CISM (CISM) General 3

Question 1

During a risk assessment, the team identifies a vulnerability with a high likelihood but very low impact. How should this risk MOST likely be treated?

Accepted Answer

Mitigate it with low-cost controls proportional to impact

Answer

Risk treatment should be proportional; high-likelihood, low-impact risks warrant lightweight mitigating controls rather than expensive remediation or acceptance.

Question 2

A third-party vendor has access to the organization's sensitive systems. Which control BEST reduces the associated risk?

Accepted Answer

Conducting periodic vendor security assessments and right-to-audit clauses

Answer

Periodic assessments and right-to-audit clauses provide ongoing assurance that vendors maintain required security standards throughout the relationship.

Question 3

Which factor MOST influences the priority of information security risk treatment?

Accepted Answer

The likelihood and potential business impact of the risk

Answer

Risk prioritization is driven by the combination of likelihood and business impact, ensuring the most critical risks receive attention first.

Question 4

An organization accepts a residual risk. What does this mean?

Accepted Answer

The remaining risk after controls are applied is deemed tolerable

Answer

Residual risk is what remains after controls are applied; accepting it means management finds the remaining exposure within tolerance.

Question 5

Which of the following is the PRIMARY purpose of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the criticality of business processes and recovery time requirements

Answer

A BIA identifies critical business functions, their dependencies, and the time within which they must be restored to avoid unacceptable consequences.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) General 3