CIM Risk Assessment & Mitigation 4

Question 1

An incident manager discovers that a critical server has an open RDP port exposed to the internet. Using the risk equation Risk = Threat × Vulnerability × Impact, which variable does the open port MOST directly affect?

Accepted Answer

Vulnerability

Answer

An open, exposed port is a vulnerability — a weakness that increases exploitability regardless of who the threat actor is.

Question 2

Which of the following BEST describes a 'black swan' event in risk management?

Accepted Answer

A rare, high-impact event that was not predicted by historical models

Answer

Black swan events are characterized by extreme rarity, severe impact, and the tendency to be rationalized in hindsight as predictable.

Question 3

During a tabletop exercise, the team discovers their risk assessment missed a critical interdependency between two systems. This finding MOST directly highlights a gap in:

Accepted Answer

Business impact analysis completeness

Answer

Missed interdependencies between systems are a BIA gap — the analysis failed to map how one system's failure cascades to another.

Question 4

ISO 31000 recommends that risk management should be:

Accepted Answer

Integrated into all organizational processes and decision-making

Answer

ISO 31000 positions risk management as an integrated, ongoing organizational function embedded in all processes — not a periodic standalone activity.

Question 5

A Failure Mode and Effects Analysis (FMEA) assigns a Risk Priority Number (RPN) by multiplying three factors. Which combination is correct?

Accepted Answer

Severity × Occurrence × Detection

Answer

FMEA RPN = Severity × Occurrence × Detection, where each factor is scored 1–10.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Risk Assessment & Mitigation 4