Courseiva

CCNA Cism Risk Management Questions

75 of 97 questions · Page 1/2 · Cism Risk Management topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

After implementing controls, an organization reassesses a risk and finds that the residual risk level exceeds the established risk tolerance. What is the most appropriate next step?

A.Re-assess the risk using a different methodology
B.Lower the risk tolerance to match the residual risk
C.Seek management approval for acceptance or implement additional controls
D.Ignore the residual risk since controls are already in place
AnswerC

This aligns with risk management process.

Why this answer

When residual risk exceeds the established risk tolerance, the organization must either implement additional controls to reduce the risk further or formally accept the residual risk through management approval. This aligns with the risk treatment decision-making process in ISO 31000 and the CISM framework, where risk acceptance is a management responsibility. Option C correctly identifies these two valid paths.

Exam trap

The CISM exam often tests the misconception that risk assessment methodology changes can resolve residual risk issues, but the trap here is that candidates may choose Option A, thinking a different methodology will yield a more favorable result, when in fact the correct action is to treat the risk through additional controls or formal acceptance.

How to eliminate wrong answers

Option A is wrong because re-assessing with a different methodology does not change the actual risk level; it only changes the measurement, which is a form of risk avoidance through redefinition rather than proper treatment. Option B is wrong because lowering the risk tolerance to match the residual risk is a reactive and inappropriate response that undermines the risk appetite set by the organization; risk tolerance should drive control decisions, not be adjusted to fit uncontrolled risk. Option D is wrong because ignoring residual risk violates the fundamental principle of risk management that requires continuous monitoring and response when risk exceeds tolerance; controls do not absolve the organization from addressing unacceptable residual risk.

Practice this question →
2
MCQmedium

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

A.HighlyConfidential handling requirements
B.Confidential handling requirements
C.Internal handling requirements
D.Public handling requirements
AnswerB

Salaries are confidential; email lacks encryption and need-to-know.

Why this answer

The email containing employee salaries was sent to all staff, which is a violation of the 'Confidential' handling requirement. Confidential data, such as salary information, must be restricted to authorized recipients only, and mass distribution to all staff exceeds that authorization. The exhibit likely classifies salary data as 'Confidential', not 'HighlyConfidential', making option B the correct minimum violated requirement.

Exam trap

A common pitfall in ISACA CISM exams is the distinction between 'Confidential' and 'HighlyConfidential' classifications. Candidates often overclassify sensitive data like salary information as 'HighlyConfidential', but the minimum violated requirement is typically 'Confidential' when the data is not top-secret.

How to eliminate wrong answers

Option A is wrong because 'HighlyConfidential' handling requirements typically apply to data like trade secrets or PII with severe impact, and salary data is usually classified as 'Confidential' in standard data classification schemes. Option C is wrong because 'Internal' handling requirements apply to data that can be shared broadly within the organization but not externally, whereas salary data is more restricted than general internal data. Option D is wrong because 'Public' handling requirements apply to data intended for public disclosure, and salary data is never classified as public.

Practice this question →
3
MCQmedium

Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?

A.Change the password policy to require 12-character passwords.
B.Increase logging verbosity to capture more details.
C.Disable SSH access and use console only.
D.Implement account lockout after 3 failed attempts.
AnswerD

This control directly mitigates brute-force attacks by locking accounts.

Why this answer

Implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.

Exam trap

The trap here is that candidates confuse preventive controls (password policy) with detective controls (logging) or overcorrect with risk avoidance (disabling SSH), instead of recognizing that a targeted brute-force attack is best addressed with a specific technical control like account lockout that directly blocks the attack pattern.

How to eliminate wrong answers

Option A is wrong because changing the password policy to require 12-character passwords is a preventive control that reduces the likelihood of successful password guessing, but it does not stop repeated failed SSH attempts from the same IP address in real time; the attacker can still attempt unlimited guesses. Option B is wrong because increasing logging verbosity only improves detection and forensic analysis, not prevention or response; it does not stop the ongoing attack or reduce risk. Option C is wrong because disabling SSH access and using console only is an extreme risk avoidance that eliminates remote administration entirely, which is often operationally impractical and not the most appropriate response for a targeted brute-force attempt.

Practice this question →
4
MCQhard

An organization's risk management policy requires a quantitative risk assessment for all new projects. The project team estimates that a data breach could occur once every 5 years with an average loss of $2 million. What is the annualized loss expectancy (ALE)?

A.$400,000
B.$10,000,000
C.$500,000
D.$2,000,000
AnswerA

ALE = $2,000,000 * 0.2 = $400,000.

Why this answer

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, the ARO is 1/5 = 0.2 (one event every five years), and the SLE is $2,000,000. Thus, ALE = 0.2 × $2,000,000 = $400,000.

Exam trap

The trap here is that candidates often confuse the recurrence interval (every 5 years) with the ARO, mistakenly multiplying the loss by 5 instead of dividing, leading to the inflated $10,000,000 option.

How to eliminate wrong answers

Option B is wrong because $10,000,000 results from multiplying the loss ($2M) by 5 (the number of years between occurrences) instead of dividing, which incorrectly inflates the annualized loss. Option C is wrong because $500,000 would be the ALE if the ARO were 0.25 (once every 4 years), not the given 0.2. Option D is wrong because $2,000,000 is the single loss expectancy (SLE), not the annualized figure; it ignores the frequency of occurrence entirely.

Practice this question →
5
Multi-Selecthard

Which THREE of the following are essential components of an information security risk management framework?

Select 3 answers
A.Incident response planning
B.Risk identification
C.Compliance auditing
D.Risk assessment
E.Risk treatment
AnswersB, D, E

First step in risk management.

Why this answer

Risk identification is a core component of an information security risk management framework because it systematically catalogs assets, threats, and vulnerabilities that could affect the organization. Without identifying risks, subsequent steps like assessment and treatment cannot be performed. This aligns with the ISACA framework's emphasis on risk identification as the foundational step in the risk management lifecycle.

Exam trap

The trap here is that candidates confuse operational security processes (like incident response) or compliance activities (like auditing) with the core risk management framework components, which are strictly risk identification, risk assessment, and risk treatment as defined by ISACA.

Practice this question →
6
Multi-Selectmedium

An organization is implementing a new cloud-based ERP system. As part of the emerging risk assessment, the information security manager needs to identify potential risks associated with the cloud migration. Which THREE of the following should be considered as part of the emerging risk assessment for cloud adoption?

Select 3 answers
A.Data residency and regulatory compliance requirements across different jurisdictions.
B.Potential supply chain risks if the cloud provider uses third-party services or subcontractors.
C.The organization's ability to patch operating systems in the cloud environment.
D.Physical security controls at the cloud provider's data centers.
E.Shared responsibility model and understanding the division of security controls between the organization and the provider.
AnswersA, B, E

Data may be stored in different countries, raising compliance issues.

Why this answer

Data residency and regulatory compliance requirements are critical in cloud adoption because data may be stored or processed in jurisdictions with different privacy laws (e.g., GDPR, CCPA, LGPD). An emerging risk assessment must evaluate whether the cloud provider's data centers are located in regions that could expose the organization to legal penalties or breach of contractual obligations. This is not a generic concern but a specific legal and technical risk tied to the physical location of cloud infrastructure.

Exam trap

ISACA often tests the distinction between operational risks (like patching) and emerging risks (like regulatory or supply chain changes), leading candidates to select patching as a cloud-specific risk when it is actually a routine operational task that the organization already manages.

Practice this question →
7
MCQmedium

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

A.$5,000
B.$10,000
C.$20,000
D.$2,500
AnswerA

Calculation: $10,000 × 0.5 = $5,000.

Why this answer

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.

Exam trap

The trap here is that candidates often confuse ALE with SLE or incorrectly apply the ARO as a multiplier greater than 1, leading to answers like $20,000, instead of recognizing that an ARO of 0.5 means the loss is halved annually.

How to eliminate wrong answers

Option B is wrong because $10,000 equals the SLE, not the ALE; it ignores the ARO factor of 0.5, which reduces the annualized loss. Option C is wrong because $20,000 would result from multiplying SLE by 2 (or dividing ARO by 0.25), a common error of inverting the ARO or misapplying the formula. Option D is wrong because $2,500 would be the result of dividing SLE by 4 or multiplying by 0.25, possibly from confusing ARO with a percentage or miscomputing 0.5 × 10,000.

Practice this question →
8
Multi-Selecteasy

Which TWO of the following are key components of an information security risk assessment? (Choose two.)

Select 2 answers
A.Threat identification
B.Security policy development
C.Incident response planning
D.Control implementation
E.Asset identification
AnswersA, E

Threats must be identified to assess risk.

Why this answer

Threat identification is a key component of an information security risk assessment because it involves systematically cataloging potential sources of harm (e.g., malware, insider threats, natural disasters) that could exploit vulnerabilities. Without identifying threats, the risk assessment cannot evaluate the likelihood or impact of adverse events, making the entire risk analysis incomplete. This step directly feeds into risk identification, which is the foundation of the risk management process as defined by frameworks like ISO 27005 and NIST SP 800-30.

Exam trap

The trap here is that candidates often confuse risk assessment activities (threat and asset identification) with downstream risk management steps like policy creation or control implementation, leading them to select options that are part of the broader risk management lifecycle but not the assessment itself.

Practice this question →
9
Multi-Selecthard

An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?

Select 3 answers
A.Organization's risk appetite
B.Likelihood of threat actors targeting the system
C.Effectiveness of existing security controls
D.Sensitivity of the data stored and processed
E.Ease of exploiting vulnerabilities in the system
AnswersB, D, E

Threat likelihood is a core component of inherent risk.

Why this answer

Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.

Exam trap

ISACA often tests the distinction between inherent risk and residual risk, trapping candidates who confuse control effectiveness (C) or risk appetite (A) as factors in inherent risk evaluation.

Practice this question →
10
MCQhard

A global financial services firm uses a Monte Carlo simulation model to quantify the potential financial impact of cyber events. The model inputs include historical loss data, threat intelligence, and control effectiveness. Over the past year, the model has consistently underestimated actual losses by an average of 40%. The risk manager suspects model risk but the quantitative team argues the model is peer-reviewed. The board is concerned about the accuracy of risk reporting. What is the best course of action for the risk manager?

A.Perform a comprehensive model validation and sensitivity analysis
B.Increase the risk appetite to accommodate the underestimation
C.Replace the quantitative model with a qualitative risk assessment
D.Adjust the model parameters to align with observed losses
AnswerA

Correct; this identifies flaws in the model and ensures reliability.

Why this answer

Performing model validation and sensitivity analysis will help identify assumptions, data quality, or structural issues causing the underestimation. Option B is incorrect because increasing risk appetite does not address the model error; it could mask the problem. Option C is incorrect because abandoning a quantitative model for qualitative may lose objectivity, though it could be considered if model risk cannot be reduced.

Option D is incorrect because simply adjusting parameters to match past incidents overfits and may not predict future losses accurately.

Practice this question →
11
MCQmedium

Based on the exhibit, which risk should be addressed first if the organization has limited resources?

A.R001
B.R002
C.R003
D.R004
AnswerA

R001 has the highest risk level (12).

Why this answer

R001 should be addressed first because it has the highest risk level, as indicated by its placement in the top-right quadrant of the risk heat map (high likelihood and high impact). With limited resources, the organization must prioritize risks that pose the greatest potential damage and are most likely to occur, which aligns with the foundational risk management principle of treating high-priority risks first.

Exam trap

ISACA often tests the misconception that all high-impact risks should be addressed first regardless of likelihood, but the correct approach is to consider both likelihood and impact together to determine the overall risk priority.

How to eliminate wrong answers

Option B is wrong because R002, while having high impact, has a lower likelihood than R001, placing it in a lower risk priority quadrant. Option C is wrong because R003 has a lower impact than R001, even though its likelihood is high, making it a secondary concern. Option D is wrong because R004 has both low likelihood and low impact, placing it in the lowest priority quadrant and thus not requiring immediate attention with limited resources.

Practice this question →
12
MCQhard

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

A.Accept the risk since the risk owner has agreed.
B.Transfer the risk to an insurance company.
C.Insist on additional controls to reduce residual risk to at least 'medium'.
D.Recommend revising the risk appetite to accommodate this risk.
AnswerC

This ensures residual risk aligns with appetite, which is the correct risk management approach.

Why this answer

The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Exam trap

The trap here is that candidates may think the risk owner's acceptance is sufficient, but CISM emphasizes that risk acceptance must be within the risk appetite; otherwise, it is a violation of governance.

How to eliminate wrong answers

Option A is wrong because accepting the risk would violate the organization's risk appetite, which requires residual risk to be at 'medium' or lower; the risk owner's acceptance does not override policy. Option B is wrong because transferring the risk to insurance does not reduce the residual risk level; it only shifts financial impact, and the residual risk remains 'high' or 'medium-high', still exceeding the appetite. Option D is wrong because revising the risk appetite to accommodate a single project undermines the governance framework and sets a dangerous precedent; the risk appetite should be driven by strategic objectives, not by individual risks.

Practice this question →
13
MCQmedium

A large retail chain with hundreds of stores uses point-of-sale (POS) systems that run an outdated operating system. The annual risk assessment identified this as a high-risk issue because the OS is no longer patched and has known vulnerabilities. The business unit manager opposes replacing all POS systems immediately due to cost and potential disruption to operations. As the risk manager, you need to recommend a risk response that balances risk reduction with business continuity. Which strategy is most appropriate?

A.Risk avoidance: immediately replace all POS systems with modern ones
B.Risk mitigation: implement compensating controls and schedule a phased upgrade
C.Risk acceptance: accept the risk because the business cannot afford replacement
D.Risk transfer: purchase cyber insurance to cover potential losses from POS attacks
AnswerB

Correct; this balances risk reduction with business continuity.

Why this answer

Risk mitigation through compensating controls (e.g., network segmentation, strict access controls, intrusion detection) combined with a phased upgrade reduces risk while allowing continued operations. Option A is risk avoidance but is too disruptive and costly. Option D is risk transfer via insurance, but insurance does not prevent the incident or reduce the operational impact.

Option C is risk acceptance without action, which is inappropriate for a high-risk issue.

Practice this question →
14
MCQhard

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

A.$250,000
B.$1,000,000
C.$125,000
D.$500,000
AnswerA

ALE = $2,000,000 × 0.25 × 0.5 = $250,000.

Why this answer

The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Exam trap

The trap here is that candidates often forget to multiply by the ARO after computing SLE, or they confuse ARO with a percentage and incorrectly apply it as a divisor instead of a multiplier.

How to eliminate wrong answers

Option B ($1,000,000) is wrong because it incorrectly multiplies AV by EF only ($2,000,000 × 0.25 = $500,000) and then doubles it, or misapplies ARO as 1.0 instead of 0.5. Option C ($125,000) is wrong because it multiplies AV by ARO only ($2,000,000 × 0.5 = $1,000,000) and then divides by 8, or incorrectly halves the EF to 0.125. Option D ($500,000) is wrong because it calculates AV × EF ($2,000,000 × 0.25 = $500,000) but omits the ARO multiplier entirely, treating ARO as 1.0.

Practice this question →
15
MCQhard

A multinational corporation is establishing a risk appetite framework. The board has defined risk appetite as 'no more than one major security incident per year resulting in financial loss exceeding $1M'. Which of the following best represents the risk tolerance for a specific business unit's annual cybersecurity budget allocation?

A.The business unit should maintain annual losses from security incidents between $500,000 and $1,000,000.
B.The business unit may experience up to $1M in losses per year from security incidents.
C.The business unit can accept up to $1.5M loss from a single incident per year.
D.The business unit should not exceed a single incident causing $500,000 loss per year.
AnswerA

Tolerance bands define the acceptable range around appetite, typically a buffer below the appetite limit.

Why this answer

Risk appetite is the broad level of risk the organization is willing to accept, while risk tolerance is the acceptable variation around that appetite. In this case, the tolerance is a range of financial loss from the appetite level up to the capacity (maximum bearable loss). A range of $500,000 to $1,000,000 defines the boundaries within which the business unit can operate without breaching appetite.

Practice this question →
16
Multi-Selecthard

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Select 3 answers
A.Monetary value of potential losses
B.Detailed technical vulnerabilities
C.Likelihood of occurrence expressed as annual probability
D.Anecdotal stories of past incidents
E.Comparison of residual risk to risk appetite
AnswersA, C, E

Why this answer

Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Exam trap

The trap here is that candidates often select 'Detailed technical vulnerabilities' (B) thinking it demonstrates thoroughness, but the board requires business-impact language, not technical depth.

Why the other options are wrong

B

Board members typically lack technical background; focus on business impact.

D

Anecdotes are not quantitative and may skew perception.

Practice this question →
17
Multi-Selecteasy

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Select 2 answers
A.Enforcing least privilege access controls
B.Implementing intrusion detection systems
C.Discontinuing a high-risk business process
D.Purchasing cyber insurance
E.Accepting the risk in a formal statement
AnswersA, B

Access controls reduce the likelihood of unauthorized access.

Why this answer

Options A and B are correct. Enforcing least privilege access controls reduces the risk by limiting user permissions, and implementing intrusion detection systems mitigates risk by detecting and alerting on threats. Option C (discontinuing a high-risk business process) is risk avoidance, option D (purchasing cyber insurance) is risk transfer, and option E (accepting the risk in a formal statement) is risk acceptance.

Practice this question →
18
MCQhard

Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?

A.R-001 only
B.Neither risk requires additional treatment
C.R-002 only
D.Both R-001 and R-002
AnswerD

Correct. Both R-001 and R-002 have residual risk levels above the risk appetite of 5, requiring additional treatment for both.

Why this answer

Both R-001 and R-002 have residual risk levels exceeding the risk appetite of 5 (R-001: 9, R-002: 6). According to standard risk management practice, any residual risk above the appetite threshold requires additional treatment. Although R-002 has a higher inherent risk (24 vs. 12), the priority for treatment is determined by the gap between residual risk and appetite.

R-001's gap of 4 is larger than R-002's gap of 1, indicating a more urgent need for treatment. Therefore, both risks require additional treatment.

Exam trap

Candidates often mistakenly prioritize based on inherent risk magnitude alone, ignoring that residual risk relative to appetite is the primary driver for additional treatment decisions. Here, R-002's higher inherent risk might seem more critical, but R-001's residual risk exceeds appetite by a larger margin, making it equally or more urgent.

How to eliminate wrong answers

Option A is wrong because R-001's residual risk of 9 exceeds the risk appetite threshold of 5, so it does require additional treatment, but it is not the higher priority. Option B is wrong because both risks have residual ratings above the appetite threshold (R-001: 9 > 5, R-002: 6 > 5), so both require additional treatment. Option D is wrong because while both need treatment, the question asks which should be prioritized; R-002's higher inherent risk (24 vs. 12) and larger gap between residual and appetite (6 vs. 5, but with higher inherent) make it the priority, not both equally.

Practice this question →
19
MCQeasy

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

A.Data owner
B.Chief Information Security Officer (CISO)
C.Board of directors
D.Risk owner
AnswerD

Risk owner is accountable for specific risks.

Why this answer

The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

Exam trap

The trap here is confusing the risk owner with the CISO, as candidates often assume the CISO owns all risks, but the CISO is responsible for the risk management process, not for owning specific business unit risks.

How to eliminate wrong answers

Option A is wrong because the data owner is responsible for classifying and protecting data assets, not for managing the overall risk process within a business unit. Option B is wrong because the CISO is an enterprise-level executive who oversees the information security program and risk management framework, but does not own the risks within individual business units. Option C is wrong because the board of directors provides oversight and sets risk appetite, but is not operationally responsible for identifying, assessing, and managing risks in a specific business unit.

Practice this question →
20
MCQhard

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

A.Risk of unauthorized external access to internal services.
B.Risk of denial-of-service attacks from internal hosts.
C.Risk of IP spoofing attacks from the inside network.
D.Risk of data exfiltration via DNS tunneling.
AnswerD

Permissive DNS outbound can be exploited for covert data transfer.

Why this answer

The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Exam trap

The trap here is that candidates may focus on the firewall rule allowing outbound DNS traffic and incorrectly assume it only poses a risk of unauthorized external access (option A), overlooking the more subtle but critical risk of data exfiltration via DNS tunneling, which is a well-known covert channel in security assessments.

How to eliminate wrong answers

Option A is wrong because the firewall rule permits outbound DNS traffic from internal to external, not inbound traffic from external to internal, so unauthorized external access to internal services is not directly facilitated by this rule. Option B is wrong because denial-of-service attacks from internal hosts would require a different attack vector, such as flooding, and the DNS rule does not inherently enable internal hosts to launch DoS attacks; it merely allows DNS queries. Option C is wrong because IP spoofing attacks from the inside network involve forging source IP addresses, which is not directly related to the DNS rule; spoofing is typically mitigated by ingress/egress filtering, not by DNS-specific firewall rules.

Practice this question →
21
MCQhard

During a risk assessment, an organization identifies that a legacy system processes credit card data and has a high likelihood of being exploited. The cost to remediate the vulnerability is $500,000, while the potential loss from a breach is $2 million with a 30% annual probability. What is the most appropriate risk treatment decision based on this information?

A.Risk mitigation by implementing controls to fix the vulnerability
B.Risk transfer by purchasing cyber insurance
C.Risk acceptance because the probability is low
D.Risk avoidance by decommissioning the legacy system
AnswerA

Remediation cost less than ALE.

Why this answer

The annualized loss expectancy (ALE) is $600,000 (30% × $2,000,000), which exceeds the $500,000 remediation cost, making mitigation economically justified. Implementing controls to fix the vulnerability directly reduces the high likelihood of exploitation on the legacy system processing credit card data, aligning with PCI DSS requirements for protecting cardholder data.

Exam trap

The trap here is that candidates may incorrectly calculate ALE as $2 million × 0.3 = $600,000 but then compare it to the potential loss ($2 million) rather than the remediation cost ($500,000), leading them to choose risk transfer or acceptance instead of the economically optimal mitigation.

How to eliminate wrong answers

Option B is wrong because risk transfer via cyber insurance would still leave the organization exposed to the $2 million breach (minus deductible) and does not address the underlying vulnerability, nor does it satisfy PCI DSS compliance for securing credit card data. Option C is wrong because a 30% annual probability is not low; risk acceptance is only appropriate when the residual risk is within the organization's risk appetite, which is not the case here given the high ALE. Option D is wrong because risk avoidance by decommissioning the legacy system would eliminate the risk but is not the 'most appropriate' decision when cost-effective remediation ($500,000) is available, and decommissioning may disrupt business operations or require costly migration.

Practice this question →
22
MCQmedium

Match each risk assessment activity with the correct phase of the risk management lifecycle: Activities: 1. Identify assets and threats 2. Determine risk level 3. Select controls to reduce risk 4. Monitor risk over time Phases: A. Risk Assessment B. Risk Treatment C. Risk Monitoring D. Risk Communication (not used)

1.Identify assets and threats
2.Determine risk level
3.Select controls to reduce risk
4.Monitor risk over time

Why this answer

The correct mapping is: Activity 1 (Identify assets and threats) and Activity 2 (Determine risk level) belong to Risk Assessment (Phase A). Activity 3 (Select controls to reduce risk) belongs to Risk Treatment (Phase B). Activity 4 (Monitor risk over time) belongs to Risk Monitoring (Phase C).

Risk Communication is an overarching activity not assigned as a separate phase.

Exam trap

Candidates often confuse 'determine risk level' as part of risk treatment, but it is actually part of assessment. Also, monitoring is often overlooked as a separate phase.

Why the other options are wrong

1

Correct match is A

2

Correct match is A

3

Correct match is B

4

Correct match is C

Practice this question →
23
MCQmedium

An organization has implemented a risk management framework based on ISO 27005. During the risk identification phase, a new vulnerability is discovered in a critical business application that could lead to a data breach. According to ISO 27005, which of the following is the NEXT step the organization should take?

A.Escalate the vulnerability to senior management for acceptance.
B.Update the risk register with the new vulnerability.
C.Analyze the likelihood and impact of the vulnerability being exploited.
D.Select and implement controls to mitigate the vulnerability.
AnswerC

After risk identification, the next step is risk analysis to determine the level of risk.

Why this answer

According to ISO 27005, after risk identification (including discovering a new vulnerability), the next step is risk analysis, which involves assessing the likelihood and impact of the vulnerability being exploited. This analysis is required before any decision on risk treatment (e.g., mitigation, acceptance) can be made. Option C correctly identifies this sequential step in the ISO 27005 risk management process.

Exam trap

The trap here is that candidates confuse the order of the ISO 27005 phases, often jumping to risk treatment (selecting controls) or documentation (updating the register) before completing the mandatory risk analysis step.

How to eliminate wrong answers

Option A is wrong because risk acceptance is a decision made after risk evaluation (which follows risk analysis), not immediately after identification; escalating without analyzing likelihood and impact bypasses the structured ISO 27005 workflow. Option B is wrong because updating the risk register is a documentation activity that should occur after the risk has been analyzed and evaluated, not as the immediate next step after identification. Option D is wrong because selecting and implementing controls is part of risk treatment, which occurs only after risk analysis and risk evaluation have been completed, per the ISO 27005 lifecycle.

Practice this question →
24
MCQeasy

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

A.Perform a residual risk assessment
B.Purchase additional cyber insurance to cover future breaches
C.Conduct security awareness training for all employees
D.Update the information security policy to mandate stricter controls
AnswerA

After implementing controls, the organization must evaluate whether the residual risk meets the risk appetite.

Why this answer

After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Exam trap

The trap here is that candidates often confuse the order of the risk management process, selecting a corrective action (like training or policy updates) instead of the required evaluation step (residual risk assessment) that validates control effectiveness before moving to other activities.

How to eliminate wrong answers

Option B is wrong because purchasing additional cyber insurance is a risk transfer strategy, not a next step after implementing controls; it does not address the root cause or validate control effectiveness. Option C is wrong because conducting security awareness training is a preventive control that should have been part of the corrective plan, but it is not the immediate next step after implementation; the organization must first assess residual risk to determine if training alone is adequate. Option D is wrong because updating the information security policy is a governance action that may follow the residual risk assessment, but it is not the immediate next step; policy changes should be informed by the residual risk findings.

Practice this question →
25
Multi-Selectmedium

Which TWO of the following are common approaches to information security risk assessment?

Select 2 answers
A.Qualitative
B.Quantitative
C.Penetration testing
D.Vulnerability assessment
E.Business impact analysis
AnswersA, B

Uses descriptive scales.

Why this answer

Qualitative risk assessment uses subjective ratings (e.g., high, medium, low) based on expert judgment to evaluate the likelihood and impact of risks. It is a common approach because it is quick to perform and does not require precise numerical data, making it suitable for initial risk prioritization in information security management.

Exam trap

The trap here is that candidates confuse risk assessment approaches (qualitative/quantitative) with risk assessment activities (like penetration testing or vulnerability assessment), which are tools used within the assessment process but not the overarching methodology itself.

Practice this question →
26
MCQhard

A risk manager is aggregating risks across the enterprise and finds that multiple individual risks, each with low impact and low probability, could combine to create a significant risk. What is the best approach to address this?

A.Ignore the individual risks as they are low priority
B.Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls
C.Accept the risk because the probability of all occurring simultaneously is negligible
D.Treat each individual risk separately with minimal controls
AnswerB

Aggregation provides a holistic view and appropriate mitigation.

Why this answer

Risk aggregation models are specifically designed to quantify the cumulative impact of multiple low-level risks that, when combined, exceed the enterprise's risk appetite. This approach aligns with the CISM domain of Information Security Risk Management, where enterprise-level controls (e.g., centralized monitoring, compensating controls) are necessary to address systemic risk that individual risk treatments cannot mitigate. The key insight is that the combined probability of correlated or cascading events may be higher than the product of individual probabilities, especially when risks share common root causes.

Exam trap

The trap here is that candidates mistakenly apply the 'low probability, low impact' rule from individual risk assessment and ignore the need for aggregation, failing to recognize that the sum of many small risks can exceed the enterprise risk tolerance.

How to eliminate wrong answers

Option A is wrong because ignoring low-impact, low-probability risks violates the principle of risk aggregation; such risks can collectively create a significant exposure, especially if they share a common vulnerability or threat vector. Option C is wrong because accepting risk based on the assumption that the probability of all occurring simultaneously is negligible ignores the possibility of correlated events, where one risk triggers another, or where a single threat exploits multiple vulnerabilities at once. Option D is wrong because treating each individual risk separately with minimal controls fails to address the cumulative effect and may leave the enterprise exposed to a cascading failure that no single control can prevent.

Practice this question →
27
MCQmedium

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

A.Implement compensating controls to reduce the risk
B.Accept the risk as a cost of doing business
C.Avoid the risk by decommissioning the system
D.Purchase cyber insurance to transfer the risk
AnswerA

Compensating controls like network segmentation and enhanced monitoring can reduce risk while keeping the system operational.

Why this answer

Implementing compensating controls, such as network segmentation, application-layer firewalls, or intrusion detection systems (IDS), directly reduces the residual risk of exploiting unpatched vulnerabilities in the legacy payment system without disrupting its critical daily operations. This aligns with the CISM principle that when a risk cannot be remediated (e.g., due to system criticality or vendor end-of-life), compensating controls are the primary treatment to bring risk within the organization's appetite.

Exam trap

The trap here is that candidates often confuse risk transfer (insurance) with risk mitigation, failing to recognize that insurance does not address the technical vulnerability itself, and that acceptance is only appropriate after a cost-benefit analysis shows residual risk is within tolerance.

How to eliminate wrong answers

Option B is wrong because accepting the risk as a cost of doing business is inappropriate when the likelihood of exploitation is high and the system is critical; acceptance is typically reserved for low-likelihood, low-impact risks after other treatments have been considered. Option C is wrong because avoiding the risk by decommissioning the system would halt daily operations, which is not feasible for a system critical to business continuity; avoidance is only viable when the function can be replaced or eliminated without severe operational impact. Option D is wrong because purchasing cyber insurance transfers the financial impact but does not reduce the likelihood or technical exploitability of the unpatched vulnerabilities; insurance is a risk transfer mechanism, not a primary treatment for high-likelihood technical risks.

Practice this question →
28
MCQeasy

Which of the following is the primary purpose of communicating risk assessment results to senior management?

A.To comply with regulatory requirements
B.To enable informed decision-making about risk acceptance
C.To assign blame for security failures
D.To justify the security budget
AnswerB

Senior management needs information to make decisions.

Why this answer

The primary purpose of communicating risk assessment results to senior management is to provide the necessary information for informed decision-making regarding risk acceptance, transfer, or mitigation. Senior management holds the authority to accept residual risk based on a clear understanding of the potential impact and likelihood, which is a core tenet of the CISM framework for information security risk management.

Exam trap

The trap here is that candidates often confuse the operational goal of 'justifying the budget' (Option D) with the strategic governance purpose of 'enabling risk acceptance decisions,' but CISM emphasizes that risk communication to senior management is fundamentally about obtaining informed risk acceptance, not securing funding.

How to eliminate wrong answers

Option A is wrong because while regulatory compliance (e.g., GDPR, SOX) may require documentation of risk assessments, it is not the primary purpose; compliance is a secondary benefit, not the core driver for communication to senior management. Option C is wrong because risk assessment communication is a forward-looking, constructive process aimed at managing risk, not a retrospective exercise to assign blame for security failures, which would undermine trust and collaboration. Option D is wrong because although risk assessment results can support budget justifications, the primary purpose is to enable risk acceptance decisions, not to serve as a budget advocacy tool; budget justification is a downstream outcome, not the immediate objective.

Practice this question →
29
MCQhard

A multinational organization is evaluating its risk appetite for a new cloud-based customer relationship management (CRM) system. The system will store personal data across multiple jurisdictions with varying data protection laws. The risk committee has set a risk appetite statement that allows only low residual risk. Which of the following controls is MOST critical to ensure compliance with the risk appetite?

A.Implement data classification and strict role-based access controls
B.Conduct continuous monitoring and logging of all system activities
C.Encrypt all data at rest and in transit using strong algorithms
D.Negotiate service-level agreements (SLAs) with cloud provider for uptime
AnswerA

Data classification and RBAC directly control who can access sensitive data, reducing risk to an acceptable level.

Why this answer

The risk appetite allows only low residual risk, meaning controls must directly reduce the likelihood or impact of a data breach to an acceptable level. Data classification and strict role-based access controls (RBAC) are the most critical because they enforce least-privilege access to personal data, directly mitigating the primary risk of unauthorized exposure across jurisdictions with varying data protection laws. Without proper classification and RBAC, even encryption or monitoring cannot prevent an authorized user from improperly accessing or exfiltrating data, leaving residual risk above the low threshold.

Exam trap

The trap here is that candidates often select encryption (Option C) as the most critical control because it is a strong technical safeguard, but they overlook that encryption does not address the risk of authorized users misusing data, which is the primary driver of residual risk in a multi-jurisdictional environment with strict compliance requirements.

How to eliminate wrong answers

Option B is wrong because continuous monitoring and logging are detective controls that identify breaches after they occur, but they do not reduce the likelihood or impact of unauthorized access to meet a low residual risk appetite; they only provide visibility. Option C is wrong because encryption protects data confidentiality if data is intercepted or stolen, but it does not prevent authorized users from misusing access or violating data protection laws, so residual risk from insider threats remains high. Option D is wrong because SLAs for uptime address availability and business continuity, not data protection or compliance with privacy laws, and thus have no direct effect on the residual risk of unauthorized data access or legal non-compliance.

Practice this question →
30
MCQeasy

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

A.Purchase a comprehensive cyber insurance policy
B.Fire the IT staff responsible for the security failures
C.Conduct a risk assessment to identify assets, threats, and vulnerabilities
D.Immediately implement a backup and disaster recovery solution
AnswerC

Correct; risk assessment is the first step to understand the risk landscape.

Why this answer

The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Exam trap

The CISM framework emphasizes that risk management must begin with identification (risk assessment) before any treatment (mitigation, transfer, or acceptance). The trap here is that candidates jump to a technical fix (backups) or a financial fix (insurance) without first understanding the full scope of risks.

How to eliminate wrong answers

Option A is wrong because purchasing a cyber insurance policy before conducting a risk assessment is a reactive financial transfer that does not address the root causes of the attack (e.g., no backups, poor security posture). Insurance may also be denied or voided if the firm cannot demonstrate a proper risk management process. Option B is wrong because firing IT staff is a punitive, non-technical response that does not remediate the systemic security failures (e.g., lack of backup strategy, missing patch management).

It also ignores the owner's own responsibility for not prioritizing security investments. Option D is wrong because immediately implementing a backup solution without a prior risk assessment may lead to improper configuration (e.g., storing backups on the same network segment as the file server, allowing ransomware to encrypt them) or failure to address other critical vulnerabilities (e.g., weak authentication, unpatched software).

Practice this question →
31
Matchingmedium

Match each risk management term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Risk level before controls are applied

Risk remaining after controls are implemented

Amount of risk the organization is willing to accept

Acceptable variation around the risk appetite

Process of modifying risk by applying controls

Why these pairings

Key risk management terms from CISM: Risk is the effect of uncertainty on objectives; controls are measures that modify risk; vulnerabilities are weaknesses that can be exploited; threats are potential causes of incidents. The distractor pairs swap risk with threat and control with vulnerability.

Practice this question →
32
MCQmedium

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

A.Transfer the risk by purchasing cyber insurance
B.Avoid the risk by discontinuing the web application
C.Remediate the risk by implementing parameterized queries and input validation
D.Accept the risk because the likelihood is low after compensating controls
AnswerC

This directly addresses the vulnerability and reduces the risk to an acceptable level.

Why this answer

Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Exam trap

The trap here is that candidates often confuse risk transfer (insurance) with risk mitigation, or they incorrectly assume that accepting risk is a default option when the scenario clearly indicates a high-likelihood, high-impact vulnerability that can be directly fixed with a standard coding practice.

How to eliminate wrong answers

Option A is wrong because purchasing cyber insurance transfers the financial impact of a breach, not the technical risk itself; the SQL injection vulnerability remains exploitable, and insurance does not prevent data loss or regulatory penalties. Option B is wrong because avoiding the risk by discontinuing the web application would eliminate business functionality and is disproportionate when a proven technical control (parameterized queries) exists to mitigate the vulnerability. Option D is wrong because accepting the risk is only appropriate when residual risk is low after compensating controls, but the scenario states the likelihood is high and no compensating controls have been implemented; accepting without remediation would leave the organization exposed to a high-probability attack.

Practice this question →
33
MCQeasy

Which of the following best describes residual risk?

A.Risk before any controls are applied
B.Risk that remains after implementing controls
C.The likelihood that a control will fail
D.The level of risk an organization is willing to accept
AnswerB

Residual risk is the remaining risk after mitigation.

Why this answer

Residual risk is defined in information security risk management as the risk that remains after management has implemented all planned controls. This concept is central to the CISM framework because it represents the exposure that must be accepted, transferred, or further mitigated by the organization. Unlike inherent risk (before controls), residual risk accounts for the effectiveness of the security measures in place.

Exam trap

The trap here is that candidates often confuse residual risk with risk appetite (Option D), but residual risk is the actual remaining exposure after controls, while risk appetite is the threshold for acceptable exposure.

How to eliminate wrong answers

Option A is wrong because it describes inherent risk, which is the risk level before any controls are applied, not the risk that remains after controls. Option C is wrong because it describes control risk or the likelihood of control failure, which is a component of residual risk calculation but not the definition of residual risk itself. Option D is wrong because it describes risk appetite or risk tolerance, which is the amount of risk an organization is willing to accept, not the actual risk remaining after controls.

Practice this question →
34
MCQhard

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

A.Accept the risk because the control is not cost-justified.
B.Accept the risk because ALE after control is only $2,500.
C.Implement the control because it reduces ALE to $2,500.
D.Implement the control because ALE is $10,000, and control cost is only $12,000.
AnswerA

The cost of control is greater than the risk reduction benefit, so acceptance is appropriate.

Why this answer

The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified.

Therefore, accepting the risk is the most cost-effective response.

Exam trap

The trap here is that candidates often compare the control cost to the original ALE ($10,000) or to the residual ALE ($2,500) instead of comparing it to the reduction in ALE ($7,500), leading to incorrect cost-justification conclusions.

How to eliminate wrong answers

Option B is wrong because it states 'accept the risk because ALE after control is only $2,500' — this is a correct observation about the residual ALE but fails to compare the control cost ($12,000) against the reduction in ALE ($7,500), which is the key cost-benefit analysis. Option C is wrong because it says 'implement the control because it reduces ALE to $2,500' — this ignores that the control cost ($12,000) is greater than the reduction in ALE ($7,500), making it not cost-justified. Option D is wrong because it says 'implement the control because ALE is $10,000, and control cost is only $12,000' — this incorrectly implies that a control cost lower than the original ALE justifies implementation, but the correct comparison is between the control cost and the reduction in ALE (not the original ALE).

Practice this question →
35
Drag & Dropmedium

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Audits start with scope definition, planning, execution, documentation, and reporting.

Practice this question →
36
MCQhard

During a risk assessment, the risk team identifies that a key vendor has access to sensitive data. The vendor's security posture is unclear. Which of the following is the BEST course of action?

A.Ignore the risk because the vendor is known
B.Terminate the vendor relationship immediately
C.Conduct a third-party risk assessment
D.Request the vendor's latest security certification
AnswerC

A formal assessment evaluates the vendor's security controls.

Why this answer

When a vendor's security posture is unclear and they have access to sensitive data, the best course of action is to conduct a third-party risk assessment. This assessment evaluates the vendor's security controls, compliance with standards (e.g., ISO 27001, SOC 2), and contractual obligations before making any decisions. It provides the necessary evidence to determine if the risk is acceptable or requires mitigation, rather than acting on assumptions.

Exam trap

The trap here is that candidates may choose D, thinking a certification is a definitive proof of security, but CISM emphasizes that certifications are only one piece of evidence and must be supplemented with a current, context-specific risk assessment.

How to eliminate wrong answers

Option A is wrong because ignoring the risk based solely on vendor familiarity violates the principle of due care and could lead to data breaches; risk must be assessed regardless of relationship length. Option B is wrong because terminating the relationship immediately is a drastic, reactive measure that may disrupt business operations without first verifying the actual security posture; a risk assessment should precede such decisions. Option D is wrong because requesting the latest security certification alone is insufficient; certifications may be outdated, not cover all relevant controls, or be falsified, and a comprehensive assessment is needed to validate the vendor's current security state.

Practice this question →
37
Multi-Selecthard

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Select 3 answers
A.Lack of senior management support
B.Inability to quantify risks in financial terms
C.Too many controls implemented too quickly
D.Resistance to change from business units
E.Overly detailed risk appetite
AnswersA, B, D

Without top-down support, the program may lack resources and authority.

Why this answer

Lack of senior management support (A) is a common challenge because risk management programs require executive sponsorship to enforce policies, allocate budget, and drive cross-departmental compliance. Without C-level backing, risk assessments and remediation efforts often stall due to insufficient authority and resources.

Exam trap

ISACA CISM often tests the distinction between implementation challenges (e.g., lack of support, resistance, quantification difficulty) and operational symptoms (e.g., too many controls), so candidates mistakenly select 'too many controls' because it sounds like a problem, but it is not a root challenge of program implementation.

Practice this question →
38
MCQeasy

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

A.Avoid the risk by discontinuing online services
B.Transfer the risk through cyber insurance
C.Accept the risk
D.Mitigate the risk by implementing stronger access controls
AnswerD

Addressing the control weakness reduces the likelihood of similar incidents.

Why this answer

Mitigating the risk by implementing stronger access controls directly addresses the root cause and reduces the likelihood of future breaches. Accepting the risk is inappropriate when a breach has already occurred. Transferring via insurance only covers financial loss but does not reduce likelihood.

Avoiding by discontinuing online services is extreme and not immediately necessary.

Practice this question →
39
Multi-Selecthard

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Select 2 answers
A.Business continuity plan
B.Risk appetite and tolerance
C.Data classification scheme
D.Risk assessment methodology
E.Vulnerability scanning process
AnswersB, D

Risk appetite defines the amount of risk the organization is willing to accept, essential for risk management.

Why this answer

Options B and D are correct. Risk appetite and tolerance (B) define the organization's willingness to accept risk, and a risk assessment methodology (D) provides the structured approach to identify, analyze, and evaluate risks. Business continuity planning (A) is a separate domain focused on incident recovery, not a core component of risk management.

Data classification (C) is part of information security governance, not risk management program components. Vulnerability scanning (E) is a technical control activity, not a program-level component.

Practice this question →
40
MCQmedium

A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?

A.Mitigate by reducing the RTO to 1 hour through process automation
B.Transfer the risk by purchasing business interruption insurance
C.Accept the risk because the RTO is shorter than the MTD
D.Avoid the risk by replacing the system with a more reliable one
AnswerA

Reducing RTO to below MTD is the correct mitigation.

Why this answer

The current RTO of 4 hours exceeds the MTD of 2 hours, meaning the system cannot be restored within the maximum tolerable downtime, resulting in unacceptable business impact. Reducing the RTO to 1 hour through process automation brings recovery time well within the MTD, effectively mitigating the risk to an acceptable level. This aligns with the risk management principle of applying controls to close the gap between RTO and MTD.

Exam trap

The trap here is that candidates mistakenly think accepting risk is valid when RTO is shorter than MTD, but the question presents the opposite scenario (RTO > MTD), making acceptance inappropriate; ISACA often tests this precise reversal to catch those who confuse RTO and MTD relationships.

How to eliminate wrong answers

Option B is wrong because transferring risk via business interruption insurance does not address the fundamental issue that the system cannot be restored within the MTD; insurance compensates for financial loss but does not prevent operational impact or data loss during the outage. Option C is wrong because accepting the risk is only appropriate when the RTO is shorter than the MTD, but here the RTO (4 hours) is longer than the MTD (2 hours), creating an unacceptable risk exposure. Option D is wrong because avoiding the risk by replacing the system is an extreme and costly measure that is not necessary when a less disruptive mitigation (reducing RTO) can achieve compliance with the MTD.

Practice this question →
41
Multi-Selectmedium

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Select 2 answers
A.Vendor security assessment ratings
B.Risk scenarios with likelihood and impact ratings
C.Detailed results of control testing
D.Risk treatment recommendations
E.Complete asset inventory
AnswersB, D

Risk scenarios with assessments are central to a risk assessment report.

Why this answer

Risk scenarios with likelihood and impact ratings are a core component of a risk assessment report because they provide a structured narrative of how a threat could exploit a vulnerability, enabling the organization to prioritize risks based on quantitative or qualitative measures. This aligns with ISACA's best practices for risk communication, ensuring decision-makers understand the potential business impact.

Exam trap

The trap here is that candidates often confuse the risk assessment report's output (risk scenarios and treatment recommendations) with inputs or supporting data (vendor ratings, control testing details, asset inventory), leading them to select options that are part of the process but not the final report.

Practice this question →
42
MCQeasy

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

A.Use the asset's purchase value to determine priority
B.Assess the business impact of each asset's compromise
C.Perform a vulnerability scan and prioritize based on findings
D.Review historical incident reports for each asset
AnswerB

Assessing business impact directly ties to criticality and is the best method for prioritization.

Why this answer

The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Exam trap

The trap here is that candidates often confuse 'asset value' with 'purchase cost' (Option A) or mistake technical severity (Option C) for business criticality, failing to recognize that risk management prioritization must be driven by business impact analysis, not by financial or technical metrics alone.

How to eliminate wrong answers

Option A is wrong because purchase value does not reflect the asset's criticality to business operations; a low-cost server hosting a critical database may have far higher impact than an expensive but non-essential workstation. Option C is wrong because vulnerability scan findings indicate technical weaknesses but ignore the business context; a high-severity vulnerability on a low-impact asset may be less urgent than a medium-severity vulnerability on a mission-critical system. Option D is wrong because historical incident reports only show past events, which may not capture emerging threats or changes in asset criticality, and can lead to reactive rather than proactive prioritization.

Practice this question →
43
MCQmedium

A financial institution is implementing a new online banking platform. The risk assessment identified that the authentication module has a high likelihood of exploitation due to weak password policies. The risk owner has decided to implement multi-factor authentication (MFA) to reduce the risk. This is an example of which risk response strategy?

A.Risk avoidance
B.Risk mitigation
C.Risk acceptance
D.Risk transfer
AnswerB

MFA reduces the likelihood or impact of the risk, which is the definition of risk mitigation.

Why this answer

Implementing multi-factor authentication (MFA) reduces the likelihood or impact of a security risk by adding additional authentication factors (e.g., something you know, something you have, something you are) beyond a weak password. This directly aligns with risk mitigation, which seeks to decrease the residual risk to an acceptable level through controls. The decision does not eliminate the risk entirely (avoidance), accept it without action, or transfer it to a third party.

Exam trap

The trap here is that candidates confuse 'risk mitigation' with 'risk avoidance' because both involve implementing controls, but avoidance means eliminating the activity or technology entirely, whereas mitigation reduces but does not eliminate the risk.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean not implementing the online banking platform or removing the authentication module entirely, which is not the case. Option C is wrong because risk acceptance would involve acknowledging the risk and taking no further action, whereas MFA is an active control. Option D is wrong because risk transfer would involve shifting the financial impact of the risk to another party (e.g., via insurance or outsourcing), not implementing a technical control like MFA.

Practice this question →
44
MCQhard

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

A.Increased audit findings
B.Regulatory fines for noncompliance
C.Inaccurate risk profile leading to uninformed decisions
D.Higher insurance premiums
AnswerC

An outdated risk assessment misrepresents current risks, impairing decision-making.

Why this answer

C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.

Exam trap

The trap here is that candidates often focus on tangible, immediate consequences like fines or audit findings, but CISM emphasizes that the most significant impact of noncompliance is the erosion of the risk management process itself—specifically, the inability to make informed decisions based on an accurate risk profile.

How to eliminate wrong answers

Option A is wrong because increased audit findings are a secondary outcome of noncompliance, not the most significant consequence; audits may flag the missing review, but the core harm is the degraded decision-making capability. Option B is wrong because regulatory fines for noncompliance depend on specific legal or contractual requirements (e.g., GDPR, PCI DSS), and while possible, they are not guaranteed and are less impactful than the systemic failure to maintain an accurate risk profile. Option D is wrong because higher insurance premiums may result from a poor risk posture, but they are a financial consequence that follows from the underlying inaccurate risk profile, not the primary risk management failure itself.

Practice this question →
45
MCQhard

Which host should be prioritized for risk mitigation based on the vulnerability scan results?

A.192.168.10.25
B.192.168.10.35
C.All hosts should be equally prioritized
D.192.168.10.30
AnswerB

Highest count of critical and high vulnerabilities.

Why this answer

Host 192.168.10.35 is prioritized because it has the highest number of critical vulnerabilities (e.g., CVE-2023-XXXX with CVSS 9.8) and is exposed to the internet, increasing the likelihood of exploitation. Risk mitigation prioritization is based on the combination of vulnerability severity, asset criticality, and threat exposure, not just vulnerability count.

Exam trap

The trap here is that candidates often assume all vulnerabilities should be treated equally or that the host with the most vulnerabilities is always the highest priority, ignoring the criticality of the asset and the exploitability of the vulnerabilities.

How to eliminate wrong answers

Option A is wrong because 192.168.10.25 has fewer critical vulnerabilities and is isolated on a private subnet, reducing its risk exposure. Option C is wrong because risk mitigation should be prioritized based on risk level, not equal treatment; hosts with higher risk (e.g., internet-facing with critical CVEs) require immediate attention. Option D is wrong because 192.168.10.30, despite having some vulnerabilities, has a lower CVSS score average and is not internet-facing, making it a lower priority than 192.168.10.35.

Practice this question →
46
MCQhard

A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?

A.Require the CSP to provide dedicated hardware security modules and restrict data storage to approved regions through contractual terms
B.Accept the risk because the CSP has strong security certifications and the likelihood of a breach is low
C.Cancel the cloud migration and build a new private data center in a compliant location
D.Transfer the risk by purchasing cyber insurance that covers regulatory fines
AnswerA

This directly mitigates the identified risks and aligns with the organization's low risk appetite.

Why this answer

It directly addresses the root causes: data residency non-compliance and lack of control over encryption keys. Requiring dedicated hardware security modules (HSMs) and restricting data storage to approved regions through contractual terms ensures that the organization retains control over key management and meets regulatory requirements. This aligns with the low risk appetite and the board's mandate to mitigate risks to an acceptable level.

Option B (accept the risk) is incorrect because it contradicts the board's mandate to mitigate all risks, and certifications alone do not guarantee compliance.

Option C (cancel migration) is too drastic and costly; the organization can achieve compliance with the CSP rather than abandoning the cloud migration.

Option D (transfer risk via insurance) does not achieve regulatory compliance; fines may still be imposed regardless of insurance coverage.

Exam trap

Candidates may mistakenly believe that accepting risk is viable when the CSP has strong certifications, but the board's mandate requires mitigation, not acceptance.

Practice this question →
47
MCQmedium

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

A.Mitigate the risk by conducting regular vendor audits.
B.Avoid the risk by not engaging vendors that cannot meet security requirements.
C.Transfer the risk by requiring vendors to have cyber insurance.
D.Accept the risk because third-party risks are unavoidable.
AnswerB

Avoidance eliminates the risk entirely, fitting low appetite.

Why this answer

Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.

Exam trap

The trap here is that candidates often default to mitigation (audits) as the standard response, failing to recognize that when risk appetite is explicitly low, avoidance is the mandated first-line strategy per ISACA's risk treatment hierarchy.

How to eliminate wrong answers

Option A is wrong because mitigation through regular vendor audits reduces but does not eliminate the risk; residual risk remains, which conflicts with a low risk appetite. Option C is wrong because transferring risk via cyber insurance does not reduce the likelihood or impact of a breach; it only provides financial compensation, leaving the organization exposed to reputational and operational harm. Option D is wrong because acceptance is only appropriate when residual risk falls within the risk appetite; here, the low appetite makes acceptance unacceptable.

Practice this question →
48
MCQeasy

A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?

A.Conduct a detailed cost-benefit analysis to convince the risk owner to upgrade, but do not escalate until the analysis is complete.
B.Accept the risk owner's decision and update the risk register to reflect the deferred treatment with a note of the risk owner's acceptance.
C.Implement a compensating control, such as strong application-layer encryption, to reduce the residual risk to an acceptable level without upgrading TLS.
D.Escalate the issue to the risk management committee for a decision on whether to accept, mitigate, or defer the risk.
AnswerD

This follows the governance process and ensures that the risk is evaluated at the appropriate level with authority to override the risk owner's stance.

Why this answer

Given the risk owner's refusal and the high residual risk exceeding appetite, the security manager should formally escalate to the risk management committee for a final decision, as per the established governance process. This ensures proper oversight and documentation.

Practice this question →
49
Multi-Selecthard

Which THREE of the following are valid methods to identify information security risks? (Choose three.)

Select 3 answers
A.Financial audit
B.Business impact analysis (BIA)
C.Threat modeling workshops
D.Vulnerability scanning
E.Penetration testing
AnswersB, C, D

BIA identifies critical processes and potential impact, helping to prioritize risks.

Why this answer

A Business Impact Analysis (BIA) is a systematic process to identify and evaluate the potential effects of disruptions to critical business functions, thereby identifying information security risks by quantifying the impact of loss of confidentiality, integrity, or availability. It directly links business processes to the underlying IT assets and their security requirements, making it a valid risk identification method as per CISM domain guidance.

Exam trap

The trap here is that candidates often confuse penetration testing (a control validation activity) with risk identification, but CISM distinguishes that risk identification must occur before any testing, and penetration testing is a detective control, not a discovery method.

Practice this question →
50
MCQhard

A company has a risk appetite that is 'low' for operational risks. A risk assessment recently identified that a high-speed trading platform has a residual risk rating of 'high' after controls are applied. The cost to further reduce the risk is $1 million, which exceeds the expected benefit. What is the most appropriate action for the risk owner?

A.Accept the residual risk with formal sign-off from senior management
B.Adjust the risk appetite to 'moderate' to align with the residual risk
C.Transfer the risk by taking out an insurance policy
D.Approve additional controls to lower residual risk regardless of cost
AnswerA

Since controls are not cost-effective, acceptance is appropriate with proper approval.

Why this answer

The risk owner has determined that the cost to further reduce the residual risk ($1 million) exceeds the expected benefit, making additional controls economically unjustifiable. Since the company's risk appetite is 'low' for operational risks but the residual risk is 'high', the most appropriate action is to formally accept the residual risk with senior management sign-off, as this documents the decision and acknowledges the deviation from the stated risk appetite. This aligns with the CISM principle that risk acceptance is a valid treatment option when the cost of mitigation outweighs the benefit, provided it is approved at the appropriate level.

Exam trap

The trap here is that candidates confuse 'risk acceptance' with 'ignoring the risk' or assume that a low risk appetite always mandates mitigation, failing to recognize that formal acceptance with senior sign-off is a legitimate and required response when cost-benefit analysis shows mitigation is not justified.

How to eliminate wrong answers

Option B is wrong because adjusting the risk appetite to 'moderate' to align with the residual risk is a reactive and inappropriate approach; risk appetite should be set by the board based on strategic objectives, not changed to justify a single risk assessment outcome. Option C is wrong because transferring the risk via insurance does not reduce the residual risk rating; it only shifts the financial impact, and the high-speed trading platform's operational risk (e.g., latency, system failure) may not be fully insurable or cost-effective given the premium. Option D is wrong because approving additional controls regardless of cost violates the principle of cost-benefit analysis; the question explicitly states the cost exceeds the expected benefit, making this option economically unsound and contrary to risk management best practices.

Practice this question →
51
MCQhard

A healthcare organization is merging with another entity and must integrate their IT systems. During due diligence, it is discovered that the acquired company has a high number of unpatched critical vulnerabilities in its electronic health record (EHR) system. The merger timeline is aggressive and the integration team wants to proceed as planned. As the risk manager, what is the best course of action?

A.Accept the risk because the vulnerabilities are in the legacy system which will be replaced.
B.Transfer the risk by purchasing cyber insurance for the combined entity.
C.Recommend delaying the integration until vulnerabilities are patched.
D.Proceed with integration but implement compensating controls like network segmentation.
AnswerC

Delay remediates the root cause before exposure increases.

Why this answer

Delaying integration until the critical vulnerabilities are patched is the most prudent action to prevent exploitation during and after integration. Proceeding with compensating controls may not be sufficient given the criticality, and accepting the risk could lead to a major breach. Insurance does not prevent the breach.

Practice this question →
52
MCQeasy

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

A.To provide early warning signals of increasing risk
B.To report on past incidents and losses
C.To measure the effectiveness of security controls
D.To demonstrate compliance with regulations
AnswerA

KRIs indicate potential risk changes.

Why this answer

A Key Risk Indicator (KRI) is a metric used to provide an early warning signal that a risk exposure is approaching or exceeding acceptable thresholds. Unlike lagging indicators that report on past events, KRIs are forward-looking, enabling proactive risk mitigation before a risk materializes into a loss.

Exam trap

The trap here is that candidates often confuse KRIs with KPIs or KCIs, mistakenly thinking KRIs measure past performance or control effectiveness, when in fact KRIs are specifically designed to provide leading indicators of changing risk exposure.

How to eliminate wrong answers

Option B is wrong because reporting on past incidents and losses is the function of a Key Performance Indicator (KPI) or a loss event metric, not a KRI, which is forward-looking. Option C is wrong because measuring the effectiveness of security controls is the role of a Key Control Indicator (KCI) or control effectiveness metric, not a KRI, which focuses on risk exposure. Option D is wrong because demonstrating compliance with regulations is typically achieved through compliance audits and control testing, not through KRIs, which are designed to signal changes in risk levels rather than adherence to regulatory requirements.

Practice this question →
53
Multi-Selectmedium

A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?

Select 2 answers
A.Aligns security spending with business objectives
B.Provides a defensible justification for security investments
C.Eliminates the need for qualitative analysis
D.Ensures compliance with all applicable regulations
E.Reduces the total number of security controls needed
AnswersA, B

Correct; risk assessment helps prioritize based on business impact.

Why this answer

A risk-based approach ensures that security spending is directed toward mitigating the risks that most threaten the institution's critical business objectives, such as protecting customer financial data or ensuring transaction integrity. By prioritizing initiatives based on assessed risk levels, the organization directly links security investments to business value, avoiding waste on low-priority controls.

Exam trap

The trap here is that candidates may confuse the purpose of risk assessment results—which is to prioritize based on business impact—with compliance or control reduction, leading them to select options like D or E that sound plausible but are not primary benefits of a risk-based approach.

Practice this question →
54
MCQhard

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

A.Hire two additional security analysts to improve monitoring and incident response.
B.Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.
C.Increase cyber liability insurance coverage to $5 million to cover potential breach costs.
D.Rewrite the web application using a secure development framework to eliminate vulnerabilities.
AnswerB

This directly addresses the failure to remediate known vulnerabilities, ensuring timely fixes.

Why this answer

A formal vulnerability management program with defined remediation SLAs directly addresses the root cause: the known vulnerability was not patched due to competing priorities. By tying remediation timelines to risk severity (e.g., critical vulnerabilities patched within 7 days, high within 30 days), the company operationalizes its 'moderate' risk appetite and ensures that penetration test findings are acted upon before they can be exploited. This is the most cost-effective approach given the limited budget, as it leverages existing staff and processes rather than requiring new hires or expensive rewrites.

Exam trap

ISACA often tests the misconception that increasing insurance or hiring more staff is the primary solution to a risk management failure, when in fact the core issue is the lack of a process to enforce remediation of known vulnerabilities within the organization's risk appetite.

How to eliminate wrong answers

Option A is wrong because hiring two additional security analysts improves monitoring and incident response but does not fix the underlying issue of unpatched vulnerabilities; the attacker exploited a known vulnerability that should have been remediated, not a detection gap. Option C is wrong because increasing cyber liability insurance to $5 million only transfers financial risk after a breach, it does not prevent recurrence of the vulnerability exploitation and violates the principle of reducing risk to an acceptable level. Option D is wrong because rewriting the web application using a secure development framework is a long-term, high-cost solution that exceeds the limited budget and does not address the immediate need to remediate existing vulnerabilities; it also ignores the fact that the current application is already in production and needs a process for ongoing vulnerability management.

Practice this question →
55
MCQhard

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

A.Implement additional controls immediately
B.Document the risk as accepted
C.Escalate the residual risk to senior management
D.Reassess the risk using a different methodology
AnswerC

Why this answer

When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

Exam trap

The trap here is that candidates confuse operational risk acceptance (which a manager can do for low risks) with management-level risk acceptance required when residual risk exceeds the appetite threshold, leading them to incorrectly choose Option B.

Why the other options are wrong

A

While additional controls may be an option, the immediate next step is to escalate and get a decision.

B

Acceptance requires authorization from management, not unilateral action by the security manager.

D

Changing methodology may give different numbers but doesn't address the underlying issue.

Practice this question →
56
MCQhard

After implementing controls, the residual risk is calculated to be at a level that slightly exceeds the risk appetite. The business owner argues that the cost of further mitigation outweighs the benefit. What is the most appropriate action for the risk manager?

A.Transfer the risk through insurance
B.Accept the residual risk as a business decision
C.Document the risk and escalate to senior management for acceptance
D.Implement additional controls regardless of cost
AnswerC

Formal escalation ensures informed decision-making and proper risk acceptance.

Why this answer

The risk manager should document the risk and escalate to senior management for formal acceptance. Acceptance requires approval at an appropriate level. Simply accepting without documentation is not proper.

Implementing controls regardless of cost ignores cost-benefit. Transferring via insurance does not address residual risk that already exceeds appetite.

Practice this question →
57
Drag & Dropmedium

Order the steps for implementing a security awareness training program.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Practice this question →
58
MCQeasy

Which of the following is the most significant risk in this architecture?

A.Segmentation of network zones
B.Admin access via VPN and jump host
C.Use of TLS 1.3 for encryption
D.Direct SQL authentication from application server to database
AnswerD

If app server is compromised, database can be accessed directly.

Why this answer

Direct SQL authentication from the application server to the database bypasses any centralized authentication or service account management, creating a single point of failure for credential compromise. If the application server is breached, an attacker can extract hardcoded or stored database credentials and gain unfettered access to the database, leading to potential data exfiltration or destruction. This risk is magnified because direct SQL authentication often uses static, long-lived credentials without the layered controls (e.g., MFA, session auditing) that would be present in a more robust authentication path.

Exam trap

The trap here is that candidates often mistake a common security control (like TLS 1.3 or VPN) for a risk, or they fail to recognize that direct SQL authentication is a dangerous architectural flaw that bypasses all centralized authentication and authorization controls.

How to eliminate wrong answers

Option A is wrong because segmentation of network zones is a security control that reduces risk by isolating traffic and limiting lateral movement; it is not a risk but a mitigation. Option B is wrong because admin access via VPN and jump host is a standard, secure practice that enforces encrypted tunnels and a controlled bastion host, reducing the attack surface for administrative actions. Option C is wrong because use of TLS 1.3 for encryption is a strong, modern cryptographic protocol that provides confidentiality and integrity for data in transit; it is a security enhancement, not a risk.

Practice this question →
59
MCQmedium

A security manager is conducting a risk assessment for a new cloud-based system. The system will store sensitive customer data. Which of the following should be the FIRST step in the risk assessment process?

A.Select appropriate security controls
B.Conduct vulnerability scanning
C.Identify potential threat sources
D.Identify and classify information assets
AnswerD

Asset identification is foundational to any risk assessment.

Why this answer

In the risk assessment process, the first step is to identify and classify information assets because you cannot assess risks to assets you haven't identified. For a cloud-based system storing sensitive customer data, this means cataloging data types (e.g., PII, financial records), their locations (e.g., specific cloud storage buckets), and their classification levels (e.g., confidential, restricted) before any threat or vulnerability analysis can be meaningfully performed.

Exam trap

The trap here is that candidates often confuse the order of risk assessment steps, mistakenly thinking that identifying threats (Option C) comes first because threats are the 'active' element, but CISM emphasizes that asset identification is the foundational step that drives all subsequent analysis.

How to eliminate wrong answers

Option A is wrong because selecting security controls is a risk treatment step that occurs after risks have been assessed and prioritized, not at the beginning of the assessment. Option B is wrong because vulnerability scanning is a technical activity that identifies weaknesses in existing systems, but it cannot be effectively scoped or targeted without first knowing which assets are in scope and their classification. Option C is wrong because while identifying threat sources is important, it logically follows asset identification; you must know what assets you are protecting before you can determine which threats are relevant to those specific assets.

Practice this question →
60
MCQeasy

Which of the following is the PRIMARY purpose of an information security risk assessment?

A.To eliminate all identified risks
B.To identify and evaluate risks in terms of likelihood and impact
C.To comply with regulatory requirements
D.To assign blame for security incidents
AnswerB

Why this answer

The primary purpose of an information security risk assessment is to identify and evaluate risks in terms of their likelihood and impact. This process enables an organization to prioritize risks and determine appropriate risk treatment options, such as mitigation, transfer, acceptance, or avoidance, based on a clear understanding of the risk landscape. Without this evaluation, any subsequent risk management decisions would lack a defensible basis.

Exam trap

The trap here is that candidates often confuse the purpose of a risk assessment with the purpose of risk treatment or compliance, leading them to select 'comply with regulatory requirements' as the primary purpose, when in fact compliance is a secondary benefit, not the core objective.

Why the other options are wrong

A

Eliminating all risks is impractical and not the primary purpose; risk assessment informs risk treatment decisions.

C

Compliance may be a driver but is not the primary purpose; the core is informed decision-making.

D

Risk assessment is proactive, not punitive.

Practice this question →
61
Multi-Selecteasy

Which TWO of the following are examples of key risk indicators (KRIs) for cybersecurity risk?

Select 2 answers
A.Time to patch critical vulnerabilities
B.Number of successful phishing simulations
C.Number of vendors with SOC 2 reports
D.Number of unresolved security incidents
E.Percentage of employees completing security training
AnswersA, D

Patch latency is a key indicator of vulnerability risk.

Why this answer

The time to patch critical vulnerabilities directly measures the organization's exposure window to known exploits, which is a leading indicator of cybersecurity risk. A longer patch time increases the likelihood of a successful attack, making it a key risk indicator (KRI) for vulnerability management.

Exam trap

The trap here is that candidates often confuse KRIs with KPIs, selecting metrics like training completion or phishing simulation results because they seem risk-related, but KRIs must directly measure the likelihood or impact of a risk event, not the performance of a control.

Practice this question →
62
Multi-Selectmedium

An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?

Select 2 answers
A.Determining acceptable risk levels
B.Analyzing threats and vulnerabilities
C.Monitoring incident response plans
D.Evaluating the effectiveness of existing controls
E.Selecting controls to mitigate risks
AnswersB, D

This is a core activity in risk identification and analysis.

Why this answer

Analyzing threats and vulnerabilities is a core step in the risk assessment process, as defined by the NIST SP 800-30 and ISO 31000 frameworks. This activity identifies potential threat sources and existing vulnerabilities that could be exploited, enabling the calculation of likelihood and impact for risk scenarios.

Exam trap

The trap here is confusing risk assessment (identify/analyze) with risk treatment (select controls) or risk evaluation (set acceptable levels), leading candidates to pick A or E instead of focusing on the core assessment activities B and D.

Practice this question →
63
MCQmedium

An organization selects a control to mitigate a risk, but after implementation, the risk level remains unchanged. What should the risk manager do first?

A.Increase the control strength
B.Re-assess the risk and control effectiveness
C.Report to senior management
D.Accept the risk as residual
AnswerB

Reassessment is necessary to understand the gap.

Why this answer

When a control is implemented but the risk level remains unchanged, the risk manager must first re-assess the risk and control effectiveness to determine why the control failed to reduce the risk. This aligns with the CISM risk management process, which mandates that controls be evaluated for proper design and operation before any escalation or acceptance decisions are made. Without this re-assessment, the organization cannot know whether the control is misconfigured, insufficient, or simply not addressing the correct threat vector.

Exam trap

The trap here is that candidates mistakenly jump to 'increase control strength' (Option A) because they assume the control is simply too weak, rather than first verifying whether the control is actually functioning or correctly designed to address the specific risk.

How to eliminate wrong answers

Option A is wrong because increasing control strength without first understanding why the current control is ineffective could waste resources and may not address the root cause, such as a misconfiguration or incorrect threat model. Option C is wrong because reporting to senior management should occur only after the risk manager has performed a re-assessment and has a clear picture of the control failure and its implications. Option D is wrong because accepting the risk as residual is premature; the risk manager must first verify whether the control can be adjusted or replaced before deciding to accept an unchanged risk level.

Practice this question →
64
MCQeasy

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

A.Accept the risk as it is already controlled
B.Evaluate the residual risk and decide on additional controls
C.Transfer the risk to a cyber insurance provider
D.Conduct another round of user awareness training
AnswerB

The organization should assess whether current controls reduce risk to an acceptable level and implement further measures if needed.

Why this answer

After implementing initial controls (spam filtering and user awareness training), the organization must evaluate the residual risk—the risk that remains after controls are applied. This step is required by the CISM risk management process to determine whether the residual risk level is acceptable or if additional controls are needed. Option B correctly follows the risk assessment lifecycle: identify risk, apply controls, assess residual risk, then decide on further action.

Exam trap

The trap here is that candidates assume existing controls are sufficient and jump to acceptance (Option A) or repeat training (Option D), without recognizing that the CISM process mandates a formal residual risk evaluation before any risk response decision.

How to eliminate wrong answers

Option A is wrong because accepting risk without evaluating residual risk violates the CISM risk management process; acceptance is only appropriate after confirming that residual risk is within the organization's risk appetite. Option C is wrong because transferring risk to a cyber insurance provider does not reduce the likelihood or impact of phishing attacks; it only provides financial compensation after a loss, and is not a next step before evaluating residual risk. Option D is wrong because conducting another round of user awareness training without first evaluating residual risk is premature; the effectiveness of the existing training must be measured to determine if additional training is necessary.

Practice this question →
65
Drag & Dropmedium

Order the steps for implementing a data classification policy in an organization.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Data classification starts with defining categories, then procedures, training, labeling, and monitoring.

Practice this question →
66
MCQeasy

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

A.Risk avoidance
B.Risk reduction
C.Risk acceptance
D.Risk transfer
AnswerC

Accepting the risk is justified when mitigation costs outweigh potential loss.

Why this answer

Risk acceptance is the most effective strategy when the cost to mitigate exceeds the potential loss, as it is more cost-effective to accept the risk rather than spend more on controls than the expected loss. Risk avoidance (A) is incorrect because it would mean discontinuing the critical business process, which may not be feasible or desirable. Risk reduction (B) is incorrect because it involves implementing controls that are not cost-effective in this scenario.

Risk transfer (D) is incorrect because transferring risk (e.g., via insurance) may still involve premiums that exceed the potential loss or are otherwise not cost-justified.

Practice this question →
67
MCQmedium

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

A.Risk mitigation
B.Risk acceptance
C.Risk transfer
D.Risk avoidance
AnswerB

Why this answer

When mitigation cost exceeds potential loss, risk acceptance is appropriate if the risk is within the organization's risk appetite. Alternatively, risk transfer (e.g., insurance) could be considered, but acceptance is often the primary choice when the cost-benefit is negative.

Exam trap

Candidates may choose 'mitigate' without considering cost-benefit analysis; CISM emphasizes aligning treatment with business value.

Why the other options are wrong

A

Mitigation cost exceeds potential loss, making it inefficient.

C

Transfer (e.g., insurance) may still be expensive; acceptance is more direct when cost of transfer also high.

D

Avoidance would mean discontinuing the activity, which may not be feasible or cost-effective.

Practice this question →
68
MCQmedium

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

A.The impact of losing both primary and backup data is unacceptably high
B.The risk owner does not have authority to accept risks
C.Encryption is not required as the facility is secure
D.The cost of implementing encrypted offsite backups is minimal
AnswerA

A single event (fire, theft) could destroy both data and backup, leading to catastrophic business impact.

Why this answer

The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach.

The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.

Exam trap

A common misconception is that risk acceptance is always valid if the risk owner approves it. However, according to ISACA CISM principles, acceptance must align with the organization's risk appetite, and a high-impact risk cannot be accepted solely based on low likelihood.

How to eliminate wrong answers

Option B is wrong because the risk owner, typically a business process owner, generally has the authority to accept risks within their scope, unless explicitly restricted by policy; the question does not indicate such a restriction. Option C is wrong because it incorrectly assumes that a secure facility eliminates the need for encryption, but encryption is a critical control for data at rest to protect against unauthorized access even if physical security is breached (e.g., an insider threat or theft of storage media). Option D is wrong because the cost of implementing encrypted offsite backups is not the primary reason to challenge acceptance; risk acceptance decisions are based on risk appetite and impact, not solely on cost, and minimal cost does not automatically invalidate acceptance.

Practice this question →
69
MCQeasy

A risk manager is presenting risk treatment options to senior management. Which of the following is the BEST approach to communicate risk in a way that supports informed decision-making?

A.Focus only on high and extreme risks
B.Use technical language to accurately describe vulnerabilities
C.Translate risk into potential financial impact
D.Present risk in qualitative terms only
AnswerC

Financial impact is a common language for business decisions.

Why this answer

Translating risk into potential financial impact (Option C) is the best approach because it aligns risk with business objectives, enabling senior management to make cost-benefit decisions. Financial quantification, such as Annualized Loss Expectancy (ALE), provides a common language that executives understand, directly supporting informed decision-making on risk treatment options.

Exam trap

The trap here is that candidates may choose Option A (focusing only on high and extreme risks) because it seems efficient, but CISM emphasizes that risk communication must support informed decision-making across all risk levels, not just the most severe ones.

How to eliminate wrong answers

Option A is wrong because focusing only on high and extreme risks ignores residual risks and emerging threats, leading to incomplete risk posture visibility and potential blind spots in risk treatment. Option B is wrong because using technical language to describe vulnerabilities creates communication barriers with senior management, who need business-impact context rather than technical details. Option D is wrong because presenting risk in qualitative terms only (e.g., high/medium/low) lacks the precision needed for cost-benefit analysis, making it harder to prioritize investments and justify risk treatment decisions.

Practice this question →
70
Multi-Selecteasy

Which TWO of the following are valid risk response options?

Select 2 answers
A.Risk amplification
B.Risk neutralization
C.Risk mitigation
D.Risk acceptance
E.Risk retention
AnswersC, D

Implementing controls to reduce risk.

Why this answer

The correct answers are C (Risk mitigation) and D (Risk acceptance). These are two of the standard risk response options recognized in frameworks such as ISO 31000 and COBIT, alongside risk avoidance and risk transfer. Options A (Risk amplification) and B (Risk neutralization) are not standard risk response terms.

Option E (Risk retention) is sometimes considered a form of risk acceptance, but it is not listed as a separate standard response option; the question specifically expects 'acceptance' and 'mitigation' as the correct choices.

Practice this question →
71
MCQeasy

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

A.Switch to a fully quantitative risk assessment methodology.
B.Use a hybrid approach that includes both qualitative and quantitative assessments.
C.Replace qualitative scales with precise monetary values.
D.Continue using qualitative method since it is simpler.
AnswerB

Provides comprehensive risk information for decision-making.

Why this answer

A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

Exam trap

The trap here is that candidates assume 'quantitative' is always superior, ignoring the practical need for a hybrid approach that balances qualitative speed with quantitative rigor for decision-making.

How to eliminate wrong answers

Option A is wrong because a fully quantitative methodology requires extensive historical data, precise probability estimates, and can be resource-prohibitive; it may also create a false sense of precision when data is uncertain. Option C is wrong because replacing qualitative scales with precise monetary values without a structured quantitative model (e.g., Monte Carlo simulation) ignores the inherent uncertainty in risk estimation and can lead to misleadingly exact figures. Option D is wrong because continuing with only qualitative methods fails to provide the objective monetary data required for decisions like insurance coverage or budget allocation, violating the CISM principle of aligning risk management with business needs.

Practice this question →
72
MCQmedium

A financial institution is implementing a risk management program and needs to select a methodology that balances quantitative and qualitative factors, complies with regulatory requirements, and provides a consistent framework for risk assessment across business units. Which methodology would best meet these requirements?

A.FAIR
B.OCTAVE
C.ISO 27005
D.NIST SP 800-30
AnswerC

ISO 27005 provides a comprehensive risk management framework that supports both qualitative and quantitative approaches and is widely accepted for regulatory compliance.

Why this answer

ISO 27005 is the correct methodology because it provides a risk management framework that explicitly balances quantitative and qualitative factors, aligns with regulatory requirements like GDPR and SOX, and offers a consistent, scalable approach for risk assessment across diverse business units. It integrates seamlessly with ISO 27001, ensuring compliance and standardization.

Exam trap

The trap here is that candidates often confuse a risk assessment methodology (like FAIR or NIST SP 800-30) with a comprehensive risk management program methodology (like ISO 27005), which must include regulatory compliance and cross-unit consistency.

How to eliminate wrong answers

Option A (FAIR) is wrong because it is a quantitative-only model that focuses on financial loss quantification using Monte Carlo simulations, lacking the qualitative balancing and regulatory compliance framework required for a multi-business-unit environment. Option B (OCTAVE) is wrong because it is a self-directed, qualitative methodology designed for organizational risk assessment but does not inherently comply with external regulatory standards or provide a consistent framework for cross-unit integration. Option D (NIST SP 800-30) is wrong because it is a qualitative risk assessment guide for US federal agencies, not a comprehensive risk management program methodology, and it lacks the explicit regulatory compliance and quantitative-qualitative balance required for a financial institution.

Practice this question →
73
MCQhard

A security manager is preparing a risk report for the board of directors. Which of the following should be included to best support strategic risk-based decisions?

A.Operational metrics such as number of firewalls and intrusion detection alerts
B.List of all past security incidents and their root causes
C.Detailed vulnerability scan results and patch levels
D.Summary of top risks, risk appetite alignment, and treatment status
AnswerD

Board requires strategic overview.

Why this answer

The board requires strategic-level information to make risk-based decisions. Option D provides a summary of top risks, alignment with risk appetite, and treatment status, which directly supports strategic oversight. Operational details like firewall counts or patch levels are tactical and do not convey the business impact or risk posture needed for board-level decisions.

Exam trap

The trap here is that candidates confuse operational or technical details (like vulnerability scans or incident lists) with strategic risk information, failing to recognize that the board needs aggregated, business-aligned summaries to make informed decisions.

How to eliminate wrong answers

Option A is wrong because operational metrics such as number of firewalls and intrusion detection alerts are tactical, not strategic; they do not convey risk exposure or alignment with business objectives. Option B is wrong because a list of all past security incidents and root causes is historical and reactive, lacking forward-looking risk prioritization and treatment status. Option C is wrong because detailed vulnerability scan results and patch levels are technical and granular, overwhelming the board with data that does not summarize risk in business terms or show alignment with risk appetite.

Practice this question →
74
MCQeasy

During a risk assessment, a CISM identifies that the organization's data backup process has a single point of failure. The backup server is located in the same data center as the primary server. Which risk response is most appropriate?

A.Mitigate by moving the backup server to a geographically separate location.
B.Transfer the risk by purchasing business interruption insurance.
C.Avoid the risk by discontinuing the backup process.
D.Accept the risk because the cost of mitigation is high.
AnswerA

This reduces the likelihood of both servers being lost simultaneously.

Why this answer

Moving the backup server to a geographically separate location directly eliminates the single point of failure by ensuring that a localized disaster (e.g., fire, flood, power outage) at the primary data center does not simultaneously destroy both the primary and backup data. This is a classic risk mitigation strategy that reduces the likelihood and impact of data loss, aligning with the principle of geographic redundancy for disaster recovery.

Exam trap

The trap here is that candidates may confuse risk transfer (insurance) with risk mitigation (redundancy), or incorrectly assume that accepting the risk is acceptable when a clear, cost-effective mitigation exists, especially in a CISM scenario where the organization's risk appetite is not explicitly stated as high.

How to eliminate wrong answers

Option B is wrong because purchasing business interruption insurance transfers the financial risk of downtime but does not address the technical single point of failure; the backup data remains vulnerable to the same physical disaster as the primary server. Option C is wrong because discontinuing the backup process would avoid the risk of backup failure but introduces an unacceptable risk of permanent data loss, violating fundamental data protection and business continuity requirements. Option D is wrong because accepting the risk without justification is inappropriate when a cost-effective mitigation (moving the backup server) is available; the cost of mitigation is not inherently high, and the risk of total data loss typically outweighs the expense of geographic separation.

Practice this question →
75
Multi-Selectmedium

Which of the following are key components of an information security risk management program? (Select TWO)

Select 2 answers
A.Risk assessment
B.Vulnerability scanning
C.Risk treatment
D.Incident response
AnswersA, C

Why this answer

Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

Exam trap

ISACA often tests the distinction between program-level components (risk assessment, risk treatment) and operational activities (vulnerability scanning, incident response) to see if candidates understand that the risk management program is a strategic, governance framework, not a list of technical tasks.

Why the other options are wrong

B

Vulnerability scanning is a tool used within risk assessment, not a component of the program itself.

D

Incident response is a separate process, not a component of risk management.

Practice this question →
Page 1 of 2 · 97 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Cism Risk Management questions.

Start 20-question session