During a security awareness training session, the CISO needs to explain to non-technical employees why a new phishing simulation program is being implemented. Which communication strategy is most effective for this audience?

Share the latest threat intelligence report with all employees.

State that the program is mandatory and employees must comply without further explanation.

Provide a detailed explanation of the SMTP protocol and email header analysis.

Use real-world examples of phishing attacks and explain how the program helps protect both the company and employees' personal information.

An organization has a compliance monitoring program that identifies recurring violations of a data retention policy. Despite repeated reports, the violations continue. What is the most effective way to improve compliance?

Increase the frequency of compliance audits.

Analyze the root cause of the violations and implement process or training changes.

Escalate the violations to senior management.

Revise the data retention policy to be less restrictive.

What is the primary purpose of a key risk indicator (KRI)?

To replace the need for risk assessments

To measure the financial value of all organizational assets

To provide an early warning signal of increasing risk exposure

To document all past security incidents

Which of the following is an example of a key risk indicator (KRI)?

Number of floors in the headquarters building

Total number of employees in the organization

Number of unresolved critical vulnerabilities in the environment

What is the primary purpose of risk reporting to stakeholders?

To provide relevant risk information for informed decision-making

To replace the need for risk assessments

To assign blame for security incidents

To satisfy all regulatory requirements without exception

Certified Information Security Manager

Domain 2Objective 6

Risk Monitoring and Reporting CISM Practice Questions (Page 2)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

37questions here

8free pages

9concepts

20%of the exam

Questions 6–10

6application · medium
During a security awareness training session, the CISO needs to explain to non-technical employees why a new phishing simulation program is being implemented. Which communication strategy is most effective for this audience?
Select an answer first
7expert · hard
An organization has a compliance monitoring program that identifies recurring violations of a data retention policy. Despite repeated reports, the violations continue. What is the most effective way to improve compliance?
Select an answer first
8foundation · easy
What is the primary purpose of a key risk indicator (KRI)?
Select an answer first
9foundation · easy
Which of the following is an example of a key risk indicator (KRI)?
Select an answer first
10foundation · easy
What is the primary purpose of risk reporting to stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.