Information Security Risk Management →mediumMultiple SelectObjective-mapped

CISM Information Security Risk Management Practice Question

Which TWO of the following are common approaches to information security risk assessment?

⚠ Common exam trap

Candidates often confuse risk assessment approaches (qualitative/quantitative) with risk assessment activities (like penetration testing or vulnerability assessment), which are tools used within the assessment process but not the overarching methodology itself.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Qualitative

Qualitative risk assessment uses subjective ratings (e.g., high, medium, low) based on expert judgment to evaluate the likelihood and impact of risks. It is a common approach because it is quick to perform and does not require precise numerical data, making it suitable for initial risk prioritization in information security management.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Qualitative
Why this is correct
Uses descriptive scales.
✓
Quantitative
Why this is correct
Uses numerical data.
✗
Penetration testing
Why it's wrong here
A security test, not a risk assessment approach.
✗
Vulnerability assessment
Why it's wrong here
Part of risk assessment, not an approach.
✗
Business impact analysis
Why it's wrong here
Focuses on impact, not risk assessment.

Go deeper

CISM Information Security Risk Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question