Emerging Risk and Threat Landscape CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a regulatory trend that could introduce emerging risk?

   • AA vendor's decision to change its product pricing model
   • BAn industry best practice for patch management
   • CA company's internal policy on acceptable use of social media
   • DA new data privacy law requiring organizations to report breaches within 72 hours
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the PRIMARY objective of risk horizon scanning?

   • ATo replace the need for regular risk assessments
   • BTo detect early signals of emerging risks and threats
   • CTo eliminate all potential risks from the organization's environment
   • DTo provide a historical record of past risk events
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A hospital is considering using IoT devices for patient monitoring. The CISO must balance the benefits of real-time data with the security risks. What is the most appropriate risk response?

   • ATransfer the risk to the device manufacturer through contracts
   • BProhibit the use of IoT devices entirely
   • CImplement a robust network segmentation and device management policy to isolate IoT devices
   • DAccept the risk without any controls because the devices are FDA-approved
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company's critical software vendor is located in a country that is imposing new export controls. The CISO must manage this emerging risk. What is the most balanced response?

   • AImmediately switch to a domestic vendor without evaluating the new vendor's security
   • BIgnore the risk because the vendor has a long-term contract
   • CDevelop a contingency plan that includes identifying alternative vendors and assessing the impact of potential loss of access
   • DStockpile all software licenses and updates
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A software company is preparing for a new privacy regulation that requires data minimization. The CISO must decide how to respond. What is the most effective approach?

   • ADelete all customer data immediately to ensure compliance
   • BWait for the regulation to be enforced before taking action
   • COnly update the privacy policy without changing data practices
   • DConduct a data inventory and implement data minimization controls in new development projects
   Reveal Solution Discussion Select an answer first