CISM Information Security Risk Management Practice Question
A multinational corporation is establishing a risk appetite framework. The board has defined risk appetite as 'no more than one major security incident per year resulting in financial loss exceeding $1M'. Which of the following best represents the risk tolerance for a specific business unit's annual cybersecurity budget allocation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The business unit should maintain annual losses from security incidents between $500,000 and $1,000,000.
Risk appetite is the broad level of risk the organization is willing to accept, while risk tolerance is the acceptable variation around that appetite. In this case, the tolerance is a range of financial loss from the appetite level up to the capacity (maximum bearable loss). A range of $500,000 to $1,000,000 defines the boundaries within which the business unit can operate without breaching appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The business unit should maintain annual losses from security incidents between $500,000 and $1,000,000.
Why this is correct
Tolerance bands define the acceptable range around appetite, typically a buffer below the appetite limit.
- ✗
The business unit may experience up to $1M in losses per year from security incidents.
Why it's wrong here
This is the risk appetite, not the tolerance. Tolerance includes a buffer below the appetite.
- ✗
The business unit can accept up to $1.5M loss from a single incident per year.
Why it's wrong here
This exceeds the appetite of $1M and would be a breach unless capacity permits.
- ✗
The business unit should not exceed a single incident causing $500,000 loss per year.
Why it's wrong here
This is too restrictive; tolerance allows loss up to appetite, not below a lower threshold.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.