CISM Information Risk Management 3

Question 1

What is Annual Loss Expectancy (ALE) used for in quantitative risk assessment?

Accepted Answer

To estimate the expected financial loss from a risk over a year

Answer

To calculate the number of incidents per year

Answer

To measure employee productivity loss from security training

Answer

To determine the cost of deploying a new firewall

Question 2

A risk assessment reveals that a control is more expensive than the risk it mitigates. A CISM should RECOMMEND:

Accepted Answer

Accepting the risk if it falls within the risk appetite

Answer

Implementing the control anyway for compliance purposes

Answer

Escalating to law enforcement immediately

Answer

Outsourcing the entire IT function

Question 3

Which of the following is MOST important when establishing risk assessment criteria?

Accepted Answer

Aligning criteria with the organization's business objectives and risk appetite

Answer

Using the same criteria as peer organizations in the industry

Answer

Adopting criteria from the most recent regulatory guidance

Answer

Selecting criteria that minimize the number of identified risks

Question 4

A CISM discovers that business units are making risk decisions without consulting the security team. The BEST corrective action is to:

Accepted Answer

Implement mandatory security reviews into the project management process

Answer

Report all business units to senior management immediately

Answer

Restrict business units from making any IT-related decisions

Answer

Purchase risk management software for all business units

Question 5

Which of the following BEST describes a threat in the context of information security risk?

Accepted Answer

A potential cause of an unwanted event that could harm an asset

Answer

A weakness in a system or process

Answer

The financial impact of a security breach

Answer

A control that has failed to prevent an incident

Question 6

In risk management, which of the following BEST defines a 'vulnerability'?

Accepted Answer

A weakness that can be exploited by a threat to cause harm

Answer

A malicious actor targeting the organization

Answer

The probability that a risk event will occur

Answer

The financial loss resulting from a security incident