The answer is ease of exploiting vulnerabilities in the system, as this directly measures the likelihood of a risk event occurring before any security controls are applied. Inherent risk represents the raw, untreated danger tied to a system’s exposure and attractiveness to attackers, so evaluating how easily a vulnerability can be weaponized—such as through default cloud configurations or weak authentication—is critical for determining the baseline threat probability. On the Certified Information Security Manager CISM exam, this concept tests your ability to separate inherent risk from residual risk, a common trap where candidates mistakenly consider existing controls like encryption or firewalls. Remember that inherent risk assumes no controls exist, so focus purely on the system’s native weaknesses and the threat landscape. A useful memory tip: think of inherent risk as the “bare-bones” danger—if a vulnerability is easy to exploit, the inherent risk is high, regardless of what you plan to fix later.
CISM Information Security Risk Management Practice Question
This CISM practice question tests your understanding of information security risk management. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Likelihood of threat actors targeting the system
Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Organization's risk appetite
Why it's wrong here
Risk appetite is used to evaluate whether residual risk is acceptable, not to calculate inherent risk.
✓
Likelihood of threat actors targeting the system
Why this is correct
Threat likelihood is a core component of inherent risk.
Related concept
Read the scenario before looking for a memorised answer.
✗
Effectiveness of existing security controls
Why it's wrong here
Control effectiveness is considered when assessing residual risk, not inherent risk.
✓
Sensitivity of the data stored and processed
Why this is correct
Data sensitivity directly impacts the potential impact.
Related concept
Read the scenario before looking for a memorised answer.
✓
Ease of exploiting vulnerabilities in the system
Why this is correct
Ease of exploitation affects the likelihood of a risk event.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISACA often tests the distinction between inherent risk and residual risk, trapping candidates who confuse control effectiveness (C) or risk appetite (A) as factors in inherent risk evaluation.
Detailed technical explanation
How to think about this question
Inherent risk assessment for a cloud-based HR system must account for the sensitivity of data (D) because HR systems store personally identifiable information (PII), payroll data, and health records, which are subject to regulations like GDPR and HIPAA. The likelihood of threat actors targeting the system (B) is elevated for cloud HR systems due to their high-value data and internet-facing attack surface, often assessed using threat intelligence feeds and the MITRE ATT&CK framework. The ease of exploiting vulnerabilities (E) is a factor in determining the likelihood, but it is not a standalone key consideration; it is part of the vulnerability assessment that feeds into the likelihood calculation.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CISM exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information Security Risk Management — This question tests Information Security Risk Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Likelihood of threat actors targeting the system — Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.
What should I do if I get this CISM question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.