERP) deployment. The organization has limited historical incident data, the deployment timeline is aggressive, and executives want a defensible ranking of risks within two weeks. Which approach is MOST appropriate?

Accepted Answer

A qualitative analysis using a defined likelihood and impact scale with calibrated subject matter expert judgment.. When historical loss data is scarce and results are needed quickly, a qualitative analysis with documented likelihood and impact scales and calibrated expert judgment is the most practical and defensible choice. It produces a consistent ranking without fabricating quantitative precision, and the documented scales allow reviewers to understand and challenge how each ERP risk was rated.

Answer

A quantitative analysis using annualized loss expectancy derived from industry breach cost benchmarks.

Answer

A hybrid analysis that assigns monetary values to every identified ERP risk regardless of data availability.

Answer

A control gap analysis mapped to ISO/IEC 27002 that ranks risks by the number of missing controls.

Question 11

A hospital’s CISO is reviewing a critical clinical application that cannot be patched due to vendor certification constraints. The risk of exploitation is assessed as high. The hospital has implemented network segmentation and enhanced monitoring as compensating controls. Which of the following is the MOST appropriate next step to manage this risk?

Accepted Answer

Perform a residual risk assessment to determine if the compensating controls reduce risk to an acceptable level.. When compensating controls are introduced, the risk profile changes and must be re-evaluated. A residual risk assessment determines whether segmentation and monitoring reduce the risk to a level the hospital can tolerate. Only after that assessment can leadership make an informed decision to accept, further mitigate or transfer the risk. Acting without this step risks either unnecessary disruption or unrecognized exposure.

Answer

Transfer the risk by purchasing cyber insurance that covers clinical system outages.

Answer

Accept the risk and document it in the risk register with a review date.

Answer

Immediately remove the application from the network until the vendor provides a patch.

Question 12

An information security manager is reviewing the organization's risk register and notices that a risk related to unpatched software has been assigned a risk score of 9 (on a scale of 1-10) with a note that the risk is 'accepted' because patching would disrupt a critical production system. Which of the following should the manager do NEXT?

Accepted Answer

Verify that the risk acceptance is documented and approved by the appropriate business owner.. The next step is to verify that the risk acceptance is properly documented and approved by the business owner. Risk acceptance is a formal process that requires accountability. If the acceptance is not valid, the manager can then take appropriate action, such as proposing compensating controls or escalating. Verifying the process ensures that the organization's risk governance is upheld and that the decision to accept the risk was made at the correct level.

Answer

Immediately implement a compensating control such as network segmentation to reduce the risk.

Answer

Update the risk register to reflect that the risk is mitigated by the acceptance decision.

Answer

Escalate the risk to the board of directors because a score of 9 is unacceptable.

Question 13

An insurance company's risk committee has formally approved a risk treatment plan that relies on a new identity governance platform to reduce excessive access privileges. Six months into implementation, the project is 20 percent complete due to competing priorities. What should the information security manager do FIRST?

Accepted Answer

Update the risk register to reflect the increased residual risk and report the treatment shortfall to the risk committee.. Risk treatment plans are approved on the basis of projected residual risk, so slippage changes the factual basis of that approval. The security manager must first update the risk register and notify the risk committee, enabling it to decide whether to fund acceleration, accept the higher exposure temporarily, or mandate compensating controls. Execution and vendor actions come after risk visibility is restored.

Answer

Request an extension of the original project timeline from the vendor and continue monitoring.

Answer

Close the original risk entry and open a new one describing the delayed identity governance implementation.

Answer

Reassign the identity governance project to the security team so it can be completed faster.

Question 14

A software company is entering a new market that requires compliance with a strict data protection law. The CISO must determine whether the current security program can meet the law’s requirements. Which of the following should be the FIRST step?

Accepted Answer

Conduct a gap analysis between the law’s requirements and the current security controls.. The first step in achieving compliance is to understand the difference between what the law requires and what the organization currently does. A gap analysis produces that understanding by mapping requirements to existing controls, identifying deficiencies and highlighting areas where evidence is missing. This allows the CISO to prioritize remediation, allocate budget and build a realistic compliance plan before making technical or policy changes.

Answer

Engage external legal counsel to interpret the law’s requirements.

Answer

Implement encryption for all data at rest and in transit across the enterprise.

Answer

Update the information security policy to reference the new law.

Question 15

A security analyst is identifying assets to include in a risk assessment for a new e-commerce platform. The platform will process credit card payments and store customer personal information. Which of the following should be considered the MOST critical asset to protect?

Accepted Answer

The customer database containing personal and payment card information.. The customer database is the most critical asset because it holds sensitive personal and payment card information. Its compromise would result in the most significant impact to the organization, including regulatory fines, financial loss, and reputational harm. While other components like servers, firewalls, and load balancers are important for operations and security, they support the protection of the data. Risk assessments should prioritize assets based on the potential impact of their loss.

Answer

The load balancer distributing traffic to the web servers.

Answer

The network firewall protecting the e-commerce environment.

Answer

The web server hosting the e-commerce application.