CISM Information Security Risk Management Practice Question
An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?
⚠ Common exam trap
A common mix-up: candidates confuse risk transfer (insurance) with risk mitigation, or they incorrectly assume that accepting risk is a default option when the scenario clearly indicates a high-likelihood, high-impact vulnerability that can be directly fixed with a standard coding practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remediate the risk by implementing parameterized queries and input validation
Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transfer the risk by purchasing cyber insurance
Why it's wrong here
Insurance compensates financial loss after an incident but leaves the insufficient input validation unfixed, so the vulnerability and high likelihood persist. Transfer suits low-frequency, high-severity risks where the exposure cannot be reduced directly, not a known exploitable code defect.
- ✗
Avoid the risk by discontinuing the web application
Why it's wrong here
Discontinuing the application removes the business capability entirely, which is disproportionate when the flaw is a fixable input-validation defect. Avoidance is correct only when no control can bring the risk within tolerance and the activity is genuinely dispensable.
- ✓
Remediate the risk by implementing parameterized queries and input validation
Why this is correct
Parameterised queries separate SQL code from user-supplied data, and input validation rejects malformed input, eliminating the injection vector itself. This directly addresses the identified insufficient input validation, removing the high-likelihood risk rather than transferring or accepting it.
- ✗
Accept the risk because the likelihood is low after compensating controls
Why it's wrong here
Acceptance is invalid because the stem states high likelihood, and acceptance requires the residual risk to sit within tolerance after treatment. Acceptance is the correct strategy when likelihood and impact are both low, or when treatment cost clearly exceeds the potential loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.