In threat landscape analysis, which of the following BEST describes the role of understanding threat actor motivations?

To identify which assets are most likely to be targeted and why

To eliminate the need for technical vulnerability scanning

To predict the exact date and time of a future attack

To determine the legal jurisdiction for prosecuting attackers

The CISO needs to report an emerging threat to the board. The threat involves a new zero-day vulnerability in a widely used software. What is the most appropriate way to communicate this?

Provide the technical details of the vulnerability and exploit code

Explain the potential business impact and recommend immediate patching or compensating controls

Downplay the threat to avoid alarming the board

Only mention it in the annual report

Which of the following is an example of a NEW attack vector that has emerged in the evolving threat landscape?

Denial-of-service attacks using botnets

Phishing emails targeting employees to steal credentials

Malware distributed via infected USB drives

Exploitation of vulnerabilities in Internet of Things (IoT) devices

The CISO has identified a new ransomware strain that specifically targets the organization's industry. The board needs to understand the risk and decide on a response. What is the most effective way to communicate this emerging threat?

Issue a press release to warn the public about the ransomware

Wait until the threat materializes before informing the board

Present a concise briefing that explains the threat, its potential impact, and recommended response options with associated costs

Send a detailed technical report with all known indicators of compromise

A global bank is evaluating the risk of a new AI-based fraud detection system. The system will process customer data across multiple jurisdictions. The CISO must identify the most critical emerging risk that requires immediate attention.

Data privacy and cross-border data transfer compliance

The potential for the AI system to be hacked by competitors

The need for additional training for employees

The cost of the AI system implementation

Certified Information Security Manager

Domain 2Objective 1

Emerging Risk and Threat Landscape CISM Practice Questions (Page 5)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

35questions here

7free pages

8concepts

20%of the exam

Questions 21–25

21foundation · easy
In threat landscape analysis, which of the following BEST describes the role of understanding threat actor motivations?
Select an answer first
22application · medium
The CISO needs to report an emerging threat to the board. The threat involves a new zero-day vulnerability in a widely used software. What is the most appropriate way to communicate this?
Select an answer first
23foundation · easy
Which of the following is an example of a NEW attack vector that has emerged in the evolving threat landscape?
Select an answer first
24application · medium
The CISO has identified a new ransomware strain that specifically targets the organization's industry. The board needs to understand the risk and decide on a response. What is the most effective way to communicate this emerging threat?
Select an answer first
25expert · hard
A global bank is evaluating the risk of a new AI-based fraud detection system. The system will process customer data across multiple jurisdictions. The CISO must identify the most critical emerging risk that requires immediate attention.
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.