Emerging Risk and Threat Landscape CISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization has identified several emerging risks, including AI bias, quantum computing, and new privacy regulations. The CISO must integrate these into the risk management framework. What is the most effective approach?

   • APrioritize risks based on likelihood and impact, and assign owners for each
   • BTreat all risks equally with the same response
   • COnly focus on the risk with the highest media attention
   • DCreate a separate risk register for each risk without linking to the main framework
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational manufacturer sources rare-earth magnets from a single supplier in a region experiencing escalating trade restrictions. The CISO is updating the risk register and needs to categorize this emerging risk. Which categorization is most appropriate?

   • ASocietal expectation risk
   • BTechnological obsolescence risk
   • CGeopolitical and supply chain risk
   • DRegulatory compliance risk
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team observes a new attack pattern where attackers exploit misconfigured cloud storage buckets to exfiltrate data. The CISO wants to analyze this threat. Which factor is most important to consider?

   • AThe brand of the cloud service provider
   • BThe color of the cloud storage buckets
   • CThe number of employees in the security team
   • DThe motivation of the threat actor and the ease of exploitation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization wants to improve its ability to detect emerging risks early. Which action is most aligned with horizon scanning?

   • AIncreasing the frequency of internal vulnerability scans
   • BConducting a post-incident review of the last breach
   • CPurchasing more cybersecurity insurance
   • DEstablishing a cross-functional team to review external threat intelligence and industry reports on a regular basis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A global e-commerce company learns that a new data protection regulation will take effect next year, requiring stricter consent mechanisms. The CISO needs to evaluate the emerging risk. What is the most appropriate first step?

   • AOutsource all data processing to a third party to avoid compliance
   • BIgnore the regulation until it is officially enforced
   • CConduct a gap analysis of current consent processes against the new requirements
   • DImmediately implement the most stringent consent mechanism available
   Reveal Solution Discussion Select an answer first