(CISM) General Flashcards

During a risk assessment, the team identifies a vulnerability with a high likelihood but very low impact. How should this risk MOST likely be treated?

Answer: Mitigate it with low-cost controls proportional to impact

Risk treatment should be proportional; high-likelihood, low-impact risks warrant lightweight mitigating controls rather than expensive remediation or acceptance.

A third-party vendor has access to the organization's sensitive systems. Which control BEST reduces the associated risk?

Answer: Conducting periodic vendor security assessments and right-to-audit clauses

Periodic assessments and right-to-audit clauses provide ongoing assurance that vendors maintain required security standards throughout the relationship.

Which factor MOST influences the priority of information security risk treatment?

Answer: The likelihood and potential business impact of the risk

Risk prioritization is driven by the combination of likelihood and business impact, ensuring the most critical risks receive attention first.

An organization accepts a residual risk. What does this mean?

Answer: The remaining risk after controls are applied is deemed tolerable

Residual risk is what remains after controls are applied; accepting it means management finds the remaining exposure within tolerance.

Which of the following is the PRIMARY purpose of a Business Impact Analysis (BIA)?

Answer: To determine the criticality of business processes and recovery time requirements

A BIA identifies critical business functions, their dependencies, and the time within which they must be restored to avoid unacceptable consequences.

A risk treatment option that involves sharing risk with another party, such as through outsourcing, is BEST described as:

Answer: Risk transfer

Risk transfer shifts the financial or operational burden of a risk to a third party, such as an insurer or outsourced provider.

When performing information risk assessments, which approach provides the MOST objective results?

Answer: Combining quantitative data with qualitative expert judgment

A hybrid approach leverages measurable data for objectivity while using expert judgment to address gaps that tools and metrics cannot fully capture.