Information Security Risk Management →easyMultiple ChoiceObjective-mapped

CISM Information Security Risk Management Practice Question

Exhibit

Refer to the exhibit.

```
Risk Assessment Log
Date: 2025-03-01
Asset: Database Server DB-01
Threat: Unauthorized access
Vulnerability: Weak password policy
Current Controls: Password complexity enabled, account lockout after 5 failed attempts
Likelihood: 3 (Moderate)
Impact: 4 (Major)
Risk Level: 12 (High)
Risk Appetite Threshold: 10
```

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

⚠ Common exam trap

ISACA often tests the misconception that risk acceptance is a valid default response when likelihood is moderate, but the trap here is that acceptance requires the risk to be within the risk appetite after all cost-effective controls have been considered—not before.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Recommend implementing multifactor authentication to reduce the risk

Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Recommend implementing multifactor authentication to reduce the risk
Why this is correct
Additional controls can lower the likelihood or impact, bringing the risk within appetite.
✗
Accept the risk because the likelihood is only moderate
Why it's wrong here
Acceptance is not appropriate when the risk exceeds appetite and remediation is possible.
✗
Reassess the risk with a higher risk appetite threshold
Why it's wrong here
Changing the threshold to match the risk is not a valid risk management practice.
✗
Transfer the risk by purchasing cyber insurance
Why it's wrong here
Insurance transfers financial impact but does not reduce the inherent risk level.

Go deeper

CISM Information Security Risk Management Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question