CIM Risk Assessment & Mitigation 3

Question 1

Which scenario BEST illustrates the concept of 'residual risk'?

Accepted Answer

The risk remaining after all mitigation measures have been applied

Answer

Residual risk is the exposure that remains after controls and mitigations have been applied to the inherent risk.

Question 2

A CIM professional is conducting a risk assessment and needs to prioritize risks for treatment. Which criterion should be applied FIRST?

Accepted Answer

The combination of likelihood and impact scores

Answer

Risk prioritization is fundamentally based on the product of likelihood and impact, identifying which risks pose the greatest overall threat.

Question 3

An organization mandates that all third-party vendors complete a security questionnaire before contract award. This is an example of:

Accepted Answer

Supply chain risk mitigation

Answer

Vetting vendors through security questionnaires is a proactive supply chain risk mitigation practice.

Question 4

When applying the DREAD risk scoring model, which of the following is NOT one of the five scoring categories?

Accepted Answer

Asset criticality

Answer

DREAD stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability — asset criticality is not a DREAD dimension.

Question 5

In the context of risk treatment, 'risk transfer' is MOST effectively achieved through:

Accepted Answer

Purchasing cyber liability insurance or outsourcing to a third party

Answer

Risk transfer shifts the financial consequences of a risk to another party, typically via insurance or contractual agreements.

(CIM) Certified Incident Manager Practice Test