CISM Information Security Risk Management — Timed 10 Questions

Question 1

A security manager is evaluating risk treatment options for a high-risk vulnerability. Drag each option to the correct risk treatment category.

Options:
- Apply a vendor patch
- Purchase cyber insurance
- Decommission the system
- Accept the risk with formal sign-off
- Install a WAF (Web Application Firewall)

Categories:
- Mitigate
- Transfer
- Avoid
- Accept

Question 2

A company is choosing a risk assessment methodology for a new cloud-based application. The CISO prefers a method that uses monetary values and numerical probabilities to compute annual loss expectancy. Which methodology should be selected?

Accepted Answer

Quantitative risk assessment using SLE, ARO, and ALE. The CISO requires a methodology that uses monetary values and numerical probabilities to compute annual loss expectancy (ALE). Quantitative risk assessment directly calculates ALE using the formula ALE = SLE × ARO, where SLE (Single Loss Expectancy) is expressed in monetary terms and ARO (Annualized Rate of Occurrence) is a numerical probability. This matches the requirement precisely, whereas qualitative methods (like OCTAVE Allegro or risk matrices) use subjective scales, not hard monetary figures.

Answer

OCTAVE Allegro methodology

Answer

NIST SP 800-30 Revision 1 risk assessment process

Answer

Qualitative risk assessment using risk matrices

Question 3

A regional hospital is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). During an internal audit, it was discovered that patient electronic health records (EHRs) are transmitted over the internet without encryption. The risk manager has been asked to recommend a risk treatment. Which action should be prioritized to address this finding?

Accepted Answer

Implement encryption for all data in transit. Implementing encryption for data in transit directly addresses the identified vulnerability and is a mandatory safeguard under HIPAA. Option B is incorrect because accepting this high-risk condition would likely violate regulatory requirements. Option C is incorrect because insurance does not reduce the risk of non-compliance. Option D is overly drastic and would disrupt operations without addressing underlying security.

Answer

Accept the risk because the likelihood of interception is low

Answer

Purchase cyber insurance to cover potential data breach costs

Answer

Discontinue all electronic transmission of patient data

Question 4

A financial institution is implementing a new online banking platform. The risk assessment identified that the authentication module has a high likelihood of exploitation due to weak password policies. The risk owner has decided to implement multi-factor authentication (MFA) to reduce the risk. This is an example of which risk response strategy?

Accepted Answer

Risk mitigation. Implementing multi-factor authentication (MFA) reduces the likelihood or impact of a security risk by adding additional authentication factors (e.g., something you know, something you have, something you are) beyond a weak password. This directly aligns with risk mitigation, which seeks to decrease the residual risk to an acceptable level through controls. The decision does not eliminate the risk entirely (avoidance), accept it without action, or transfer it to a third party.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 5

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

Accepted Answer

Insist on additional controls to reduce residual risk to at least 'medium'.. The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Answer

Accept the risk since the risk owner has agreed.

Answer

Transfer the risk to an insurance company.

Answer

Recommend revising the risk appetite to accommodate this risk.

Question 6

During a risk assessment, a CISM identifies that the organization's data backup process has a single point of failure. The backup server is located in the same data center as the primary server. Which risk response is most appropriate?

Accepted Answer

Mitigate by moving the backup server to a geographically separate location.. Moving the backup server to a geographically separate location directly eliminates the single point of failure by ensuring that a localized disaster (e.g., fire, flood, power outage) at the primary data center does not simultaneously destroy both the primary and backup data. This is a classic risk mitigation strategy that reduces the likelihood and impact of data loss, aligning with the principle of geographic redundancy for disaster recovery.

Answer

Transfer the risk by purchasing business interruption insurance.

Answer

Avoid the risk by discontinuing the backup process.

Answer

Accept the risk because the cost of mitigation is high.

Question 7

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

Accepted Answer

Avoid the risk by not engaging vendors that cannot meet security requirements.. Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.

Answer

Mitigate the risk by conducting regular vendor audits.

Answer

Transfer the risk by requiring vendors to have cyber insurance.

Answer

Accept the risk because third-party risks are unavoidable.

Question 8

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 9

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

Accepted Answer

Use a hybrid approach that includes both qualitative and quantitative assessments.. A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

Answer

Switch to a fully quantitative risk assessment methodology.

Answer

Replace qualitative scales with precise monetary values.

Answer

Continue using qualitative method since it is simpler.

Question 10

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Accepted Answer

Risk appetite and tolerance. Options B and D are correct. Risk appetite and tolerance (B) define the organization's willingness to accept risk, and a risk assessment methodology (D) provides the structured approach to identify, analyze, and evaluate risks. Business continuity planning (A) is a separate domain focused on incident recovery, not a core component of risk management. Data classification (C) is part of information security governance, not risk management program components. Vulnerability scanning (E) is a technical control activity, not a program-level component.

Answer

Business continuity plan

Answer

Data classification scheme

Answer

Vulnerability scanning process