CISM Information Security Risk Management Practice Question
An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?
⚠ Common exam trap
A common mix-up: candidates confuse risk transfer (insurance) with risk mitigation, or they incorrectly assume that accepting risk is a default option when the scenario clearly indicates a high-likelihood, high-impact vulnerability that can be directly fixed with a standard coding practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remediate the risk by implementing parameterized queries and input validation
Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transfer the risk by purchasing cyber insurance
Why it's wrong here
Transfer does not reduce the likelihood; it only shifts financial impact.
- ✗
Avoid the risk by discontinuing the web application
Why it's wrong here
Avoidance is too drastic and not necessary when remediation is possible.
- ✓
Remediate the risk by implementing parameterized queries and input validation
Why this is correct
This directly addresses the vulnerability and reduces the risk to an acceptable level.
- ✗
Accept the risk because the likelihood is low after compensating controls
Why it's wrong here
Acceptance is not appropriate for a high-risk vulnerability that can be remediated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.