CISM Information Security Risk Management Practice Question
During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?
⚠ Common exam trap
A common misconception is that risk acceptance is always valid if the risk owner approves it. However, according to ISACA CISM principles, acceptance must align with the organization's risk appetite, and a high-impact risk cannot be accepted solely based on low likelihood.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The impact of losing both primary and backup data is unacceptably high
The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach. The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The impact of losing both primary and backup data is unacceptably high
Why this is correct
A single event (fire, theft) could destroy both data and backup, leading to catastrophic business impact.
- ✗
The risk owner does not have authority to accept risks
Why it's wrong here
Usually risk owners can accept risks within defined thresholds.
- ✗
Encryption is not required as the facility is secure
Why it's wrong here
This supports acceptance, not challenges it.
- ✗
The cost of implementing encrypted offsite backups is minimal
Why it's wrong here
Low cost is a reason to mitigate, but not the best challenge to acceptance.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.