Risk Monitoring and Reporting CISM Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A technology company is considering a new cloud service that will store customer data. The CISO wants to monitor the risk of data exposure. Which KRI would provide the most meaningful early warning of increasing risk?

   • APercentage of customer data encrypted at rest and in transit.
   • BMonthly cost of the cloud service.
   • CTotal amount of customer data stored in the cloud.
   • DNumber of cloud service providers used by the organization.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When should a risk register be updated?

   • AOnly when a risk materializes into an incident
   • BNever, once the initial risk assessment is complete
   • CWhenever there is a significant change in the risk environment or treatment plan
   • DOnly at the end of the fiscal year
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A CISO must report on a new critical vulnerability to both the board of directors and the IT operations team. The board needs to understand the business impact, while the IT team needs to know the technical details and required actions. What is the most effective reporting approach?

   • APrepare two separate reports: a high-level business impact summary for the board and a technical briefing for the IT team.
   • BSend a high-level summary to both audiences and let them ask for more details.
   • CSend the same detailed technical report to both audiences.
   • DHold a joint meeting and present the technical details to both groups.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A CISO wants to provide the board with a high-level view of the organization's risk exposure, including the number of critical risks and the trend over time. Which set of metrics is most appropriate for this dashboard?

   • AList of all risk owners and their assigned risks.
   • BNumber of security incidents and average response time.
   • CNumber of open critical risks, percentage of risks within appetite, and trend of risk scores over time.
   • DDetailed vulnerability counts by severity and patch status.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A CISO needs to present the organization's risk posture to the executive committee. The committee wants to see trends over the past year and the current status of top risks. Which dashboard technique is most effective for this purpose?

   • AA bar chart comparing the number of open risks across departments.
   • BA pie chart showing the percentage of risks in each category.
   • CA line chart showing the trend of key risk indicators over time, with a summary table of top risks.
   • DA list of all risks in the risk register with their scores.
   Reveal Solution Discussion Select an answer first