Risk Assessment and Analysis CISM Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A healthcare organization has a risk that spans multiple departments: IT manages the technical controls, legal handles regulatory compliance, and operations manages patient data access. The CISO needs to ensure the risk is managed effectively. Which action is most appropriate?

   • AEscalate the risk to the board and let them manage it
   • BAssign each department as a co-owner with equal responsibility
   • CAssign a single risk owner with authority across departments to coordinate the response
   • DLet the IT department own the risk because it controls the technical aspects
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has completed a risk assessment and identified several risks. The CISO wants to ensure that the assessment results are used to drive decisions and actions, not just stored in a document. Which action best integrates the assessment into the risk management process?

   • APublish the assessment report on the company intranet
   • BFile the assessment report in the risk management archive
   • CPresent the results to the board and take no further action
   • DUse the assessment results to update the risk register, develop treatment plans, and assign owners
   Reveal Solution Discussion Select an answer first
4. 33application · medium · select all that apply

   A company has identified a risk related to its customer data processing. The CISO wants to ensure proper risk ownership. Which of the following are key responsibilities of a risk owner? (Select all that apply.)

   • AEliminating the risk entirely
   • BAccepting all risks on behalf of the organization
   • CReporting on the risk status to senior management
   • DMonitoring the risk on an ongoing basis
   • EImplementing the risk treatment plan
   Check answers Discussion Select an answer first
5. 34application · medium · select all that apply

   A company has completed a risk assessment and needs to document the results. Which of the following are appropriate outputs of a risk assessment? (Select all that apply.)

   • AA risk heat map showing likelihood and impact
   • BA compliance certificate from a regulatory body
   • CA detailed report for management with prioritized recommendations
   • DA risk register listing identified risks, scores, and owners
   • EA list of all vulnerabilities found in the network
   Check answers Discussion Select an answer first
6. 35expert · hard

   A bank has a conservative risk appetite and must prioritize two risks: (1) a high-likelihood, low-impact phishing risk that affects many employees, and (2) a low-likelihood, high-impact fraud risk that could result in regulatory fines. The bank has limited resources and can only address one risk this quarter. Which risk should the bank prioritize?

   • ABoth equally, because they are both risks
   • BThe phishing risk, because it affects more employees
   • CThe phishing risk, because high likelihood means it will certainly occur
   • DThe fraud risk, because its high impact exceeds the bank's risk appetite despite low likelihood
   Reveal Solution Discussion Select an answer first