CISM Information Security Risk Management Practice Question
A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?
⚠ Common exam trap
A common mix-up: candidates confuse the purpose of risk assessment results—which is to prioritize based on business impact—with compliance or control reduction, leading them to select options like D or E that sound plausible but are not primary benefits of a risk-based approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Aligns security spending with business objectives
A risk-based approach ensures that security spending is directed toward mitigating the risks that most threaten the institution's critical business objectives, such as protecting customer financial data or ensuring transaction integrity. By prioritizing initiatives based on assessed risk levels, the organization directly links security investments to business value, avoiding waste on low-priority controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Aligns security spending with business objectives
Why this is correct
Correct; risk assessment helps prioritize based on business impact.
- ✓
Provides a defensible justification for security investments
Why this is correct
Correct; risk-based approach supports business case for budget allocation.
- ✗
Eliminates the need for qualitative analysis
Why it's wrong here
Incorrect; both qualitative and quantitative are often needed.
- ✗
Ensures compliance with all applicable regulations
Why it's wrong here
Incorrect; risk assessment does not guarantee compliance with all regulations.
- ✗
Reduces the total number of security controls needed
Why it's wrong here
Incorrect; risk assessment may identify need for additional controls.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.