Risk Assessment and Analysis CISM Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A financial institution performs risk assessments annually. This year, it experienced a major data breach and also adopted a new cloud-based core banking system. The CISO must decide on the risk assessment schedule for the upcoming year. Which approach is most appropriate?

   • AWait for the next annual assessment because the schedule is fixed
   • BConduct an immediate ad-hoc assessment due to the breach and system change, then resume annual assessments
   • CConduct only a vulnerability scan of the new cloud system
   • DMove to quarterly assessments permanently
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A software company performs a full risk assessment annually. Mid-year, the company acquires a smaller firm and integrates its customer database into the main network. According to risk assessment best practices, what should the company do?

   • APerform a vulnerability scan on the new database only
   • BConduct an ad-hoc risk assessment because the acquisition introduces new assets and threats
   • CWait until the next annual assessment to evaluate the new risks
   • DUpdate the risk register with the new asset but do not assess it
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional bank must justify its annual security budget to the board. The CISO has detailed historical loss data for past incidents (e.g., fraud losses, downtime costs) and needs to present risk in monetary terms that the board can compare against potential investments. Which risk assessment approach is most appropriate?

   • AQuantitative assessment using SLE, ARO, and ALE calculations
   • BQualitative assessment using a high/medium/low risk matrix
   • CHybrid assessment that only uses qualitative for all risks
   • DCompliance-based assessment aligned to regulatory requirements
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A hospital is assessing risks to its patient portal. The assessment team has identified that the portal stores sensitive health data, that a specific malware variant could exploit a known unpatched vulnerability, and that a breach could result in regulatory fines and reputational damage. Which combination of elements has the team identified?

   • AThreat, vulnerability, and control
   • BVulnerability, threat, and risk appetite
   • CAsset, threat, and vulnerability
   • DAsset, vulnerability, and impact
   Reveal Solution Discussion Select an answer first
6. 30application · medium · select all that apply

   A university is conducting a risk assessment for its online learning platform. The assessment team is identifying risks. Which of the following are examples of risk identification techniques? (Select all that apply.)

   • ACalculating the ALE for a potential data breach
   • BConducting vulnerability scans on the platform's web servers
   • CInterviewing system administrators about past incidents and known issues
   • DDefining the organization's risk appetite
   • EReviewing threat intelligence reports for malware targeting educational institutions
   Check answers Discussion Select an answer first