Risk Monitoring and Reporting CISM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization is subject to GDPR and must demonstrate compliance with its data protection policies. The CISO wants to ensure that all employees are following the data handling procedures. Which activity is most directly aligned with this goal?

   • AProvide additional training to employees on data protection.
   • BReview the risk register to identify new data protection risks.
   • CUpdate the data protection policy to reflect new regulatory changes.
   • DConduct periodic audits of data handling practices against the organization's policies.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare organization must comply with HIPAA and has implemented a risk management program. The CISO wants to ensure that all security policies are being followed by employees. Which monitoring activity is most appropriate?

   • AImplement a new security awareness training program.
   • BReview the risk register to update risk ratings.
   • CConduct regular compliance audits of access controls and data handling procedures.
   • DPerform a vulnerability scan of the network.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services firm has established a risk appetite that tolerates a maximum of 15% of customer accounts with outdated security patches. The CISO wants to detect when the organization is approaching this threshold before it is breached. Which action best supports this objective?

   • AImplement a key risk indicator that tracks the percentage of accounts with outdated patches and set a warning threshold at 10%.
   • BConduct a quarterly risk assessment to identify new threats that could affect the patch management process.
   • CReview the risk register monthly to see if any existing risks have changed in likelihood or impact.
   • DEscalate any reported security incident to the board of directors immediately.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of an ongoing risk monitoring process?

   • ATo document risks only after a security incident has occurred
   • BTo replace the need for periodic formal risk assessments
   • CTo eliminate all risks that have been identified in the risk assessment
   • DTo ensure that current risk levels remain within the organization's risk appetite
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A KRI for a critical supplier has been trending upward for three months and is now at the warning threshold. The supplier is essential to operations, and replacing them would be costly. The CISO must decide whether to escalate. What is the most important factor in this decision?

   • AThe opinion of the risk owner.
   • BThe cost of replacing the supplier.
   • CThe trend and the likelihood that the risk will exceed the risk appetite.
   • DThe supplier's historical performance.
   Reveal Solution Discussion Select an answer first