CISM Information Security Risk Management Practice Question
An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?
⚠ Common exam trap
Many candidates confuse risk assessment (identify/analyze) with risk treatment (select controls) or risk evaluation (set acceptable levels), leading candidates to pick A or E instead of focusing on the core assessment activities B and D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyzing threats and vulnerabilities
Analyzing threats and vulnerabilities is a core step in the risk assessment process, as defined by the NIST SP 800-30 and ISO 31000 frameworks. This activity identifies potential threat sources and existing vulnerabilities that could be exploited, enabling the calculation of likelihood and impact for risk scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Determining acceptable risk levels
Why it's wrong here
This is part of risk appetite definition, not the assessment process itself.
- ✓
Analyzing threats and vulnerabilities
Why this is correct
This is a core activity in risk identification and analysis.
- ✗
Monitoring incident response plans
Why it's wrong here
Incident response monitoring is part of ongoing operations, not risk assessment.
- ✓
Evaluating the effectiveness of existing controls
Why this is correct
Control evaluation helps determine residual risk during assessment.
- ✗
Selecting controls to mitigate risks
Why it's wrong here
Control selection occurs during risk treatment, after assessment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.