A company's primary cloud provider is headquartered in a country that is entering a trade war. The CISO must assess the emerging risk. What is the most appropriate response?

Only monitor the situation without any action

Ignore the risk because the provider has a strong reputation

Evaluate the potential impact on data access and consider multi-cloud or regional diversification

Immediately migrate all workloads to a domestic provider without analysis

When communicating emerging risks to stakeholders, which of the following is an appropriate recommended risk response to include?

Ignoring the risk until it materializes

Guaranteeing that the risk will not occur

Transferring all risk to the IT department

Implementing additional controls to mitigate the risk

What is the PRIMARY purpose of integrating emerging risk information into the organization's overall risk management framework?

To transfer all emerging risks to the insurance provider

To replace the existing risk register with a new one

To ensure that emerging risks are considered alongside existing risks in decision-making

To eliminate the need for separate risk assessments

A manufacturing company wants to implement a horizon scanning program but has limited budget and staff. The CISO must choose the most effective approach. Which approach balances cost and effectiveness?

Rely solely on free open-source intelligence without dedicated staff

Subscribe to a commercial threat intelligence service and assign a small team to review weekly reports

Build an in-house team of 20 analysts to monitor all sources manually

Purchase an expensive AI-driven platform and hire consultants to manage it

A multinational corporation learns that a new regulation will require mandatory breach notification within 24 hours. The CISO needs to assess the emerging risk. What is the most significant risk introduced by this regulation?

Reduced need for security monitoring

Operational strain on incident response processes to meet the tight timeline

Higher costs of coffee for the security team

Increased risk of physical theft of laptops

Certified Information Security Manager

Domain 2Objective 1

Emerging Risk and Threat Landscape CISM Practice Questions (Page 1)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

35questions here

7free pages

8concepts

20%of the exam

Questions 1–5

1application · medium
A company's primary cloud provider is headquartered in a country that is entering a trade war. The CISO must assess the emerging risk. What is the most appropriate response?
Select an answer first
2foundation · easy
When communicating emerging risks to stakeholders, which of the following is an appropriate recommended risk response to include?
Select an answer first
3foundation · easy
What is the PRIMARY purpose of integrating emerging risk information into the organization's overall risk management framework?
Select an answer first
4expert · hard
A manufacturing company wants to implement a horizon scanning program but has limited budget and staff. The CISO must choose the most effective approach. Which approach balances cost and effectiveness?
Select an answer first
5application · medium
A multinational corporation learns that a new regulation will require mandatory breach notification within 24 hours. The CISO needs to assess the emerging risk. What is the most significant risk introduced by this regulation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.