CISM Information Risk Management 3

Question 1

What is Annual Loss Expectancy (ALE) used for in quantitative risk assessment?

Accepted Answer

To estimate the expected financial loss from a risk over a year

Answer

ALE (ALE = SLE × ARO) estimates the expected annual financial loss from a specific risk, used to justify security investments through cost-benefit analysis.

Question 2

A risk assessment reveals that a control is more expensive than the risk it mitigates. A CISM should RECOMMEND:

Accepted Answer

Accepting the risk if it falls within the risk appetite

Answer

When a control's cost exceeds the risk value it addresses, accepting the risk is appropriate if it aligns with the organization's defined risk appetite.

Question 3

Which of the following is MOST important when establishing risk assessment criteria?

Accepted Answer

Aligning criteria with the organization's business objectives and risk appetite

Answer

Risk assessment criteria must reflect the organization's specific business objectives and risk appetite to produce meaningful and actionable results.

Question 4

A CISM discovers that business units are making risk decisions without consulting the security team. The BEST corrective action is to:

Accepted Answer

Implement mandatory security reviews into the project management process

Answer

Embedding mandatory security reviews into project management processes ensures risk is systematically considered before business decisions are finalized.

Question 5

Which of the following BEST describes a threat in the context of information security risk?

Accepted Answer

A potential cause of an unwanted event that could harm an asset

Answer

A threat is any potential cause of an unwanted incident that could result in harm to an organization's assets or operations.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Information Risk Management 3