Risk Assessment and Analysis CISM Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   During risk identification, which activity involves recognizing potential sources of harm that could exploit a vulnerability?

   • AThreat identification
   • BControl assessment
   • CAsset valuation
   • DRisk appetite definition
   Reveal Solution Discussion Select an answer first
2. 7application · medium · select all that apply

   A company is evaluating risks using a qualitative risk matrix. Which of the following factors are typically used to prioritize risks in this method? (Select all that apply.)

   • AThe number of vulnerabilities found in a scan
   • BImpact on the organization
   • CLikelihood of occurrence
   • DThe organization's risk appetite
   • EThe exact monetary value of each risk
   Check answers Discussion Select an answer first
4. 8application · medium

   A company has completed a risk assessment and identified a high-risk vulnerability in its remote access solution. The CISO must decide how to integrate this finding into the broader risk management process. Which action is most appropriate?

   • AInform the board and take no further action
   • BDevelop a risk treatment plan and assign a risk owner
   • CDocument the risk in the risk register and close the assessment
   • DImmediately purchase new remote access software
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of assigning risk ownership?

   • ATo transfer all risk to the owner
   • BTo ensure clear accountability for managing risks
   • CTo shift liability to external parties
   • DTo eliminate the need for risk assessments
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which step in the risk management process directly follows risk assessment?

   • ARisk communication
   • BRisk identification
   • CRisk monitoring
   • DRisk treatment
   Reveal Solution Discussion Select an answer first