Risk Monitoring and Reporting CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which activity is an example of compliance monitoring?

   • APeriodically reviewing access control logs against policy requirements
   • BPurchasing new security software
   • CDeveloping a new security policy
   • DConducting a one-time risk assessment
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key outcome of using monitoring results for continuous improvement?

   • AA static risk management framework that never changes
   • BReduced need for stakeholder communication
   • CEnhanced effectiveness of risk management controls and processes
   • DElimination of all residual risk
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a common risk metric used to present risk status to management?

   • ANumber of open high-risk findings
   • BTotal number of employees
   • CCompany revenue
   • DNumber of office locations
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key element of effective risk communication to non-technical stakeholders?

   • AUsing business language and focusing on potential impact
   • BSharing all risk details with every audience equally
   • CUsing highly technical jargon to demonstrate expertise
   • DProviding only raw data without interpretation
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which factor should be considered when determining the frequency of risk reports to management?

   • AThe color scheme of the dashboard
   • BThe personal preference of the security team
   • CThe number of employees in the organization
   • DThe level of risk and the speed at which it can change
   Reveal Solution Discussion Select an answer first