Which of the following is the PRIMARY purpose of categorizing emerging risks during the identification process?

To organize risks into meaningful groups to support analysis and response prioritization

To eliminate all risks that are not directly related to technology

To satisfy regulatory requirements for risk reporting

To assign a monetary value to each risk for insurance purposes

A technology company relies on a single overseas chip manufacturer for critical components. Recent geopolitical tensions have increased the risk of supply disruption. How should the CISO integrate this emerging risk into the risk management framework?

Ignore the risk because it is outside the organization's control

Only report the risk to the board without any further action

Immediately terminate the relationship with the supplier

Add the risk to the risk register and assign a risk owner to monitor and develop mitigation strategies

Which of the following BEST describes how emerging risk information should be integrated into the risk management framework?

By waiting until the risks have fully materialized before adding them to the register

By updating the risk register and incorporating the risks into existing risk assessment processes

By keeping emerging risks separate from the main risk register to avoid confusion

By only reporting emerging risks to the board without involving operational management

A healthcare organization is considering deploying AI-based diagnostic tools that process patient data. The CISO must assess the risk implications. Which risk is most directly introduced by this emerging technology?

Data privacy and model bias leading to incorrect diagnoses

Compatibility issues with legacy fax machines

Higher electricity consumption of data centers

Increased physical theft of servers

Which of the following activities is an example of risk horizon scanning?

Conducting a quarterly internal audit of access controls

Reviewing a vendor's annual financial audit report

Monitoring academic research and industry publications for new vulnerabilities

Performing a post-incident review after a security breach

Certified Information Security Manager

Domain 2Objective 1

Emerging Risk and Threat Landscape CISM Practice Questions (Page 4)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

35questions here

7free pages

8concepts

20%of the exam

Questions 16–20

16foundation · easy
Which of the following is the PRIMARY purpose of categorizing emerging risks during the identification process?
Select an answer first
17application · medium
A technology company relies on a single overseas chip manufacturer for critical components. Recent geopolitical tensions have increased the risk of supply disruption. How should the CISO integrate this emerging risk into the risk management framework?
Select an answer first
18foundation · easy
Which of the following BEST describes how emerging risk information should be integrated into the risk management framework?
Select an answer first
19application · medium
A healthcare organization is considering deploying AI-based diagnostic tools that process patient data. The CISO must assess the risk implications. Which risk is most directly introduced by this emerging technology?
Select an answer first
20foundation · easy
Which of the following activities is an example of risk horizon scanning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.